Design Infrastructure Solutions

360 soru

Tüm türler360 Çoktan seçmeli189 Çoklu seçim171

A biotechnology firm is designing the Azure compute virtualization infrastructure for two workloads:
- Genomic Sequencing Analyzer: A batch processing job that executes for up to $45$ minutes per run. It is highly resource-intensive, interruptible, can save progress to a checkpoint database, and must be optimized for the lowest possible compute costs.
- Customer Operations Portal: A steady-state web application database backend that requires a $99.99\%$ availability SLA and is critical to business continuity.

Which two compute solutions should you recommend to meet these requirements? (Select two).

Geçerli olan tümünü seçin

Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines.

Deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

Deploy the Customer Operations Portal on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines to reduce ongoing operational costs.

Deploy all virtual machine instances for the Customer Operations Portal within a single Azure Availability Zone to simplify network routing.

Run the Genomic Sequencing Analyzer on Azure Functions under a Consumption plan to eliminate compute cost when idle.

Cevabı ve açıklamayı göster

Cevap: Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines.; Deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

Cevap

Deploy the Genomic Sequencing Analyzer on Virtual Machine Scale Sets utilizing Azure Spot Virtual Machines, and deploy the Customer Operations Portal across multiple Azure Availability Zones using Virtual Machine Scale Sets in Flexible orchestration mode.

The correct solution recommends utilizing Azure Spot VMs on Virtual Machine Scale Sets for the genomic sequencing analyzer because it is a cost-effective, interruptible batch workload that can resume from checkpoints. It also recommends deploying the customer operations portal across multiple Availability Zones in Flexible orchestration mode to ensure high availability and redundancy to meet the

99.99\%

uptime SLA.

Adım Adım Çözüm

Analyze the Genomic Sequencing Analyzer requirements: runs up to

45

minutes, resource-intensive, interruptible (checkpointed), and requires lowest cost.

Identify that Azure Spot VMs on Virtual Machine Scale Sets are appropriate. Eliminate the Azure Functions Consumption plan because its

10

-minute limit would cause timeout failures.

Spot VMs offer significant discounts for interruptible workloads, whereas the Functions Consumption plan has a hard timeout limit.

Analyze the Customer Operations Portal database requirements: steady-state,

99.99\%

availability SLA, critical to business continuity.

Determine that standard VM instances must be deployed across multiple Availability Zones to ensure high availability. Eliminate the Spot VM option and single zone deployment.

Spot VMs are subject to eviction and cannot guarantee an SLA, and a single availability zone does not provide regional redundancy.

Anahtar Kavram

Selecting Azure compute resources based on workload characteristics, SLA, cost, and availability requirements.

Tahmini Süre:2m 0s

Soru 242Soru →

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The topology consists of a hub virtual network named `vnet-hub-prod` ( $10.100.0.0/16$ ), a spoke virtual network named `vnet-spoke-app` ( $10.101.0.0/16$ ), and a spoke virtual network named `vnet-spoke-db` ( $10.102.0.0/16$ ). The hub virtual network contains an Azure Firewall deployed at $10.100.2.4$ . Virtual network peering is established between the hub and each spoke virtual network.

The following routing requirements must be met:
- All traffic between `vnet-spoke-app` and `vnet-spoke-db` must transit through the Azure Firewall in the hub.
- All outbound internet traffic from the spokes must be routed through the Azure Firewall.
- Virtual machines within `vnet-spoke-app` must communicate directly with each other without sending traffic to the firewall.

Which of the following routing configurations should you implement to satisfy these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Associate a route table to the subnets in `vnet-spoke-app` containing a route for

10.102.0.0/16

and a route for

0.0.0.0/0

, both with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-db` containing a route for

10.101.0.0/16

and a route for

0.0.0.0/0

, both with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-app` containing a route for

10.101.0.0/16

with a next hop type of Virtual Appliance pointing to

10.100.2.4

Associate a route table to the subnets in `vnet-spoke-db` containing a route for

10.102.0.0/16

with a next hop type of Virtual Appliance pointing to

10.100.2.4

Cevabı ve açıklamayı göster

Cevap: Associate a route table to the subnets in `vnet-spoke-app` containing a route for $10.102.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .; Associate a route table to the subnets in `vnet-spoke-db` containing a route for $10.101.0.0/16$ and a route for $0.0.0.0/0$ , both with a next hop type of Virtual Appliance pointing to $10.100.2.4$ .

Cevap

The correct configurations are to associate a route table to the subnets in the application spoke containing a route for the database prefix and a route for the default route pointing to the firewall IP, and to associate a route table to the subnets in the database spoke containing a route for the application prefix and a route for the default route pointing to the firewall IP.

Routing between spoke virtual networks in a hub-and-spoke architecture requires User Defined Routes (UDRs) because virtual network peering is not transitive. To send traffic from the application spoke to the database spoke, a UDR for the database subnet prefix (

10.102.0.0/16

) pointing to the firewall is required. Similarly, a UDR for the internet destination (

0.0.0.0/0

) pointing to the firewall satisfies the secure egress requirement. The same logic applies in reverse for the database spoke routing to the application spoke. Because local traffic within a spoke relies on the default system route (VnetLocal) which is implicit, leaving the local prefix out of the UDR ensures that intra-VNet communication does not transit the firewall.

Adım Adım Çözüm

Identify the address spaces and firewall IP address details.

Hub VNet uses

10.100.0.0/16

, Spoke A uses

10.101.0.0/16

, Spoke B uses

10.102.0.0/16

, and Azure Firewall IP is

10.100.2.4

Establishes the exact prefixes and next-hop parameters needed to define User Defined Routes (UDRs).

Determine the required route table entries for the application spoke.

Create a route table associated with the subnets in the application spoke. Add a route for

10.102.0.0/16

(database spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.101.0.0/16

range.

This configuration correctly directs inter-spoke and egress traffic to the firewall while allowing local VNet communication to remain direct by utilizing the implicit, lower-priority VnetLocal system route.

Determine the required route table entries for the database spoke.

Create a route table associated with the subnets in the database spoke. Add a route for

10.101.0.0/16

(application spoke) and a route for

0.0.0.0/0

(internet), both pointing to the virtual appliance at

10.100.2.4

. Do not add a route for the local

10.102.0.0/16

range.

This mirroring configuration directs return and egress traffic from the database spoke to the firewall while ensuring local database VMs communicate directly using the VnetLocal system route.

Anahtar Kavram

Azure Virtual Network routing priorities dictate that User Defined Routes (UDRs) override system routes. When configuring transit routing through an NVA/Firewall, defining a UDR matching the local virtual network's address space overrides the default VnetLocal system route and disrupts intra-VNet local communications.

Soru 243Soru →

An enterprise is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-useast-hub` ( $10.100.0.0/16$ ), contains an Azure Firewall deployed at $10.100.3.4$ in the `AzureFirewallSubnet` ( $10.100.3.0/24$ ). The spoke virtual network, `vnet-useast-prod` ( $10.101.0.0/16$ ), contains two subnets: `snet-prod-web` ( $10.101.1.0/24$ ) and `snet-prod-db` ( $10.101.2.0/24$ ). The two virtual networks are peered. You need to design a routing solution for the route table associated with `snet-prod-web` to meet the following requirements:
- All traffic destined for the internet must be routed through the Azure Firewall.
- All traffic destined for `snet-prod-db` must be routed through the Azure Firewall.
- Traffic between virtual machines within the same `snet-prod-web` subnet must bypass the Azure Firewall and communicate directly.
- The configuration must minimize administrative maintenance when new subnets are added to `vnet-useast-prod` in the future.

Which configuration should you use for the route table associated with `snet-prod-web`?

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; a route for

10.101.0.0/16

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.1.0/24

with a next hop type of Virtual Network.

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.0.0/16

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.2.0/24

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

A route for

0.0.0.0/0

with a next hop type of Virtual Appliance and next hop IP address of

10.100.3.4

; and a route for

10.101.0.0/16

with a next hop type of Virtual Network.

Cevabı ve açıklamayı göster

Cevap: A route for $0.0.0.0/0$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; a route for $10.101.0.0/16$ with a next hop type of Virtual Appliance and next hop IP address of $10.100.3.4$ ; and a route for $10.101.1.0/24$ with a next hop type of Virtual Network.

Cevap

The configuration containing a route for

0.0.0.0/0

pointing to the Virtual Appliance, a route for

10.101.0.0/16

pointing to the Virtual Appliance, and a route for

10.101.1.0/24

pointing to Virtual Network.

In Azure routing, if you define a User Defined Route (UDR) that overlaps with the system-defined local virtual network route (such as

10.101.0.0/16

), the UDR will override the system route. To prevent intra-subnet traffic (

10.101.1.0/24

) from being sent to the firewall, you must define a more specific route for the local subnet with a next hop type of Virtual Network. Because Azure routing uses the Longest Prefix Match (LPM) algorithm, traffic destined for the local subnet (

10.101.1.0/24

) matches the

/24

route and is routed directly within the virtual network. Traffic destined for other subnets in the VNet (e.g.,

10.101.2.0/24

) or future subnets will match the

/16

route and be sent to the Azure Firewall. Internet traffic will match the

0.0.0.0/0

route and also go to the firewall. This minimizes administrative overhead because adding new subnets does not require updating the route table.

Adım Adım Çözüm

Analyze Azure routing precedence and Longest Prefix Match (LPM) behavior.

Azure routes traffic based on the most specific prefix (longest prefix match). When two routes have the same prefix, User-Defined Routes (UDRs) override system routes.

We must understand how to override the system-defined VNet route (

10.101.0.0/16

) while preserving local subnet routing.

Design routes to force internet and cross-subnet traffic through the firewall.

Add a default route (

0.0.0.0/0

) pointing to the firewall (

10.100.3.4

) and a VNet-wide route (

10.101.0.0/16

) pointing to the firewall.

This sends all external traffic and any traffic destined for other subnets in the spoke VNet to the firewall.

Introduce a more specific route for the local subnet to prevent intra-subnet traffic from being diverted.

Add a route for

10.101.1.0/24

with the next hop type set to Virtual Network.

Since

/24

is more specific than

/16

, VMs in the same subnet will communicate directly using the Virtual Network next hop, preventing local connectivity failure.

Anahtar Kavram

Azure User-Defined Routing (UDR) and Longest Prefix Match (LPM) overriding system routes

Tahmini Süre:2m 30s

Soru 244Soru →

An organization plans to migrate an on-premises web application to Azure. The environment consists of:
- Four web servers running Apache Tomcat on VMware vSphere VMs.
- An Oracle Database running on two physical Red Hat Enterprise Linux (RHEL) servers configured in a hardware-level cluster.

The organization has the following requirements:
- Map network dependencies between the Tomcat VMs and the physical database servers to ensure no components are left behind.
- Minimize administrative overhead for the hybrid identity solution. Federated authentication is not required.
- Identify database compatibility and determine the correct target Azure service for the Oracle database workload.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Geçerli olan tümünü seçin

Perform agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical RHEL servers.

Select Microsoft Entra Connect with Password Hash Synchronization (PHS) to synchronize user accounts.

Deploy Active Directory Federation Services (AD FS) to federate on-premises user accounts with Microsoft Entra ID.

Group the Tomcat VMs and RHEL servers into migration waves based on hostname patterns without performing network dependency analysis.

Recommend migrating the Oracle Database directly to a single database tier in Azure SQL Database without prior schema conversion.

Cevabı ve açıklamayı göster

Cevap: Perform agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical RHEL servers.; Select Microsoft Entra Connect with Password Hash Synchronization (PHS) to synchronize user accounts.

Cevap

The migration assessment strategy must include performing agentless dependency analysis for the VMware VMs and agent-based dependency analysis for the physical servers, as well as implementing Microsoft Entra Connect with Password Hash Synchronization (PHS).

To analyze dependencies in a hybrid environment where some servers are virtualized on VMware and others are physical servers (such as RHEL bare-metal), Azure Migrate requires different dependency mapping strategies: agentless dependency analysis is supported for VMware VMs, whereas physical servers require agent-based dependency mapping using the Dependency Agent and Log Analytics agent. Additionally, to minimize administrative overhead for identity synchronization when federation is not required, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the most appropriate option.

Adım Adım Çözüm

Analyze dependency mapping requirements for a mixed environment of VMware VMs and physical servers.

Identify that VMware VMs can use agentless dependency analysis, while physical RHEL servers require the installation of agents (Dependency Agent and Log Analytics agent) for dependency mapping.

To ensure all application components are discovered and correctly grouped into migration waves without missing network dependencies.

Determine the optimal identity synchronization mechanism based on the constraint of minimizing administrative overhead without requiring federated authentication.

Select Password Hash Synchronization (PHS) using Microsoft Entra Connect.

PHS provides hybrid identity with the lowest management and infrastructure overhead, avoiding the complexity of Active Directory Federation Services (AD FS).

Evaluate the database target and rule out incorrect migration paths.

Reject direct migration of Oracle Database to Azure SQL Database without schema conversion, as Azure SQL Database does not natively run Oracle workloads.

To ensure database compatibility and avoid application failures post-migration.

Anahtar Kavram

Designing a migration assessment strategy that handles mixed virtualization environments, performs proper dependency mapping to avoid connection failures, and optimizes hybrid identity synchronization based on business requirements.

Soru 245Soru →

An enterprise is designing a virtual network routing architecture in Azure to support their workload migration. The architecture consists of a hub virtual network named `vnet-prod-hub` ( $10.100.0.0/16$ ) that contains a Virtual Network Gateway (`vgw-prod-hub`) in the `GatewaySubnet` ( $10.100.0.0/24$ ), and a spoke virtual network named `vnet-prod-spoke1` ( $10.101.0.0/16$ ) hosting an application subnet named `snet-app` ( $10.101.1.0/24$ ). You need to design a routing solution that forces all internet-bound traffic from the VMs in `snet-app` to go through `vgw-prod-hub` to the on-premises network, while ensuring that VMs within `vnet-prod-spoke1` can communicate directly with each other without routing through the hub. Which two configurations should you include in the design? Select two.

Geçerli olan tümünü seçin

Configure the virtual network peering from `vnet-prod-spoke1` to `vnet-prod-hub` to use the remote virtual network's gateway, and configure the peering from `vnet-prod-hub` to `vnet-prod-spoke1` to allow gateway transit.

Create and associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for

0.0.0.0/0

and a next hop type of Virtual network gateway.

Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for

10.101.0.0/16

and a next hop type of Virtual appliance pointing to the hub gateway.

Associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for the Azure DNS service IP address (

168.63.129.16/32

) with a next hop type of Virtual network gateway.

Cevabı ve açıklamayı göster

Cevap: Configure the virtual network peering from `vnet-prod-spoke1` to `vnet-prod-hub` to use the remote virtual network's gateway, and configure the peering from `vnet-prod-hub` to `vnet-prod-spoke1` to allow gateway transit.; Create and associate a route table to the `snet-app` subnet in `vnet-prod-spoke1` with a route for $0.0.0.0/0$ and a next hop type of Virtual network gateway.

Cevap

Configure the virtual network peering from the spoke to the hub to use the remote gateway, configure the peering from the hub to the spoke to allow gateway transit, and associate a route table to the application subnet with a route for

0.0.0.0/0

pointing to the Virtual network gateway.

To successfully route all internet-bound traffic from a spoke virtual network to an on-premises network via a hub gateway (forced tunneling), you must configure the virtual network peering to allow gateway transit on the hub virtual network and configure the spoke virtual network to use the remote virtual network's gateway. Additionally, you must associate a route table containing a route for

0.0.0.0/0

with a next hop type of Virtual network gateway to the spoke subnet to override the default system route that sends internet traffic directly to the internet.

Adım Adım Çözüm

Enable gateway transit on the virtual network peering link on the hub VNet, and configure the spoke VNet to use the remote gateway.

The spoke virtual network is authorized and configured to route traffic through the Virtual Network Gateway located in the hub virtual network.

This establishes the network path required for the spoke virtual network to access the gateway resource.

Create a route table, add a route for

0.0.0.0/0

with a next hop type of Virtual network gateway, and associate the route table with the application subnet in the spoke.

The default system route to the Internet is overridden, forcing all internet-bound traffic from the subnet to transit the peered gateway.

By default, Azure routes internet-bound traffic directly to the Internet. A UDR is required to steer this traffic to the gateway.

Anahtar Kavram

Forced tunneling in Azure hub-and-spoke topologies requires configuring gateway transit on the peering links and deploying a UDR for

0.0.0.0/0

pointing to the Virtual network gateway without overriding local subnet or infrastructure routes.

Soru 246Soru →

AeroSpace Dynamics is designing the network security for a subnet named ProcessingSubnet that hosts Azure Virtual Machines. The virtual machines require outbound access to Azure Storage and Azure Key Vault to process data. All other outbound internet access from the subnet must be blocked. The design must minimize administrative maintenance.

Which two outbound configurations should you recommend for the Network Security Group (NSG) associated with ProcessingSubnet?

Geçerli olan tümünü seçin

An outbound security rule that allows traffic to the Storage service tag

An outbound security rule that allows traffic to the AzureKeyVault service tag

Individual outbound security rules that allow traffic to the specific public IP address ranges of the Azure Storage and Azure Key Vault endpoints

A custom route table with user-defined routes (UDRs) that direct Storage and Key Vault traffic to the Internet gateway, overriding the default Azure system routes

Cevabı ve açıklamayı göster

Cevap: An outbound security rule that allows traffic to the Storage service tag; An outbound security rule that allows traffic to the AzureKeyVault service tag

Cevap

Configure outbound NSG security rules that allow traffic to the Storage and AzureKeyVault service tags.

Using service tags like Storage and AzureKeyVault in outbound NSG rules allows the virtual machines to reach the respective Azure services. Azure manages the IP address prefixes under these service tags automatically, minimizing administrative maintenance while enforcing the required outbound security boundary.

Adım Adım Çözüm

Identify the destination services.

Azure Storage and Azure Key Vault are identified as the target destinations.

Outbound connectivity needs to be restricted to only these two services.

Evaluate the mechanism to allow access while minimizing administrative effort.

Service tags represent a group of IP address prefixes from a given Azure service, managed automatically by Azure.

Using service tags avoids the need to manually update and maintain individual IP address rules as Azure changes public IP ranges.

Determine the required NSG rules.

Add outbound security rules with destination set to the Storage service tag and the AzureKeyVault service tag, followed by a rule to block all other outbound internet traffic.

This configuration satisfies the security and administrative requirements.

Anahtar Kavram

Azure Network Security Group (NSG) Service Tags simplify outbound security rule management by grouping IP address prefixes for Azure services.

Soru 247Soru →

A company is designing a serverless solution to process daily large-scale data exports from an on-premises ERP system. The processing job runs once per day, takes approximately $15$ minutes to complete, and requires a custom Python environment with specific system-level dependencies. The solution must minimize administrative overhead and ensure that compute resources are billed only during the execution of the job. Which Azure compute solution should you recommend?

Azure Container Apps jobs to run the containerized processing script

Azure Functions on a Consumption plan running the script as a function

An Azure Kubernetes Service (AKS) cluster to run the job as a Kubernetes CronJob

An Azure Virtual Machine Scale Set utilizing Spot VMs to run the script

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps jobs to run the containerized processing script

Cevap

Azure Container Apps jobs to run the containerized processing script

Azure Container Apps jobs are optimized for run-to-completion tasks, support custom container environments, scale dynamically, and charge only for the execution duration, avoiding the timeout limit of standard consumption functions.

Adım Adım Çözüm

Analyze the execution duration and environment requirements

The job takes

15

minutes, exceeding the

10

-minute limit of some serverless offerings, and requires custom system-level Python dependencies.

This rules out basic Azure Functions Consumption plans due to the timeout limitation.

Evaluate the administrative overhead and pricing model requirements

The solution must minimize administrative overhead and only bill for execution time.

This rules out AKS due to management overhead and VM scale sets/App Service plans due to continuous idle costs.

Select the optimal serverless option for run-to-completion containerized tasks

Azure Container Apps jobs satisfy the custom environment (via containers), run-to-completion execution without a

10

-minute limit, minimal overhead, and scale-to-zero billing model.

It matches all constraints perfectly.

Anahtar Kavram

Selecting serverless compute services based on execution duration, custom dependencies, and hosting requirements.

Soru 248Soru →

An organization named Novis Analytics is designing a secure three-tier application architecture in Azure. The application will be deployed within a single virtual network subnet named WorkloadSubnet and consists of three groups of Azure Virtual Machines (VMs) running the following workloads:

* Web front-ends
* Application back-ends
* Database administrators

The design must satisfy the following security and operational requirements:

* Web front-ends must only be allowed to communicate outbound to the application back-ends.
* Application back-ends must be allowed to make outbound HTTPS requests to an Azure Key Vault and an Azure SQL Database.
* Database administrators must be allowed to access the Azure SQL Database, but must be blocked from accessing the Azure Key Vault.
* All other outbound internet traffic from the subnet must be blocked.
* Administrative effort must be minimized, and security policies must automatically apply to new VM instances added to any tier without updating network security rule definitions.

Which network security design should you recommend?

Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.

Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and manually define destination IP address ranges extracted from the Azure public IP range list for Azure Key Vault and Azure SQL Database.

Create two custom Service Tags to represent the web and application VM workloads, use them as sources in a single Network Security Group (NSG) associated with WorkloadSubnet, and configure the outbound rules to target the default AzureKeyVault and Sql Service Tags.

Configure a separate Network Security Group (NSG) for each VM network interface. In each NSG, define outbound rules using the individual private IP addresses of the VMs as sources, and use the AzureKeyVault and Sql Service Tags as destinations.

Cevabı ve açıklamayı göster

Cevap: Create three Application Security Groups (ASGs) to represent the VM workloads, associate each VM's network interface with its corresponding ASG, and associate a single Network Security Group (NSG) with WorkloadSubnet. In the NSG, define rules using the ASGs as sources or destinations, and use the AzureKeyVault and Sql Service Tags as destinations for outbound rules.

Cevap

Using Application Security Groups (ASGs) allows the organization to group virtual machines based on their workload roles (Web, Application, Database Administrators) and apply security rules to those groups, ensuring that any new VM associated with an ASG automatically inherits the correct security rules. Associating a single Network Security Group (NSG) at the subnet level minimizes administrative effort compared to managing NSGs per network interface. Using built-in Service Tags (AzureKeyVault and Sql) as destinations simplifies rule management by using Azure-managed IP address ranges instead of manually maintaining public IP lists, which change over time.

Adım Adım Çözüm

Group virtual machines by workload using Application Security Groups (ASGs).

Three ASGs are created, allowing VM network interfaces to be dynamically associated with their respective workloads.

This allows security policies to automatically apply to new VM instances as they are provisioned without modifying the security rule definitions.

Associate a single Network Security Group (NSG) at the subnet level (WorkloadSubnet).

Outbound and inbound network traffic for all VMs in the subnet is controlled centrally.

Associating the NSG with the subnet minimizes administrative overhead compared to managing individual NSGs on every VM network interface.

Configure NSG rules using the ASGs as sources and destinations, and the built-in Service Tags as destinations.

Rules are created allowing application back-ends to access AzureKeyVault and Sql tags, and database administrators to access the Sql tag, while blocking other traffic.

Using system-defined Service Tags avoids the need to manually maintain public IP addresses of Azure services, reducing administrative overhead.

Anahtar Kavram

Azure Application Security Groups (ASGs) allow you to configure network security as an extension of an application's structure, grouping VMs and defining network security policies based on those groups. Network Security Groups (NSGs) combined with Service Tags allow you to secure traffic to Azure PaaS services without manually maintaining IP address ranges.

Soru 249Soru →

An insurance firm is designing the Azure compute virtualization solution for its core claims processing system. The system requires two distinct compute environments:

* Claims Web API: A customer-facing API that processes incoming claims, requires memory-optimized virtual machines (high memory-to-vCPU ratio) to handle large session states, and must maintain an availability SLA of 99.99%.
* Reporting Generator: A batch workload that runs overnight to aggregate daily claims reports. The processing can tolerate interruptions, and the primary design constraint is minimizing operational costs.

Which virtualization solution meets the requirements for both workloads?

Deploy the Claims Web API on Spot E-series Virtual Machines, and deploy the Reporting Generator on E-series Virtual Machines.

Deploy the Claims Web API on E-series Virtual Machines in a single Availability Zone, and deploy the Reporting Generator on Spot Virtual Machines.

Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones using a Virtual Machine Scale Set, and deploy the Reporting Generator on Spot Virtual Machines.

Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones, and deploy the Reporting Generator on Azure Functions using a Consumption plan.

Cevabı ve açıklamayı göster

Cevap: Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones using a Virtual Machine Scale Set, and deploy the Reporting Generator on Spot Virtual Machines.

Cevap

Deploy the Claims Web API on E-series Virtual Machines across multiple Availability Zones using a Virtual Machine Scale Set, and deploy the Reporting Generator on Spot Virtual Machines.

The correct solution uses memory-optimized E-series Virtual Machines in a Virtual Machine Scale Set spread across multiple Availability Zones to ensure high availability (99.99% SLA) and proper resource sizing. For the non-critical, interruptible batch workload, Spot Virtual Machines are used to minimize costs.

Adım Adım Çözüm

Analyze the Claims Web API requirements.

The API requires memory-optimized virtual machines (high memory-to-vCPU ratio) and a high availability SLA of 99.99%.

This rules out compute-optimized (F-series) or storage-optimized (Ls-series) VMs, and demands deployment across multiple Availability Zones to meet the SLA.

Analyze the Reporting Generator requirements.

The reporting generator is a batch workload running overnight, which can tolerate interruptions and must minimize costs.

This makes it a perfect candidate for Spot Virtual Machines, which offer significant discounts. Azure Functions on a Consumption plan are ruled out due to the 10-minute timeout limit for long-running batch jobs.

Select the option that combines both correct services and deployment strategies.

The combination of E-series VMs in a multi-zone Virtual Machine Scale Set for the API and Spot VMs for the reporting workload meets all constraints.

This is the only configuration that satisfies both the performance/SLA targets of the API and the cost-optimization targets of the batch reporter without violating system limits.

Anahtar Kavram

Selecting Azure VM series and deployment architectures based on availability, performance, and cost constraints.

Soru 250Soru →

A company named Veridia Tech deploys a three-tier web application to Azure. The application consists of web servers, application servers, and database servers, all hosted on Azure Virtual Machines within a single subnet named WorkloadSubnet. You need to design a network security solution that meets the following requirements:
- Restricts network traffic so that web servers can only communicate with application servers, and application servers can only communicate with database servers.
- Prevents direct network communication between web servers and database servers.
- Automatically applies the traffic restrictions to new virtual machines as they are provisioned.
- Minimizes administrative overhead by avoiding the management of individual IP addresses or the creation of separate subnets.

Which component should you include in the network security design?

Application Security Groups (ASGs) associated with the network interfaces of the virtual machines

User-defined routes (UDRs) that direct all intra-subnet traffic to an Azure Firewall

Network Security Group (NSG) rules configured with individual static IP address ranges for each virtual machine

Azure Private Endpoints configured for each virtual machine to establish Private Link connections

Cevabı ve açıklamayı göster

Cevap: Application Security Groups (ASGs) associated with the network interfaces of the virtual machines

Cevap

Application Security Groups (ASGs) associated with the network interfaces of the virtual machines

The correct solution uses Application Security Groups (ASGs) to group virtual machines by role (Web, Application, Database) and defines NSG rules using these ASGs. Because ASGs are associated with the network interfaces of the virtual machines, any newly provisioned virtual machine assigned to an ASG automatically inherits the network security rules without requiring manual updates to the NSGs or IP configurations. This achieves the required traffic isolation within a single subnet while minimizing administrative effort.

Adım Adım Çözüm

Define Application Security Groups (ASGs) for the different application roles: Web, Application, and Database.

Three logical groups are created in Azure that can be referenced in Network Security Group (NSG) rules.

This allows referencing these groups as sources or destinations instead of using specific IP addresses or subnets.

Associate the respective ASGs with the network interfaces of the virtual machines belonging to each tier.

The virtual machines are dynamically grouped according to their application functions.

This ensures that any new virtual machine assigned to an ASG automatically inherits the security policies associated with that group.

Configure NSG rules on the WorkloadSubnet that allow traffic between the Web and Application ASGs, and between the Application and Database ASGs, while blocking other traffic.

Traffic flow is secured such that Web cannot talk directly to Database, while App can communicate with both Web and Database.

This implements the required network isolation policies dynamically and with minimal administrative overhead.

Anahtar Kavram

Using Application Security Groups (ASGs) to define context-aware network security policies within a single subnet, reducing administrative complexity and enabling dynamic scaling.

Tahmini Süre:1m 30s

Soru 251Soru →

An organization is designing a serverless backend solution to process data analysis batches. Each batch job takes up to 25 minutes to complete. The solution must auto-scale to meet demand, minimize cost when idle, and require minimal management overhead.

Which two Azure compute options should you recommend for hosting the batch jobs?

Geçerli olan tümünü seçin

Azure Functions on a Premium plan

Azure Container Apps jobs

Azure Functions on a Consumption plan

Azure Kubernetes Service (AKS)

Cevabı ve açıklamayı göster

Cevap: Azure Functions on a Premium plan; Azure Container Apps jobs

Cevap

Azure Functions on a Premium plan and Azure Container Apps jobs are the recommended choices.

The correct options are Azure Functions on a Premium plan and Azure Container Apps jobs. Azure Functions on a Premium plan allows execution times up to 30 minutes (and can be configured to be unbounded) and scales dynamically, avoiding the strict 10-minute timeout limit of the Consumption plan. Azure Container Apps jobs are built specifically for processing containerized, run-to-completion batch tasks without a strict 10-minute timeout constraint, scaling to zero when no jobs are running. Both options offer a serverless model that minimizes management overhead and cost when idle.

Adım Adım Çözüm

Evaluate the execution timeout constraint

The execution takes 25 minutes, ruling out options with a 10-minute timeout limit.

Azure Functions on a Consumption plan has a hard 10-minute timeout limitation, making it unsuitable.

Evaluate operational overhead and scaling constraints

Identify compute platforms that scale to zero, minimize idle costs, and require minimal infrastructure management.

Azure Kubernetes Service (AKS) requires management of clusters and nodes, violating the minimal management requirement, whereas Azure Functions and Azure Container Apps jobs are serverless and managed.

Confirm compatible serverless hosting models

Azure Functions on a Premium plan and Azure Container Apps jobs satisfy both the 25-minute execution requirement and the serverless management and scaling constraints.

Both selected plans support long-running tasks and automatically scale down to zero when idle.

Anahtar Kavram

Selecting serverless hosting options based on execution duration limits, scaling behavior, and operational overhead.

Tahmini Süre:2m 0s

Soru 252Soru →

A gaming company is deploying a new online multiplayer game on Azure. The system architecture requires two distinct compute tiers:

1. Matchmaking Service: A production-grade backend service that manages active player sessions and matchmaking. It runs $24/7$ , requires a $99.95\%$ availability SLA, and must not experience unexpected virtual machine (VM) termination.
2. Telemetry Log Processor: A background worker service that aggregates and processes player telemetry metrics. The processing can be interrupted and resumed later without data loss.

To maximize availability for the Matchmaking Service and minimize costs for the Telemetry Log Processor, which compute configuration should you recommend?

Deploy the Matchmaking Service instances across multiple Availability Zones using standard Virtual Machines (VMs), and host the Telemetry Log Processor on Azure Spot VMs.

Deploy the Matchmaking Service instances within a single Availability Zone using Azure Spot VMs, and host the Telemetry Log Processor on standard VMs.

Deploy the Matchmaking Service instances across multiple Availability Zones using Azure Spot VMs, and host the Telemetry Log Processor on standard VMs.

Deploy the Matchmaking Service instances within a single Availability Zone using standard VMs, and host the Telemetry Log Processor on Azure Spot VMs.

Cevabı ve açıklamayı göster

Cevap: Deploy the Matchmaking Service instances across multiple Availability Zones using standard Virtual Machines (VMs), and host the Telemetry Log Processor on Azure Spot VMs.

Cevap

Deploy the Matchmaking Service instances across multiple Availability Zones using standard Virtual Machines (VMs), and host the Telemetry Log Processor on Azure Spot VMs.

The correct option ensures the production matchmaking service has a high availability SLA by spreading standard VMs across multiple Availability Zones, and optimizes cost by using low-cost Spot VMs for the interruptible telemetry service.

Adım Adım Çözüm

Analyze the requirements for the Matchmaking Service.

The service is production-grade, runs

24/7

, requires a

99.95\%

SLA, and cannot tolerate unexpected VM terminations.

This rules out Azure Spot VMs due to the risk of eviction and mandates a multi-zone VM deployment to achieve the required SLA.

Analyze the requirements for the Telemetry Log Processor.

The workload is a background process that is interruptible and can resume without data loss.

This makes the workload an ideal candidate for Azure Spot VMs, which provide deep discounts but can be evicted.

Combine the compute solutions to meet all constraints while optimizing cost.

Standard VMs in a multi-zone layout for matchmaking ensure high availability, and Spot VMs for telemetry optimize cost.

This meets both the SLA requirements for the critical tier and the cost-reduction requirements for the batch tier.

Anahtar Kavram

Selecting Azure VM tiers (Standard vs Spot) and Availability Zone configurations based on SLA and workload characteristics.

Soru 253Soru →

Ember Healthcare is designing the network security architecture for a new application in Azure. The application architecture includes an Azure SQL Database logical server and an Azure Storage account. The local corporate network is connected to Azure using an ExpressRoute circuit with private peering.

You must design a network solution that meets the following requirements:
- The Azure SQL Database and Azure Storage account must not accept any connections from the public internet.
- On-premises users must be able to securely connect to the SQL Database and Storage account using their respective Fully Qualified Domain Names (FQDNs) over the private connection.
- The solution must minimize the administrative overhead of deploying and maintaining virtual machine-based DNS forwarders.
- Inbound and outbound access to the Azure subnets must be secured using Network Security Groups (NSGs) while minimizing the need to manually update rule IP addresses when Microsoft updates their service ranges.

Which two actions should you include in the recommended design?

Geçerli olan tümünü seçin

Deploy Azure Private Endpoints for the Azure SQL Database and the Azure Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint to resolve the private DNS zones from the on-premises network.

Configure Network Security Groups (NSGs) on the subnets that utilize built-in Azure Service Tags instead of individual IP address ranges to control network traffic to Azure services.

Configure inbound Network Security Group (NSG) rules on the database subnet that list individual IP address ranges for the Microsoft SQL service endpoints.

Configure a User Defined Route (UDR) on the GatewaySubnet that overrides BGP routes by mapping individual service IP ranges to the Virtual Network Gateway, and disable BGP route propagation on the database subnet.

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Private Endpoints for the Azure SQL Database and the Azure Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint to resolve the private DNS zones from the on-premises network.; Configure Network Security Groups (NSGs) on the subnets that utilize built-in Azure Service Tags instead of individual IP address ranges to control network traffic to Azure services.

Cevap

The recommended design must include deploying Azure Private Endpoints combined with an Azure Private DNS Resolver inbound endpoint, and configuring Network Security Groups utilizing built-in Azure Service Tags.

Deploying Private Endpoints ensures that PaaS resources are assigned private IP addresses within the virtual network. The Azure Private DNS Resolver provides a managed inbound endpoint that on-premises DNS servers can target via conditional forwarders, resolving the private DNS zones without the need to manage custom DNS forwarder virtual machines. In addition, using Azure Service Tags in NSGs allows the platform to automatically manage the underlying IP addresses for specific Azure services, eliminating the administrative burden of manually updating rules when Microsoft modifies service IP ranges.

Adım Adım Çözüm

Address private access and DNS requirements.

Recommend Azure Private Endpoints for the SQL Database and Storage account, and deploy an Azure Private DNS Resolver with an inbound endpoint.

Private Endpoints satisfy the requirement to block public internet access. The Private DNS Resolver enables on-premises DNS resolution for these private endpoints without requiring VM-based forwarders.

Address the subnet access control and administrative overhead requirements.

Configure Network Security Groups on the subnets using built-in Azure Service Tags.

Service Tags automatically track Microsoft's service IP address ranges, securing access to Azure services while eliminating the need for manual rule updates.

Anahtar Kavram

Azure Private Access and Managed Name Resolution over Hybrid Connections

Soru 254Soru →

A financial services company is designing the Azure compute virtualization infrastructure for a new multi-tier application. The architecture has two primary workloads:

1. Production Database Tier: A transactional database cluster that requires high write throughput and must achieve a $99.99\%$ virtual machine uptime SLA.
2. Development Testing Tier: A batch-oriented build-and-test environment that can tolerate interruptions and does not have a strict SLA. The primary objective is to minimize compute costs.

Which two compute configurations should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Deploy the Production Database Tier virtual machines across two or more Availability Zones in the same Azure region.

Deploy the Development Testing Tier virtual machines as Azure Spot Virtual Machines.

Deploy the Production Database Tier virtual machines as Azure Spot Virtual Machines.

Deploy the Production Database Tier virtual machines within a single Availability Zone using an Availability Set.

Cevabı ve açıklamayı göster

Cevap: Deploy the Production Database Tier virtual machines across two or more Availability Zones in the same Azure region.; Deploy the Development Testing Tier virtual machines as Azure Spot Virtual Machines.

Cevap

Deploy the production database virtual machines across two or more Availability Zones and deploy the development testing virtual machines as Azure Spot Virtual Machines.

To satisfy the

99.99\%

SLA constraint for the Production Database Tier, you must deploy virtual machines across multiple Availability Zones in the same Azure region. To satisfy the low-cost constraint for the Development Testing Tier, which is tolerant of interruptions, you should deploy the virtual machines as Azure Spot VMs to leverage deep discounts.

Adım Adım Çözüm

Analyze the SLA requirement for the Production Database Tier.

The Production Database Tier requires a

99.99\%

VM uptime SLA.

This determines the minimum high-availability configuration required for the production compute layer.

Evaluate availability options for the Production Database Tier.

Deploying virtual machines across multiple Availability Zones in the same region satisfies the

99.99\%

SLA, whereas Availability Sets only guarantee

99.95\%

SLA.

To select the architecture that meets the SLA while avoiding single-point-of-failure vulnerabilities.

Analyze the cost and interruption tolerance of the Development Testing Tier.

The Development Testing Tier requires minimal cost and can be interrupted.

To select the most cost-effective virtual machine type, which points to Azure Spot Virtual Machines.

Anahtar Kavram

Selecting appropriate compute availability options and cost tiers based on workload SLA and interruption tolerance.

Soru 255Soru →

Vortex Logistics is designing a secure architecture in Azure. They have a virtual network named VNet1 that contains a subnet named BackendSubnet. The virtual machines in BackendSubnet need to access an Azure Storage account named store1 and an Azure SQL Database named db1 privately without exposing the data traffic to the public internet. The solution must minimize administrative overhead and avoid using static IP listings or manual routing updates. Which two actions should you include in the design to meet these requirements?

Geçerli olan tümünü seçin

Create Private Endpoints for store1 and db1 within BackendSubnet.

Configure Azure Private DNS zones integrated with VNet1 to resolve the fully qualified domain names (FQDNs) of store1 and db1.

Add outbound security rules to the Network Security Group (NSG) on BackendSubnet targeting the individual public IP addresses of the Microsoft SQL and Storage endpoints.

Configure a User-Defined Route (UDR) in BackendSubnet that routes all traffic destined for Azure Storage and SQL Database through a virtual network gateway to an on-premises firewall.

Cevabı ve açıklamayı göster

Cevap: Create Private Endpoints for store1 and db1 within BackendSubnet.; Configure Azure Private DNS zones integrated with VNet1 to resolve the fully qualified domain names (FQDNs) of store1 and db1.

Cevap

To meet the requirements, you should create Private Endpoints for the storage account and SQL database within the backend subnet, and configure Azure Private DNS zones integrated with the virtual network to handle FQDN resolution.

Creating Private Endpoints assigns private IP addresses from the subnet to the Azure Storage account and Azure SQL Database, ensuring that all data traffic remains within the private Microsoft backbone network and is not exposed to the public internet. Because Private Endpoints require proper name resolution to resolve the service FQDNs to these private IPs, configuring and linking Azure Private DNS zones is necessary to ensure virtual machines can connect successfully.

Adım Adım Çözüm

Identify the need for private, non-public internet exposure for Azure PaaS services (Storage and SQL Database) while avoiding manual IP maintenance.

Determine that Private Endpoints are the appropriate technology to assign private IPs to the PaaS resources.

Private Endpoints provide secure private IP connectivity and block public internet exposure.

Determine the DNS resolution mechanism for Private Endpoints.

Decide to configure Private DNS Zones for both storage and SQL database services and link them to the virtual network.

Clients must resolve the standard service FQDNs to the new private endpoint IPs to ensure seamless application connectivity.

Anahtar Kavram

Implementing private access to Azure PaaS resources using Private Endpoints and Private DNS Zones to secure data traffic and avoid public internet exposure.

Soru 256Soru →

A company plans to migrate its legacy ERP system from an on-premises datacenter hosting physical servers and VMware vSphere virtual machines to Azure.

The system requirements and constraints are:
- The inventory consists of 40 virtual machines running on VMware vSphere and 5 physical servers running specialized processing software.
- The database tier runs on SQL Server on-premises, using SQL Server Agent jobs for nightly ETL tasks and cross-database queries between two databases on the same instance.
- Users will authenticate using their existing on-premises Active Directory Domain Services (AD DS) credentials. No advanced federation features (such as certificate-based authentication or smart cards) are required, but minimizing infrastructure overhead and deployment complexity is critical.
- You need to map application dependencies for all servers to identify migration groups, ensuring that network connection details (ports, IP addresses) are captured for security group planning.

Which two actions should you include in the migration assessment and strategy? (Choose two.)

Geçerli olan tümünü seçin

Configure agentless dependency mapping for the VMware virtual machines, and install the Azure Monitor agent and Dependency agent on the physical servers to enable agent-based dependency mapping.

Recommend Azure SQL Managed Instance as the target database tier, and run the Azure SQL migration assessment using Azure Migrate to evaluate compatibility.

Configure agentless dependency mapping for both the VMware virtual machines and the physical servers using the Azure Migrate appliance.

Deploy Active Directory Federation Services (AD FS) on-premises and configure a federation trust with Microsoft Entra ID to authenticate users.

Recommend Azure SQL Database elastic pools as the target database tier to support the cross-database queries.

Cevabı ve açıklamayı göster

Cevap: Configure agentless dependency mapping for the VMware virtual machines, and install the Azure Monitor agent and Dependency agent on the physical servers to enable agent-based dependency mapping.; Recommend Azure SQL Managed Instance as the target database tier, and run the Azure SQL migration assessment using Azure Migrate to evaluate compatibility.

Cevap

The correct strategy involves combining agentless dependency mapping for VMware virtual machines with agent-based dependency mapping for physical servers, and recommending Azure SQL Managed Instance as the target database tier to support cross-database queries and SQL Server Agent jobs.

The correct strategy involves combining agentless dependency mapping for VMware virtual machines with agent-based dependency mapping for physical servers, as physical servers do not support agentless discovery for network connections. Additionally, since the application requires SQL Server Agent and cross-database queries, Azure SQL Managed Instance is the required target database tier, and performing a compatibility assessment is necessary to identify any migration blockers.

Adım Adım Çözüm

Analyze the virtual and physical server inventory and determine the appropriate dependency mapping method.

VMware virtual machines can use agentless dependency mapping, while the physical servers require agent-based dependency mapping with the Azure Monitor agent and Dependency agent.

Agentless dependency mapping is not supported for physical servers in Azure Migrate, so a hybrid dependency strategy is required.

Evaluate the on-premises SQL Server requirements, specifically cross-database queries and SQL Server Agent.

Identify Azure SQL Managed Instance as the appropriate target database tier.

Azure SQL Database single databases or elastic pools do not support native cross-database queries or SQL Server Agent jobs, which are legacy requirements.

Analyze the identity synchronization requirements for hybrid authentication.

Determine that Microsoft Entra Password Hash Synchronization (PHS) with Seamless SSO is the optimal identity synchronization mechanism.

Using PHS with Seamless SSO minimizes infrastructure overhead and complexity compared to deploying AD FS, as there are no requirements for advanced federation features.

Anahtar Kavram

Selecting the correct assessment tools, dependency mapping strategies, and database target tiers during an Azure migration planning phase.

Tahmini Süre:3m 0s

Soru 257Soru →

An IoT manufacturing enterprise is deploying a regional telematics processing solution in Azure. The architecture contains two main services:

1. An HTTP/HTTPS dashboard API that requires path-based routing (routing `/telemetry/*` to a hot-path processing pool and `/reports/*` to a cold-path pool) and SSL/TLS termination at the gateway.
2. A raw TCP receiver service running on port 5001 that processes stream data directly from hardware sensors.

The design requires zone-redundancy and high availability across three Availability Zones. The virtual machines hosting the TCP receiver service currently use Basic SKU Public IP addresses to support direct remote debugging over the internet.

Which load balancing configuration should you recommend to meet these requirements?

Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API. Upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.

Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API. Deploy a Standard Load Balancer to distribute the TCP traffic to the receiver virtual machines, retaining their existing Basic SKU Public IP addresses.

Deploy Azure Traffic Manager to manage SSL/TLS termination and path-based routing for the HTTP/HTTPS dashboard API. Upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.

Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API. Deploy a Standard Load Balancer to distribute the TCP traffic, but locate all TCP receiver virtual machines within a single Availability Zone to bypass public IP SKU limitations.

Cevabı ve açıklamayı göster

Cevap: Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API. Upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.

Cevap

Deploy an Azure Application Gateway Standard v2 for the HTTP/HTTPS dashboard API, upgrade the public IP addresses of the TCP receiver virtual machines to Standard SKU, and deploy a Standard Load Balancer to distribute the TCP traffic.

The recommended design uses Azure Application Gateway Standard v2 for the regional HTTP/HTTPS path-based routing and SSL/TLS termination, and a Standard Load Balancer for the Layer 4 TCP receiver service. To prevent validation failures, the virtual machines' public IPs must be upgraded to Standard SKU because Standard Load Balancer backend pools do not support Basic SKU public IPs.

Adım Adım Çözüm

Select the load balancer for the Layer 7 web traffic.

Azure Application Gateway Standard v2 is chosen because it supports regional zone redundancy, path-based routing, and SSL/TLS termination.

The dashboard API requires path-based routing (/telemetry/* and /reports/*) and SSL termination at the gateway level.

Select the load balancer for the Layer 4 TCP receiver traffic.

Standard Load Balancer is chosen over Basic Load Balancer.

The TCP service must support high availability across three Availability Zones, which requires a Standard SKU Load Balancer since Basic Load Balancer does not support zone-redundancy.

Address backend SKU compatibility requirements.

All VM instance-level Public IPs in the backend pool must be upgraded to Standard SKU.

Standard Load Balancers fail validation if associated with virtual machines that have Basic SKU Public IP addresses.

Anahtar Kavram

Designing a co-existing Layer 7 (Application Gateway) and Layer 4 (Standard Load Balancer) regional solution with proper SKU alignment for public-facing virtual machines across Availability Zones.

Soru 258Soru →

A healthcare provider is designing a serverless architecture to ingest and process HL7 clinical data messages and host a lightweight REST API. The REST API will receive incoming message metadata and must respond within $200$ milliseconds to the sender. The clinical data messages are processed asynchronously by a background worker that can take up to $20$ minutes to complete the analysis and transformation for each message. The architecture must minimize administrative overhead and ensure that compute costs are reduced to zero during periods of inactivity. Which of the following Azure services should you recommend to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Azure Container Apps jobs to run the background worker

Azure Functions on a Consumption plan to host the REST API

Azure Functions on a Consumption plan to run the background worker

Azure Kubernetes Service (AKS) to host both the REST API and the background worker

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps jobs to run the background worker; Azure Functions on a Consumption plan to host the REST API

Cevap

The architecture should include Azure Container Apps jobs to run the background worker and Azure Functions on a Consumption plan to host the REST API.

To process the

20

-minute background tasks while scaling to zero during inactivity, Azure Container Apps jobs is the correct choice because it does not suffer from the

10

-minute limit of serverless functions. To host the lightweight REST API with zero administrative overhead and zero cost during idle periods, Azure Functions on a Consumption plan is the most efficient choice.

Adım Adım Çözüm

Analyze execution duration constraints

The background job requires up to

20

minutes to run. Standard serverless execution limits must be checked.

Azure Functions Consumption plan has a maximum execution limit of

10

minutes, which makes it unsuitable for this background task.

Select hosting for the background worker

Azure Container Apps jobs can execute tasks that run for hours to completion and can scale down to zero when idle.

This satisfies the duration requirements while keeping costs to zero during periods of inactivity with minimal overhead.

Select hosting for the REST API

Azure Functions on a Consumption plan is cost-effective, scales to zero, and has minimal administrative overhead.

The REST API only handles metadata ingestion, which fits within the execution window and low-latency bounds of serverless functions.

Anahtar Kavram

Selecting Azure serverless hosting options based on execution limits, administrative overhead, and scaling behaviors.

Tahmini Süre:1m 30s

Soru 259Soru →

Your company is designing a hybrid network in Azure using a hub-and-spoke topology. The architecture includes:

* A hub virtual network named `vnet-hub-central` with an address space of $172.16.0.0/16$ .
* A spoke virtual network named `vnet-spoke-app` with an address space of $172.17.0.0/16$ .
* A spoke virtual network named `vnet-spoke-data` with an address space of $172.18.0.0/16$ .
* An Azure ExpressRoute gateway deployed in the `GatewaySubnet` ( $172.16.2.0/24$ ) of `vnet-hub-central` connecting to the on-premises network.
* A third-party network virtual appliance (NVA) deployed in `vnet-hub-central` to inspect all transit traffic.
* An Azure Route Server deployed in the `RouteServerSubnet` ( $172.16.1.0/24$ ) of `vnet-hub-central`.

You need to configure the network to ensure that the spoke virtual networks dynamically exchange routing information with the on-premises network via the NVA, minimizing manual route table maintenance.

Which three actions should you perform? (Each correct answer presents part of the solution.)

Geçerli olan tümünü seçin

Configure BGP peering between the NVA and the Azure Route Server.

Enable the Branch-to-Branch (route exchange) setting on the Azure Route Server.

Configure the virtual network peerings from the hub to the spokes to allow gateway transit, and the peerings from the spokes to the hub to use the remote virtual network's gateway or Route Server.

Create User Defined Routes (UDRs) in the spoke subnets with a next hop pointing to the NVA's IP address for the on-premises IP ranges.

Create User Defined Routes (UDRs) in the gateway subnet of `vnet-hub-central` that define routes to the spokes with the ExpressRoute gateway as the next hop.

Create a User Defined Route (UDR) in the NVA subnet that overrides the default system route for the local virtual network address space (

172.16.0.0/16

Cevabı ve açıklamayı göster

Cevap: Configure BGP peering between the NVA and the Azure Route Server.; Enable the Branch-to-Branch (route exchange) setting on the Azure Route Server.; Configure the virtual network peerings from the hub to the spokes to allow gateway transit, and the peerings from the spokes to the hub to use the remote virtual network's gateway or Route Server.

Cevap

To configure dynamic hybrid routing using Azure Route Server and an NVA, you must configure BGP peering between the NVA and the Azure Route Server, enable the Branch-to-Branch route exchange setting on the Route Server, and configure VNet peering transit options ('Use remote virtual network's gateway or Route Server' on spokes, and allow gateway transit on the hub).

The correct configuration relies on dynamic route exchange using Azure Route Server (ARS). Configuring BGP peering between the NVA and ARS allows the NVA to advertise its routes to the Azure SDN. Enabling Branch-to-Branch (route exchange) on the ARS allows the Route Server to propagate BGP routes between the ExpressRoute gateway and the NVA. Finally, configuring the virtual network peering options ensures that the spoke VNets dynamically receive these routes from the hub's Route Server.

Adım Adım Çözüm

Configure BGP Peering on the NVA and Route Server.

The NVA and Azure Route Server establish a BGP session.

This allows the NVA to dynamically advertise routes (like on-premises subnets) to the Route Server, which handles route propagation inside the Azure VNets.

Enable Branch-to-Branch on Azure Route Server.

Route Server exchanges routes between the ExpressRoute gateway and the NVA.

This allows the ExpressRoute gateway to learn the routes advertised by the NVA, and the NVA to learn on-premises routes advertised by the ExpressRoute gateway, facilitating transit routing.

Configure Peering Transit Settings.

Spoke virtual networks dynamically receive the propagated routes from the Route Server.

VNet peerings must be configured to allow gateway/Route Server transit so that the spokes can inherit the routes learned by the hub's Route Server.

Anahtar Kavram

Azure Route Server simplifies dynamic routing between network virtual appliances (NVAs) and virtual networks by establishing BGP peering, eliminating the need to maintain static User Defined Routes (UDRs) across multiple subnets.

Soru 260Soru →

A company named Vortex Retail is designing a secure network environment for a payment processing system. The system runs on Azure Virtual Machines deployed in a subnet named PaymentSubnet within a virtual network named VNet-Prod. The virtual machines must meet the following requirements:
- Access an Azure Storage Account named paystorage securely without routing traffic over the public internet.
- Connect to Azure Key Vault to retrieve cryptographic keys.
- Communicate with Microsoft Entra ID for identity verification and Azure Monitor for telemetry ingestion.
- Block all other outbound traffic to the public internet.
- Minimize administrative effort and avoid manually maintaining IP address lists.

You need to recommend the network security and private access architecture for the virtual machines.

Which configuration should you recommend?

Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.

Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the specific public IP address ranges currently used by Microsoft Entra ID and Azure Monitor, followed by a rule to deny the Internet service tag.

Deploy Private Endpoints for paystorage and the Azure Key Vault. Configure User-Defined Routes (UDRs) to route all outbound traffic from the subnet to the public IP addresses of Microsoft Entra ID and Azure Monitor, and associate a Network Security Group (NSG) that denies all outbound traffic to the Internet service tag.

Configure Service Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure a rule to deny the Internet service tag, and rely on default rules to permit all Microsoft Entra ID and Azure Monitor traffic.

Cevabı ve açıklamayı göster

Cevap: Deploy Private Endpoints for paystorage and the Azure Key Vault. In the Network Security Group (NSG) associated with PaymentSubnet, configure outbound rules to allow the AzureActiveDirectory and AzureMonitor service tags, followed by a rule to deny the Internet service tag.

Cevap

Deploying Private Endpoints assigns private IP addresses from the virtual network to the storage account and key vault. Traffic to these resources is routed internally and is permitted by default. Outbound access to public endpoints (Microsoft Entra ID and Azure Monitor) is allowed using the AzureActiveDirectory and AzureMonitor service tags, which dynamically update, eliminating the need to maintain IP ranges. The catch-all deny rule for the Internet service tag blocks all other public outbound traffic.

Adım Adım Çözüm

Select the appropriate private access method for Azure Storage and Azure Key Vault.

Private Endpoints are chosen because they map the resources to private IP addresses within the virtual network, ensuring traffic stays off the public internet.

This meets the requirement of securing storage and key vault access without public internet exposure.

Determine the rule strategy for outbound traffic to Microsoft Entra ID and Azure Monitor.

Configure outbound NSG rules allowing the AzureActiveDirectory and AzureMonitor service tags.

Service tags abstract the management of IP ranges, satisfying the requirement to minimize administrative effort.

Configure the rule to restrict all other outbound internet traffic.

Add an outbound NSG rule denying the Internet service tag at a lower priority than the allow rules.

This blocks all unauthorized outbound internet traffic while preserving access to the allowed service tags and private endpoints.

Anahtar Kavram

Azure Private Endpoints allow secure, private access to Azure resources using private IP addresses from the virtual network. Service Tags simplify outbound NSG configurations for public Azure services by abstracting IP address management.

ÖncekiSayfa 13 / 18Sonraki

Design Infrastructure Solutions

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram