Design Infrastructure Solutions

You are planning to migrate several physical on-premises application servers to Azure. To prevent application downtime and network latency issues post-migration, you need to identify which servers have active network connections with each other so that they can be migrated in the same group. Which Azure Migrate feature should you use to map these server relationships?

An organization is designing an event-driven system to process data files uploaded to Azure Blob Storage. The file sizes range from $10$ MB to $500$ MB, and the processing time for a single file can take up to $15$ minutes to complete. The system must process files as they are uploaded, scale down to zero instances when no files are present to minimize costs, and require the lowest possible administrative overhead. Which Azure compute solution should you recommend?

A media streaming company is designing a serverless video processing and distribution portal. The architecture requires two workloads:

* User portal frontend: A static single-page application (SPA) that must be globally distributed with minimal latency, SSL termination, and custom domain support.
* Video encoding microservice: A containerized workload that processes uploaded video files. The encoding job takes $15$ to $20$ minutes to run per video, and compute resources must only be active during the encoding process to avoid baseline idle charges.

Which two Azure hosting solutions should you recommend to meet these requirements? (Choose two.)

An enterprise is designing a regional load balancing and traffic delivery solution in Azure. The design must satisfy the following requirements:
1. Incoming public HTTP/S traffic must be routed based on the URL path: requests to `/search/*` must be forwarded to a Virtual Machine Scale Set, while requests to `/checkout/*` must be forwarded to a group of Dedicated Hosts.
2. SSL/TLS termination must be performed at the application routing boundary to decrypt traffic before reaching the backend VMs.
3. Internal database replication traffic on TCP port 6379 must be load-balanced across database virtual machines distributed across multiple Availability Zones for high availability.
4. The database virtual machines are currently configured with Basic SKU Public IP addresses for legacy remote access.

Which configuration should you select to satisfy all requirements and ensure successful deployment validation?

A company is planning to restrict outbound network traffic from an Azure Virtual Network subnet named Subnet1. The virtual machines in Subnet1 must be allowed to send metric and log data to Azure Monitor, but all other outbound internet traffic must be blocked. You need to design a Network Security Group (NSG) rule configuration for Subnet1 that permits this traffic while minimizing administrative effort and avoiding manual rule updates when Azure Monitor IP addresses change. Which rule configuration should you recommend?

An organization plans to migrate several on-premises Hyper-V virtual machines to Azure. You need to use Azure Migrate to perform a migration assessment, determine VM readiness, and estimate monthly costs. Which two initial tasks must you perform to complete this assessment? (Choose two.)

An enterprise is designing a hub-and-spoke network topology in Azure with the following resource configurations:

* Hub VNet (`vnet-hub-weur`): Address space $10.200.0.0/16$. Contains an Azure VPN Gateway in the `GatewaySubnet` and a Network Virtual Appliance (NVA) at IP $10.200.1.4$ in `subnet-nva`.
* Spoke A VNet (`vnet-prod-weur`): Address space $10.201.0.0/16$. Contains application servers in `subnet-app` ($10.201.1.0/24$).
* Spoke B VNet (`vnet-shared-weur`): Address space $10.202.0.0/16$. Contains shared services in `subnet-data` ($10.202.1.0/24$).

Virtual network peering is established between `vnet-prod-weur` and `vnet-hub-weur`, and between `vnet-shared-weur` and `vnet-hub-weur`. There is no direct peering between the two spokes.

A route table named `rt-prod-app` is associated with `subnet-app` and has the following User Defined Routes (UDRs) configured:
* Destination: $0.0.0.0/0$, Next hop: Virtual appliance ($10.200.1.4$)
* Destination: $10.0.0.0/8$, Next hop: Virtual network gateway

The on-premises network uses the address space $10.0.0.0/8$. All traffic from `subnet-app` to Spoke B must go through the NVA for inspection. During testing, administrators observe that servers in `subnet-app` can reach the internet and on-premises resources, but cannot communicate with `subnet-data` in Spoke B.

Which of the following routing configurations will resolve the connectivity issue to Spoke B while maintaining all other security and routing requirements?

A multinational enterprise is designing a high-availability infrastructure in Azure for a new online banking application. The design must meet the following requirements:
- Global client requests must be routed based on the URL path (e.g., /payments to Region 1 and /accounts to Region 2).
- SSL/TLS termination must be performed at the global routing edge to reduce latency.
- Within each region, HTTP(S) traffic must be distributed across a pool of virtual machines with session affinity.
- A legacy batch processing component in Region 1 must receive TCP-based traffic on port 8088 distributed via an Azure Load Balancer. The existing virtual machines for this component are currently assigned Basic SKU public IP addresses.

Which two configuration decisions must you include in the network architecture design to satisfy these requirements? (Select TWO).

A company named CloudFlux is designing a secure network environment for a hybrid application. You have an Azure virtual network named VNet1 containing a subnet named Subnet1. Subnet1 hosts several virtual machines that run a business-critical application. The application needs to retrieve connection strings and credentials from an Azure Key Vault named KV1.

You need to design a network security solution that meets the following requirements:
- Access to KV1 from the virtual machines must not traverse the public internet.
- The virtual machines must not have public IP addresses.
- Azure administrators must be able to securely manage the virtual machines using the Azure portal over SSL without exposing RDP or SSH ports directly to the public internet.

Which two components should you include in the design? (Select two.)

An insurance company is designing a serverless microservices-based application. The application consists of four containerized services: an API gateway, a customer profile service, a claim intake portal, and a background report generation service that processes heavy PDF claims. The report generation service can take up to 15 minutes to complete a single processing job. The hosting platform must support scaling to zero to minimize costs during idle periods, require minimal infrastructure management overhead, and allow secure internal communication between the containerized services.

Which hosting solution should you design?

A retail corporation is setting up an application environment in Azure. The architecture consists of Azure Virtual Machines deployed in a subnet named AppSubnet inside a virtual network named ProductionVNet. The virtual machines must securely access a single Azure SQL Database instance without exposing the traffic to the public internet. You have provisioned a private endpoint for the database in AppSubnet. You now need to restrict traffic from AppSubnet so that the virtual machines can connect only to the private endpoint of that specific SQL database, and prevent outbound access to any other Azure SQL Databases or public endpoints. Which configuration should you apply to the Network Security Group (NSG) linked to AppSubnet?

An enterprise deploys a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-core` ($10.100.0.0/16$), contains an Azure Firewall at $10.100.4.4$. The first spoke virtual network, `vnet-spoke-web` ($10.110.0.0/16$), hosts web servers in a subnet named `snet-web` ($10.110.1.0/24$). The second spoke virtual network, `vnet-spoke-db` ($10.120.0.0/16$), hosts database servers in a subnet named `snet-db` ($10.120.1.0/24$). Both spoke virtual networks are peered directly with the hub virtual network, but they are not peered with each other. To route all egress traffic from `vnet-spoke-web` to the database servers through the Azure Firewall for security inspection, the network architect associates a custom route table named `rt-web-transit` with the `snet-web` subnet. The route table includes a single user-defined route (UDR) with the address prefix $10.0.0.0/8$ and the next hop set to the Azure Firewall ($10.100.4.4$). During testing, VMs in `snet-web` can successfully connect to databases in `snet-db`, but traffic is not logged or inspected by the Azure Firewall. Which configuration change must be made to ensure that traffic from `vnet-spoke-web` to `vnet-spoke-db` is routed through the Azure Firewall?

Your company is planning to migrate its on-premises VMware vSphere virtual machines to Azure. You need to use Azure Migrate to discover the virtual machines and perform an agentless dependency analysis. Which two tasks must you perform on-premises to complete the discovery and dependency assessment? (Choose two.)

An enterprise is planning a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-east-hub` ($10.10.0.0/16$), contains a Virtual Network Gateway connected to an on-premises network ($192.168.1.0/24$) via a Site-to-Site VPN. The spoke virtual network, `vnet-east-spoke` ($10.20.0.0/16$), hosts application virtual machines. You must ensure that all outbound internet traffic from `vnet-east-spoke` is forced to route through the Virtual Network Gateway in `vnet-east-hub` to the on-premises firewall for inspection.

Which two configuration steps should you include in the design?

A company named Apex Health is designing a secure architecture in Azure to comply with healthcare data regulations. The architecture includes a virtual network named VNet-Prod containing a subnet named Subnet-Web, where virtual machines process medical records. The application must write these records to an Azure Storage account named storepatientdata.

You need to recommend a network security solution that meets the following requirements:
- Virtual machines in Subnet-Web must access storepatientdata using a private connection that does not traverse the public internet.
- Virtual machines in Subnet-Web must be prevented from exfiltrating data to any other Azure Storage accounts, including those in other subscriptions.
- Public internet access to the storage account must be disabled.
- The solution must minimize administrative overhead and avoid configuring user-defined routes (UDRs) or custom firewall virtual appliances.

Which two actions should you include in the recommendation?

An educational technology company is designing a serverless backend for a new exam preparation platform. The solution has the following workload requirements:

* A user-facing quiz API that serves questions and records user responses. The API experiences unpredictable traffic spikes but is completely idle during late-night hours. Responses must be returned within $2$ seconds, and minimizing idle hosting costs is a priority.
* A background transcript processing service that runs whenever a new lecture video is uploaded. This service calls an external AI service to generate practice questions, which can take up to $15$ minutes to complete due to API throttling.

Which two hosting and processing options should you select to implement this architecture? (Select TWO.)

An organization plans to migrate a multi-tier business application from an on-premises datacenter to Azure. The application runs across 15 interconnected virtual machines. You must ensure that when these virtual machines are migrated, no critical network connections between the servers are broken, which would cause application downtime. Which feature or capability should you use to identify the network connections between these servers before grouping them for migration?

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The design includes the following components:

* A hub virtual network ($\text{VNet-Hub}$) containing an Azure Firewall and an Azure Private DNS Resolver with an inbound endpoint configured.
* A spoke virtual network ($\text{VNet-App}$) peered with $\text{VNet-Hub}$. This virtual network contains a subnet named $\text{Subnet-App}$ hosting application virtual machines.
* A spoke virtual network ($\text{VNet-Data}$) peered with $\text{VNet-Hub}$. This virtual network contains a subnet named $\text{Subnet-Data}$ hosting an Azure SQL Database with a Private Endpoint.
* An Azure Private DNS Zone named `privatelink.database.windows.net` containing the DNS record for the Private Endpoint, linked to $\text{VNet-Hub}$.

Your design must meet the following requirements:
* The virtual machines in $\text{Subnet-App}$ must connect to the Azure SQL Database using its Private Endpoint.
* All traffic between $\text{Subnet-App}$ and the Private Endpoint must be routed through and inspected by the Azure Firewall in $\text{VNet-Hub}$.
* You must minimize administrative overhead and avoid linking the Private DNS Zone `privatelink.database.windows.net` to multiple virtual networks.

Which two actions should you perform?

Your company is designing a secure network architecture for an Azure-hosted application. The application runs on Azure Virtual Machines deployed in a virtual network named VNet1. The application requires outbound access to an Azure Storage account and an Azure Key Vault. You need to recommend a network security solution that meets the following requirements:
- Prevent all access to the storage account and key vault from the public internet.
- Ensure the virtual machines can resolve and connect to the services using their default fully qualified domain names (FQDNs).
- Minimize the administrative effort required to configure and maintain network access controls.

Which of the following designs should you recommend?

A digital publishing company is designing a serverless solution to generate quarterly PDF reports for subscribers. The report generation process runs on demand, takes approximately 12 to 15 minutes to compile each document, and requires a custom Linux environment with specific PDF compilation libraries. The workload is highly irregular, and the company wants to ensure that they do not pay for compute resources when no reports are being generated.

Which compute service should you recommend?