Examkin

Design Infrastructure Solutions

360 soru

Tüm türler360Çoktan seçmeli189Çoklu seçim171
Soru 281Soru →

Lumina Financials is designing a secure architecture for a cloud database application deployed on virtual machines in a virtual network subnet named Subnet1. The virtual machines require outbound connectivity to Azure Storage and Azure SQL Database in the same region to perform nightly data transfers. You need to configure a Network Security Group (NSG) associated with Subnet1 to permit outbound traffic to only these services while blocking all other outbound internet traffic. The solution must minimize administrative overhead when IP address ranges for the Azure services change. Which NSG outbound rule configuration should you recommend?

Cevabı ve açıklamayı göster

Cevap: Create outbound rules that use the Storage and Sql Service Tags as the destination.

Cevap

Create outbound rules that use the Storage and Sql Service Tags as the destination.
The correct option is to use the built-in Storage and Sql Service Tags. Service Tags represent a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, which minimizes administrative overhead.

Adım Adım Çözüm

1
Identify the destination services requiring access.
Azure Storage and Azure SQL Database are the target services.
The VMs need outbound access to these specific Azure PaaS services.
2
Select the appropriate network security mechanism that minimizes administrative overhead.
Service Tags represent groups of IP address prefixes from managed Azure services.
Using Service Tags eliminates the need to manually track and update IP address ranges.
3
Configure the NSG outbound security rules.
Two rules are created targeting the Storage and Sql Service Tags respectively.
This allows required traffic while a lower-priority rule blocks all other outbound internet traffic.

Anahtar Kavram

Azure Service Tags simplify NSG management by representing groups of IP address prefixes for specific Azure services.
Tahmini Süre:1m 30s
Soru 282Soru →

A retail company is migrating its e-commerce inventory management portal to Azure. The portal has the following requirements:

* It must run on virtual machines to support legacy dependencies and custom operating system kernel configurations.
* It must automatically scale the number of virtual machine instances to meet fluctuating traffic demand.
* It must guarantee a Service Level Agreement (SLA) of 99.95%99.95\% for compute availability.
* It must support running a mix of virtual machine sizes (specifically, memory-optimized E-series and general-purpose D-series instances) within the same group to handle different workloads.
* It must distribute the virtual machines across multiple physical fault domains in the Azure region.

Which compute solution should you design to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: A Virtual Machine Scale Set configured in Flexible orchestration mode

Cevap

A Virtual Machine Scale Set configured in Flexible orchestration mode
A Virtual Machine Scale Set in Flexible orchestration mode is the correct design. It allows the integration of heterogeneous virtual machine sizes (specifically memory-optimized E-series and general-purpose D-series) in the same scale set, supports custom images and operating system kernels, automatically scales based on demand, and provides a 99.95%99.95\% availability SLA when virtual machines are distributed across physical fault domains in an Azure region.

Adım Adım Çözüm

1
Analyze the workload requirements for legacy compatibility and OS access.
The requirement to run legacy dependencies and configure custom operating system kernels rules out serverless options such as Azure Functions.
Serverless platforms abstract away the host OS, preventing custom kernel configuration.
2
Evaluate the orchestration mode requirements for Virtual Machine Scale Sets.
Uniform orchestration mode requires identical VM sizes, whereas Flexible orchestration mode allows mixing different VM series (e.g., D-series and E-series) within the same scale set.
The requirement states that a mix of general-purpose and memory-optimized instances must run in the same group.
3
Verify high availability and fault domain requirements.
Flexible orchestration mode guarantees a 99.95%99.95\% SLA when virtual machines are distributed across multiple fault domains in a region.
This configuration meets the SLA and physical fault isolation requirements without relying on Spot instances or single availability zones.

Anahtar Kavram

Azure Virtual Machine Scale Sets Flexible Orchestration
Tahmini Süre:2m 0s
Soru 283Soru →

A logistics enterprise is designing a regional application architecture in the East US region. The system includes two distinct components:
1. A fleet of backend Virtual Machines (VMs) that ingest raw TCP telemetry from package scanners on port 5001. The VMs are currently assigned Basic SKU Public IP addresses.
2. A web management application that requires SSL/TLS termination and URL path-based routing (e.g., routing '/api/*' and '/static/*' to different backend pools).

The enterprise requires a load balancing design that satisfies all protocol and routing requirements while ensuring compatibility with Azure SKU constraints.

Which load balancing architecture should you design for this application?

Cevabı ve açıklamayı göster

Cevap: Upgrade the Public IP addresses of the backend VMs to Standard SKU, deploy an Azure Standard Load Balancer to distribute the TCP telemetry traffic, and deploy an Azure Application Gateway (v2) to manage the web management application traffic.

Cevap

Upgrade the Public IP addresses of the backend VMs to Standard SKU, deploy an Azure Standard Load Balancer to distribute the TCP telemetry traffic, and deploy an Azure Application Gateway (v2) to manage the web management application traffic.
The correct solution uses an Azure Standard Load Balancer for the Layer 4 TCP telemetry traffic and an Azure Application Gateway for the Layer 7 HTTPS web management traffic. To prevent validation errors, the Basic SKU Public IPs on the backend VMs must be upgraded to Standard SKU because Standard Load Balancers do not support backend VMs with Basic SKU IP configurations.

Adım Adım Çözüm

1
Identify the protocol requirements for both layers of the application.
The telemetry ingestion layer requires Layer 4 TCP load balancing on port 5001. The web management application requires Layer 7 features including SSL/TLS termination and path-based routing.
This establishes which load balancer types (Layer 4 vs Layer 7) are appropriate for each workload.
2
Select the appropriate Azure services for the load balancing requirements.
Azure Standard Load Balancer is selected for the Layer 4 TCP ingestion traffic, and Azure Application Gateway is selected for the regional Layer 7 HTTPS management traffic.
Standard Load Balancer handles high-throughput Layer 4 traffic, while Application Gateway provides the path routing and TLS termination required for the web application.
3
Analyze Azure SKU compatibility rules for the backend pool.
Backend VMs with Basic SKU Public IPs cannot be placed in the backend pool of a Standard Load Balancer.
Azure enforces that all network resources associated with a Standard Load Balancer backend pool must use Standard SKU IP addresses to prevent configuration mismatches.
4
Determine the necessary remediation to satisfy the SKU constraints.
The Public IPs of the backend VMs must be upgraded to Standard SKU to allow successful association with the Standard Load Balancer.
Upgrading the IPs resolves the SKU mismatch validation error.

Anahtar Kavram

Azure load balancing selection based on protocol support and SKU compatibility rules.
Soru 284Soru →

A manufacturing corporation is planning the Azure compute architecture for two internal workloads:

- Workload 1: An automated data analysis engine that processes non-critical, interruptible batch jobs. The jobs can be safely restarted if interrupted, and minimizing compute cost is the primary objective.
- Workload 2: A core ERP database application that runs constantly and has strict regulatory requirements specifying that the virtual machines must run on dedicated physical hardware.

Which two compute virtualization solutions should you include in the design?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Spot Virtual Machines to run the data analysis engine.; Azure Dedicated Hosts to run the ERP database application virtual machines.

Cevap

The correct compute virtualization solutions are using Azure Spot Virtual Machines to run the data analysis engine and Azure Dedicated Hosts to run the ERP database application virtual machines.
The correct strategy combines Azure Spot VMs and Azure Dedicated Hosts. Spot VMs are designed for workloads that can be interrupted, offering the lowest possible cost for the data analysis engine. Dedicated Hosts provide physical hardware isolation, satisfying the regulatory compliance requirement for the ERP database.

Adım Adım Çözüm

1
Analyze the requirements for Workload 1
Workload 1 requires low cost and can tolerate interruptions and restarts.
Identify which Azure VM tier matches interruptible, cost-sensitive batch processing.
2
Select the appropriate option for Workload 1
Azure Spot Virtual Machines are selected for Workload 1.
Spot VMs offer steep discounts (up to 90%) in exchange for the possibility of eviction, which fits the non-critical nature of the workload.
3
Analyze the requirements for Workload 2
Workload 2 requires dedicated physical hardware to meet isolation compliance mandates.
Identify which Azure virtualized compute option provides dedicated physical host-level isolation.
4
Select the appropriate option for Workload 2
Azure Dedicated Hosts are selected for Workload 2.
Azure Dedicated Hosts allocate physical servers to a single subscription, ensuring compliance and physical isolation.

Anahtar Kavram

Selecting Azure compute tiers based on cost-efficiency (Spot VMs) versus regulatory and isolation constraints (Dedicated Hosts).
Soru 285Soru →

NovaBio Research is designing a secure network architecture in Azure to support a team of remote laboratory researchers. The researchers must connect to Azure Virtual Machines deployed in a private subnet.

The architecture must meet the following requirements:
* Remote researchers must be able to establish secure, encrypted, client-based connections to the virtual machines over the public internet without exposing the virtual machines directly to the internet.
* The virtual machines must be prevented from initiating outbound connections to the internet, except for necessary data uploads to Azure Storage.

Which two actions should you perform to meet the requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure a Network Security Group (NSG) associated with the VM subnet with an outbound rule that denies outbound traffic to the Internet, and a higher-priority outbound rule that allows outbound traffic to the Storage service tag.; Deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for the remote researchers.

Cevap

To meet the security requirements, you should deploy an Azure VPN Gateway in the virtual network and configure Point-to-Site (P2S) VPN connections for remote client access, and configure an NSG on the VM subnet with an outbound deny rule for the Internet and a higher-priority outbound allow rule for the Storage service tag.
Deploying an Azure VPN Gateway configured for Point-to-Site (P2S) VPN provides secure, client-based connection over the internet directly to the private subnet without public endpoints on the virtual machines. Additionally, configuring an NSG with an outbound rule denying internet access alongside a higher-priority rule allowing traffic to the Storage service tag ensures VMs can only upload data to Azure Storage and cannot access the rest of the public internet.

Adım Adım Çözüm

1
Address remote secure client access.
Identify Point-to-Site (P2S) VPN as the secure client-based connection method over the public internet to the virtual network.
This satisfies the requirement to allow remote researchers to connect securely without public IP exposure on the virtual machines.
2
Configure outbound access controls.
Use Network Security Groups (NSGs) with built-in service tags to block general outbound internet access while permitting traffic specifically to Azure Storage.
This meets the security requirement with minimal administrative effort by avoiding manually tracking and updating target IP addresses.

Anahtar Kavram

Designing secure network connectivity and access control using VPN Gateway and Network Security Groups with Service Tags.
Soru 286Soru →

A logistics company is designing an event-driven processing workflow for shipping manifests uploaded to Azure Blob Storage. Each manifest triggers a processing task that parses the file, cross-references international customs databases, and generates a compliance report. The task takes approximately 12 minutes to complete and runs sporadically throughout the day. You need to recommend a serverless compute option that supports this execution duration while minimizing costs by scaling to zero instances when no manifests are being processed. Which solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: An Azure Container Apps job

Cevap

An Azure Container Apps job
The correct answer is the option specifying an Azure Container Apps job. This service is designed for run-to-completion, event-driven tasks that can execute for hours. It scales down to zero instances when idle, ensuring that costs are minimized, while avoiding the operational overhead associated with managing a full Kubernetes cluster.

Adım Adım Çözüm

1
Evaluate the execution duration against the limits of Consumption-based serverless options.
The task requires 12 minutes of processing, which exceeds the 10-minute maximum execution timeout limit of Azure Functions on a Consumption plan.
This rules out standard Consumption-based Azure Functions as they would terminate the execution before completion.
2
Evaluate the scaling and operational overhead requirements.
The solution must scale to zero when idle to minimize costs, and it should minimize administrative overhead.
This rules out dedicated App Service plans or virtual machine-based solutions that incur continuous idle costs, and rules out complex orchestrators like Azure Kubernetes Service (AKS) which add administrative complexity.
3
Select the serverless compute resource designed for run-to-completion containerized tasks.
Azure Container Apps jobs are identified as the best fit because they support event-driven triggers, run-to-completion execution for hours, and scale to zero when idle.
This provides a low-overhead, serverless environment matching all constraints.

Anahtar Kavram

Selecting serverless compute services based on execution duration limits, operational overhead, and scale-to-zero requirements.
Tahmini Süre:1m 30s
Soru 287Soru →

A financial organization is deploying a hybrid network architecture. A central virtual network named `vnet-transit-hub` (172.20.0.0/16172.20.0.0/16) connects to the company's on-premises datacenter through an Azure ExpressRoute gateway. To support dynamic routing, the organization deploys a third-party Network Virtual Appliance (NVA) in `vnet-transit-hub` within a subnet named `snet-nva` (172.20.1.0/24172.20.1.0/24). An Azure Route Server is deployed in the mandatory `RouteServerSubnet` (172.20.2.0/24172.20.2.0/24) to exchange routing information.

The organization needs to ensure that the NVA and the on-premises datacenter can dynamically exchange routing information through BGP without maintaining manual static routes.

Which design action must be taken to support this routing requirement?

Cevabı ve açıklamayı göster

Cevap: Configure BGP peering between the Network Virtual Appliance (NVA) and the Azure Route Server, and enable the branch-to-branch setting on the Azure Route Server.

Cevap

Configure BGP peering between the Network Virtual Appliance (NVA) and the Azure Route Server, and enable the branch-to-branch setting on the Azure Route Server.
To exchange routes dynamically, BGP peering must be configured between the Route Server and the NVA. In addition, the branch-to-branch (Route-to-Route) setting on the Azure Route Server must be enabled to allow it to propagate routes between the ExpressRoute gateway and the NVA.

Adım Adım Çözüm

1
Establish BGP peering between the NVA and Azure Route Server.
The Route Server learns the routes advertised by the NVA, and the NVA learns the routes known to the Route Server.
BGP peering is required for Azure Route Server to dynamically build its routing table using the NVA as a peer.
2
Enable the branch-to-branch (Route-to-Route) setting on Azure Route Server.
Dynamic route exchange is permitted between the ExpressRoute gateway and the NVA.
By default, Azure Route Server does not propagate routes directly between virtual network gateways (like ExpressRoute or VPN) and peered NVAs. Enabling branch-to-branch permits transitivity.

Anahtar Kavram

Azure Route Server enables dynamic route propagation between NVAs and virtual network gateways. Peering the NVA with the Route Server and enabling branch-to-branch connectivity are required to allow transit routing.

Alternatif Yöntem

Instead of using Azure Route Server, you could configure static routes (UDRs) in every spoke VNet pointing to the NVA's IP address. However, this is not dynamic and does not scale well as the network grows, making Route Server the optimal design choice.
Tahmini Süre:1m 30s
Soru 288Soru →

A manufacturing company is planning to migrate its on-premises supply chain management (SCM) system from a physical server environment to Azure. The SCM system consists of three physical servers: a database server running SQL Server 2016, an application server running a background Windows service, and a reporting server.

The SCM system has the following requirements and technical constraints:
* The database utilizes SQL Server Agent jobs for nightly inventory reconciliation, cross-database queries, and Service Broker.
* The application server requires sub-millisecond network latency to the database server.
* On-premises users must access the migrated application using single sign-on (SSO).
* The identity solution must minimize operational complexity and administrative overhead. The company's security policy permits storing password hashes in the cloud.

You need to design the migration assessment and target architecture.

Which recommendation meets the requirements?

Cevabı ve açıklamayı göster

Cevap: Assess dependencies by installing the Azure Migrate dependency agent on the physical servers. Migrate the SQL Server database to Azure SQL Managed Instance. Implement hybrid identity by configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.

Cevap

Assess dependencies by installing the Azure Migrate dependency agent on the physical servers. Migrate the SQL Server database to Azure SQL Managed Instance. Implement hybrid identity by configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.
The correct recommendation is to install the Azure Migrate dependency agent on the physical servers, migrate the database to Azure SQL Managed Instance, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO. Agent-based dependency mapping is required for physical servers to analyze network connections and ensure sub-millisecond latency dependencies are met. Azure SQL Managed Instance is the appropriate database target since it supports SQL Server Agent, cross-database queries, and Service Broker. PHS with Seamless SSO provides SSO functionality with the lowest operational complexity.

Adım Adım Çözüm

1
Determine database migration target based on feature requirements.
Select Azure SQL Managed Instance.
The on-premises database utilizes SQL Server Agent, cross-database queries, and Service Broker, which are not supported in Azure SQL Database but are fully supported in Azure SQL Managed Instance.
2
Select the correct dependency assessment tool and method for physical servers.
Use Azure Migrate with agent-based dependency mapping.
Agent-based mapping is required for physical servers to discover network dependencies and ensure components requiring sub-millisecond latency are grouped appropriately. Agentless dependency analysis is not supported for physical servers.
3
Select hybrid identity synchronization method to meet SSO and complexity requirements.
Configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO.
This configuration provides a single sign-on experience for on-premises users while keeping administrative and infrastructure overhead to a minimum, as permitted by the security policy.

Anahtar Kavram

Designing migration strategies, database target selection, and identity synchronization for physical workloads.
Soru 289Soru →

Helios Energy Services is designing a secure network infrastructure in Azure. A virtual network contains a subnet named Subnet1, which hosts virtual machines (VMs) that run an application. The VMs require access to secrets stored in Azure Key Vault. According to company policy, all outbound internet traffic from Subnet1 must be blocked, except for traffic destined for Azure Key Vault. You need to recommend a network security solution that satisfies the company policy while minimizing administrative overhead. What should you recommend?

Cevabı ve açıklamayı göster

Cevap: Associate a Network Security Group (NSG) with Subnet1. Create an outbound security rule that allows traffic to the AzureKeyVault service tag, and a lower-priority outbound security rule that denies traffic to the Internet service tag.

Cevap

Associate a Network Security Group (NSG) with Subnet1, create an outbound security rule allowing traffic to the AzureKeyVault service tag, and create a lower-priority rule denying traffic to the Internet service tag.
The correct option is to associate a Network Security Group (NSG) with Subnet1, create a rule allowing outbound traffic to the AzureKeyVault service tag, and create a lower-priority rule denying outbound traffic to the Internet service tag. This configuration allows the virtual machines to reach Azure Key Vault securely while blocking all other outbound internet traffic. Using service tags eliminates the need to manage individual IP ranges, minimizing administrative effort.

Adım Adım Çözüm

1
Determine the optimal Azure resource for filtering traffic at the subnet level.
Identify that a Network Security Group (NSG) associated with Subnet1 is the standard and most efficient way to filter inbound and outbound network traffic.
NSGs operate at the subnet or network interface level to enforce security rules.
2
Select a method to define the destination for Azure Key Vault traffic that minimizes management effort.
Choose the built-in 'AzureKeyVault' service tag instead of maintaining individual public IP addresses.
Service tags represent a group of IP address prefixes from a given Azure service and are managed automatically by Microsoft, reducing administrative overhead.
3
Configure the rules and priorities to restrict internet access while permitting Key Vault traffic.
Create a higher-priority rule (e.g., priority 100) allowing outbound traffic to the 'AzureKeyVault' service tag, and a lower-priority rule (e.g., priority 200) denying outbound traffic to the 'Internet' service tag.
Rules are processed in priority order, so Key Vault traffic is allowed first before the general internet traffic block is applied.

Anahtar Kavram

Azure Network Security Group (NSG) Service Tags allow you to define network access controls for Azure services without manually managing IP addresses, minimizing administrative overhead while securing outbound connections.
Soru 290Soru →

An educational technology company is designing a serverless video processing workflow for their on-demand learning platform. The workflow requires two components:

1. A background worker that extracts audio from uploaded videos and generates text transcripts. This process is CPU-heavy and takes between 15 to 30 minutes to complete per video.
2. A lightweight REST API that serves the transcripts to users. This API experiences highly sporadic traffic and must minimize cost by scaling to zero instances when idle.

Which two Azure hosting options should you recommend to meet these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps Jobs to host the background video processing worker; Azure Functions on a Consumption plan to host the REST API

Cevap

Azure Container Apps Jobs to host the background video processing worker, and Azure Functions on a Consumption plan to host the REST API.
Azure Container Apps Jobs are ideal for running background tasks that run to completion and can execute for longer durations without the 10-minute timeout limit of standard serverless functions. Azure Functions on a Consumption plan is the most cost-effective choice for a lightweight REST API with sporadic traffic because it scales down to zero instances when not in use, avoiding compute costs during idle periods.

Adım Adım Çözüm

1
Analyze the requirements for the background worker.
The background worker requires CPU-heavy processing that runs for 15 to 30 minutes per video.
This exceeds the maximum execution timeout of 10 minutes for standard serverless functions hosted on Azure Functions Consumption plans, meaning we need a hosting model that supports long-running execution and containerization, such as Azure Container Apps Jobs.
2
Analyze the requirements for the REST API.
The REST API has highly sporadic traffic and must minimize cost by scaling down to zero instances when idle.
Azure Functions on a Consumption plan is the ideal serverless offering to host a lightweight API with sporadic load, as it scales down to zero dynamically to ensure you only pay when code is executing.
3
Verify service match and eliminate sub-optimal options.
Azure Container Apps Jobs handles the long-running worker, and Azure Functions on Consumption plan hosts the API.
Using Azure Functions Consumption plan for the worker fails due to timeout limits, while using an AKS cluster for the API introduces unnecessary management overhead and continuous compute costs.

Anahtar Kavram

Designing serverless host options based on execution duration, scaling behavior, and management overhead constraints.
Tahmini Süre:2m 0s
Soru 291Soru →

Skyward Aviation is designing a secure network architecture in Azure. You have a virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 hosts several virtual machines that run a legacy application. The virtual machines must access an Azure SQL database and an Azure Storage account. You need to design a network security and private access solution that meets the following requirements:
- Access to the Azure SQL database and Azure Storage account must be restricted to only traffic originating from Subnet1.
- The public IP addresses of the Azure SQL database and Azure Storage account must not be exposed to the virtual machines.
- The virtual machines must connect to the services using private IP addresses.
- Administrative effort to maintain the network configuration must be minimized.

Which two actions should you recommend?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in VNet1.; Configure private DNS zones in Azure for the services and link the zones to VNet1.

Cevap

To meet the requirements, you should deploy a Private Endpoint for the Azure SQL database and a Private Endpoint for the Azure Storage account in the virtual network, and configure private DNS zones in Azure for the services and link the zones to the virtual network.
Deploying Private Endpoints allocates private IP addresses from the virtual network to the Azure SQL database and Azure Storage account, ensuring all communication remains within the Microsoft backbone network and is not exposed to the public internet. Configuring Private DNS zones and linking them to the virtual network enables the application to automatically resolve the services' FQDNs to their private IPs without manual hosts file updates or custom DNS server management, which minimizes administrative overhead.

Adım Adım Çözüm

1
Select the appropriate private access technology.
Private Endpoints are selected because they assign private IP addresses from the virtual network to the services, preventing public IP exposure.
The requirement specifies that virtual machines must connect to the services using private IP addresses and public IP addresses must not be exposed.
2
Ensure proper name resolution for the private endpoints.
Private DNS zones are created for the database and storage services, and linked to the virtual network.
This allows the application to continue using the services' fully qualified domain names (FQDNs) while resolving them to the private IP addresses of the Private Endpoints, keeping administrative effort low.

Anahtar Kavram

Private access to Azure services using Private Endpoints and Private DNS Zones to avoid public endpoint exposure.
Soru 292Soru →

An enterprise is designing a hub-and-spoke virtual network topology in Azure:
- The hub virtual network, `vnet-hub-weur`, has the address space 10.10.0.0/1610.10.0.0/16 and hosts an Azure Firewall at 10.10.1.410.10.1.4.
- The spoke virtual network, `vnet-spoke-prod`, has the address space 10.20.0.0/1610.20.0.0/16 and contains a subnet named `snet-app` (10.20.1.0/2410.20.1.0/24).
- Virtual network peering is established between `vnet-hub-weur` and `vnet-spoke-prod` with transit enabled.

The enterprise has the following routing requirements for traffic originating from `snet-app`:
1. All traffic destined for the internet must be inspected by the Azure Firewall in `vnet-hub-weur`.
2. All traffic destined for resources in `vnet-hub-weur` must be inspected by the Azure Firewall.
3. Traffic destined for other subnets within `vnet-spoke-prod` must bypass the firewall and route directly.

You need to configure the route table associated with `snet-app` to meet these requirements. Which two route configurations should you add? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A route for 0.0.0.0/00.0.0.0/0 with a next hop type of `Virtual appliance` and a next hop IP address of 10.10.1.410.10.1.4.; A route for 10.10.0.0/1610.10.0.0/16 with a next hop type of `Virtual appliance` and a next hop IP address of 10.10.1.410.10.1.4.

Cevap

The correct configurations are to add a route for 0.0.0.0/00.0.0.0/0 with a next hop of the firewall IP (10.10.1.410.10.1.4) and a route for the hub address space (10.10.0.0/1610.10.0.0/16) pointing to the same firewall IP.
To route internet traffic to the firewall, you must define a default route of 0.0.0.0/00.0.0.0/0 pointing to the firewall's private IP address as a virtual appliance. To route traffic destined for the hub virtual network through the firewall instead of the direct peering connection, you must explicitly define a route for the hub IP address range (10.10.0.0/1610.10.0.0/16) pointing to the firewall. This is because user-defined routes (UDRs) have higher precedence than system-defined peering routes.

Adım Adım Çözüm

1
Determine the route required to inspect internet-bound traffic.
Create a route for 0.0.0.0/00.0.0.0/0 with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (10.10.1.410.10.1.4).
This redirects all default traffic (internet) to the firewall instead of using the default system route for the internet.
2
Determine how to inspect traffic going to the hub virtual network.
Create a route for 10.10.0.0/1610.10.0.0/16 with next hop type set to `Virtual appliance` and the next hop IP address set to the firewall IP (10.10.1.410.10.1.4).
By default, virtual network peering creates a system route for the peered range (10.10.0.0/1610.10.0.0/16) with next hop type `VNet peering`. To inspect this traffic, a user-defined route must be created for the same prefix, which takes precedence over the system route.
3
Evaluate the need for routing within the local spoke virtual network.
Leave local routing to the default system route for the virtual network (10.20.0.0/1610.20.0.0/16).
Azure automatically routes traffic within the same virtual network locally. Creating a user-defined route for the local virtual network range pointing to the firewall would incorrectly intercept intra-spoke traffic, breaking the requirement to bypass the firewall for local communication.

Anahtar Kavram

Azure User-Defined Routes (UDR) precedence and path selection in hub-and-spoke topologies.
Soru 293Soru →

An organization is planning to migrate a legacy enterprise resource planning (ERP) system hosted on-premises on physical servers to Azure. The system consists of two application servers running a proprietary Java application that communicates with several unidentified legacy internal services, and a SQL Server database that utilizes SQL Server Agent jobs, cross-database queries, and SQL Common Language Runtime (CLR) integration. The organization requires that users authenticate using their existing on-premises credentials while avoiding the deployment and management of federation infrastructure. Which two actions should you include in the migration assessment and strategy? (Choose two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Recommend migrating the database to Azure SQL Managed Instance.; Recommend configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).

Cevap

Migrate the database to Azure SQL Managed Instance, and configure Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless Single Sign-On (SSO).
The correct strategy involves migrating the database to Azure SQL Managed Instance because it supports legacy SQL Server features like cross-database queries, SQL Server Agent, and SQL CLR. For identity, configuring Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO provides on-premises credentials for users without the complexity of deploying federation services (AD FS).

Adım Adım Çözüm

1
Analyze database requirements.
The database uses SQL Server Agent, cross-database queries, and SQL CLR.
To select a compatible cloud database hosting option.
2
Determine the database tier.
Azure SQL Managed Instance supports these legacy database features, whereas Azure SQL Database does not.
To ensure functional parity and avoid rewriting application code.
3
Analyze identity requirements.
The organization needs on-premises authentication but wants to avoid federation infrastructure.
To choose a hybrid identity solution that minimizes operational complexity.
4
Determine the identity synchronization method.
Microsoft Entra Connect with Password Hash Synchronization (PHS) and Seamless SSO satisfies this requirement without AD FS.
To meet authentication requirements with low administrative overhead.
5
Analyze application dependencies.
The application has dependencies on unidentified legacy services, requiring dependency mapping before migration.
To ensure all dependent components are identified and migrated together, preventing post-migration connectivity issues.

Anahtar Kavram

Analyzing database requirements, identity synchronization, and application dependencies for Azure migration assessment.
Soru 294Soru →

An insurance firm is designing the compute infrastructure for a new core claims processing application. The application has the following requirements:
- It runs a steady-state, critical production workload that operates 24/7.
- It requires high memory-to-CPU ratios for memory-intensive data analysis.
- It must meet an SLA of 99.99% uptime.
- It must minimize costs for baseline continuous usage.

Which two compute configurations should you recommend to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Deploy E-series virtual machines within a Virtual Machine Scale Set in Flexible orchestration mode spread across multiple Availability Zones.; Utilize Azure Reserved Virtual Machine Instances for the selected virtual machine sizes.

Cevap

Deploy E-series virtual machines within a Virtual Machine Scale Set in Flexible orchestration mode spread across multiple Availability Zones, and utilize Azure Reserved Virtual Machine Instances for the selected virtual machine sizes.
To meet the 99.99% uptime SLA and high memory requirements of the claims processing application, you should deploy E-series (memory-optimized) virtual machines across multiple Availability Zones using a Virtual Machine Scale Set in Flexible orchestration mode. Additionally, because the workload is steady-state and operates 24/7, Azure Reserved Virtual Machine Instances should be utilized to minimize baseline compute costs.

Adım Adım Çözüm

1
Analyze the workload characteristics and SLA requirements.
The workload requires high memory-to-CPU ratios (demanding E-series virtual machines) and must meet a 99.99% availability SLA (demanding deployment across multiple Availability Zones, such as using Virtual Machine Scale Sets in Flexible orchestration mode).
Correct virtual machine series selection and high availability design are critical to meeting technical and business requirements.
2
Determine the appropriate billing model for a 24/7 steady-state workload.
Azure Reserved Virtual Machine Instances should be used for cost optimization instead of Spot Virtual Machines.
Steady-state workloads running continuously benefit from the cost reduction of reservation commitments, whereas Spot Virtual Machines can be evicted and do not guarantee uptime.

Anahtar Kavram

Designing highly available, cost-effective compute solutions using appropriate VM series, orchestration modes, and purchasing options.
Soru 295Soru →

A renewable energy provider is designing a solution to process daily wind turbine telemetry logs. The logs are collected and uploaded as a ZIP archive to Azure Blob Storage once per day. A containerized console application must extract the archive, validate the data format, and write the output to a database. The processing task runs sequentially and takes approximately 15 minutes to complete. The provider wants to minimize ongoing costs, ensure the task runs to completion, and minimize operational management overhead.

Which Azure service should you recommend to host the processing application?

Cevabı ve açıklamayı göster

Cevap: Azure Container Apps Jobs

Cevap

Azure Container Apps Jobs
Azure Container Apps Jobs are the optimal choice because they are designed for run-to-completion containerized tasks. They run on-demand, scale down to zero when idle to minimize costs, support execution times longer than 10 minutes, and do not require the overhead of managing a Kubernetes cluster.

Adım Adım Çözüm

1
Analyze the execution duration requirement of the workload.
The workload runs for approximately 15 minutes, which rules out hosting options with strict timeout limitations under 15 minutes.
Identify hosting options that can support tasks running longer than the typical serverless default of 5 to 10 minutes.
2
Evaluate the management and operational overhead constraints.
The requirement to minimize operational overhead rules out full container orchestrator platforms or virtual machine management.
Determine if the service requires manual provisioning, patching, or scaling configuration of underlying nodes.
3
Evaluate cost and scaling behavior during idle periods.
The workload runs once per day, so a serverless model that scales down to zero when inactive is required to minimize cost.
Match the daily on-demand execution pattern with a billing model that only charges for active execution time.

Anahtar Kavram

Selecting the appropriate Azure serverless or container hosting service based on execution duration, operational overhead, and scaling requirements.

Alternatif Yöntem

Alternatively, you could run the workload using Azure Container Instances (ACI) triggered by a logic app, though Azure Container Apps Jobs provides native scaling and event-driven triggers optimized for batch jobs.
Tahmini Süre:1m 30s
Soru 296Soru →

A municipal transit authority is designing the regional application delivery and load balancing architecture for its new passenger information system in the North Europe region. The system consists of two primary workloads deployed within a single virtual network:

1. A passenger-facing web portal that requires SSL/TLS termination, cookie-based session affinity, and URL path-based routing (routing `/schedules/*` and `/fares/*` to separate backend pools).
2. A real-time vehicle telemetry ingestion service that processes continuous location data sent over UDP port 5099.

The backend VMs for the telemetry service currently have Basic SKU public IP addresses assigned to their network interfaces.

You need to recommend a load balancing solution that meets all technical requirements while ensuring architectural compatibility.

Which load balancing solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Deploy Azure Application Gateway Standard v2 to load balance the web portal, and deploy Azure Standard Load Balancer to load balance the telemetry service after upgrading the telemetry VMs' public IP addresses to Standard SKU.

Cevap

Deploy Azure Application Gateway Standard v2 to load balance the web portal, and deploy Azure Standard Load Balancer to load balance the telemetry service after upgrading the telemetry VMs' public IP addresses to Standard SKU.
The correct solution uses Azure Application Gateway Standard v2 for the web portal because it natively supports Layer 7 capabilities including SSL/TLS termination, cookie-based affinity, and URL path-based routing. It uses Azure Standard Load Balancer for the telemetry service because the service uses the UDP protocol, which is not supported by Application Gateway. Upgrading the telemetry VMs' public IP addresses to Standard SKU is necessary because Azure does not permit VMs with Basic SKU public IP addresses to be members of a Standard Load Balancer's backend pool.

Adım Adım Çözüm

1
Identify the routing requirements of the web portal.
These are Layer 7 application-layer routing capabilities, which require Azure Application Gateway (or Azure Front Door, but Front Door is global whereas this is regional).
Azure Load Balancer operates at Layer 4 and cannot inspect HTTP paths or handle cookie-based affinity.
2
Identify the routing requirements of the telemetry service.
This requires a Layer 4 load balancer since Azure Application Gateway only supports HTTP, HTTPS, HTTP/2, and WebSocket protocols.
Azure Standard Load Balancer is needed to route UDP traffic.
3
Evaluate backend compatibility and SKU constraints.
To attach these VMs to the Standard Load Balancer backend pool, their public IP addresses must be upgraded to Standard SKU.
You cannot mix Basic SKU public IP addresses with Standard SKU load balancers.

Anahtar Kavram

Combining Azure Application Gateway for Layer 7 web traffic and Azure Standard Load Balancer for Layer 4 UDP traffic, while resolving SKU mismatch limitations between Basic SKU public IPs and Standard SKU load balancers.
Soru 297Soru →

A healthcare organization is designing a compute virtualization solution on Azure to host a new medical records processing application. The application must meet the following requirements:
- Process sensitive patient information and protect data in use using hardware-based memory encryption.
- Run continuously as a steady-state production service.
- Maximize availability by protecting against localized datacenter outages.

Which compute virtualization solution should you recommend?

Cevabı ve açıklamayı göster

Cevap: Confidential virtual machines deployed across multiple Azure availability zones

Cevap

Confidential virtual machines deployed across multiple Azure availability zones
The correct option satisfies the requirement to protect data in use by using Confidential virtual machines, which support memory encryption. It also satisfies the availability requirement by deploying the VMs across multiple availability zones, ensuring resilience against localized datacenter failures.

Adım Adım Çözüm

1
Identify the core security requirement to protect data in use.
Determine that Azure Confidential VMs utilizing hardware-based technologies (such as AMD SEV-SNP or Intel TDX) are required to encrypt memory and protect data during processing.
Standard VM series only support encryption at rest, whereas confidential computing is required for encrypting data in memory while it is actively being processed.
2
Evaluate the workload continuity and availability parameters.
Confirm that the steady-state, 24/7 nature of the workload rules out Spot VMs, and the need for protection against datacenter outages requires distributing VMs across multiple availability zones.
Spot VMs are designed for interruptible workloads and are subject to immediate eviction. Single-zone VM deployments do not protect against localized zone failures.
3
Select the design that satisfies all security, availability, and complexity constraints.
Recommend deploying Confidential virtual machines distributed across multiple availability zones.
This configuration secures data in use, ensures regional high availability, and avoids the unnecessary administrative overhead of deploying container orchestration platforms.

Anahtar Kavram

Azure Confidential Computing and Virtual Machine High Availability
Tahmini Süre:1m 30s
Soru 298Soru →

A financial services provider is designing the Azure compute and storage infrastructure for two distinct workloads:

WorkloadCore RequirementsUptime SLAOperational ModeStorage Needs
Workload 1Physical hardware isolation99.99%99.99\%Continuous / Steady-stateLow-latency, high-throughput database transaction logs
Workload 2Budget-constrainedNonePeriodic / InterruptibleStandard storage

Which infrastructure strategy should you recommend to meet these requirements?

Cevabı ve açıklamayı göster

Cevap: Host Workload 1 on Azure Dedicated Hosts deployed across multiple Availability Zones using Premium SSD disks, and run Workload 2 on Azure Spot Virtual Machines.

Cevap

Host Workload 1 on Azure Dedicated Hosts deployed across multiple Availability Zones using Premium SSD disks, and run Workload 2 on Azure Spot Virtual Machines.
The correct strategy hosts the transaction database (Workload 1) on Azure Dedicated Hosts to satisfy the regulatory hardware isolation requirement. These hosts are distributed across multiple Availability Zones to achieve the 99.99%99.99\% VM uptime SLA. The database transaction logs are placed on Premium SSDs to provide the necessary low-latency and high-throughput write performance. Finally, the non-critical, interruptible batch risk-modeling simulation (Workload 2) runs on Azure Spot VMs to maximize cost savings within strict budget limits.

Adım Adım Çözüm

1
Address physical isolation and continuity requirements for Workload 1.
Azure Dedicated Hosts are selected because they provide physical servers dedicated to a single Azure subscription, satisfying compliance while running steady-state operations.
Regulatory compliance demands physical hardware isolation, which is uniquely solved by Dedicated Hosts rather than standard multi-tenant Azure VMs.
2
Select the availability and zone redundancy strategy for Workload 1.
Deploy the Dedicated Hosts across multiple Availability Zones.
An uptime SLA of 99.99%99.99\% for virtual machines in Azure requires instances to be spread across two or more Availability Zones in the same region.
3
Choose the appropriate storage tier for database transaction logs.
Select Premium SSD storage.
Database transaction logs are highly sensitive to write latency. Standard HDDs do not meet the performance thresholds required, necessitating Premium SSDs or Ultra Disks.
4
Select the cost-effective compute solution for Workload 2.
Use Azure Spot Virtual Machines.
Workload 2 is periodic, budget-constrained, and interruptible, making it an ideal candidate for Spot VMs which offer deep discounts in exchange for being evictable.

Anahtar Kavram

Designing virtualized compute solutions in Azure with specific constraints around physical isolation, high availability, disk latency, and cost optimization.
Soru 299Soru →

An organization plans to migrate a customer billing application from an on-premises Nutanix AHV environment to Azure. The application consists of several Linux web servers and a SQL Server database tier. The database tier utilizes SQL Server Agent for scheduled data aggregation and requires cross-database queries across multiple databases. To prepare for the migration, the security team mandates that no software agents can be installed on the source servers for dependency mapping or discovery. The target database solution must be a Platform as a Service (PaaS) offering to reduce administrative overhead. User authentication must be integrated with Microsoft Entra ID using the simplest deployment model that supports credential synchronization, without deploying any federated or on-premises authentication agent servers. Which combination of discovery configuration, target database service, and hybrid identity synchronization should you recommend?

Cevabı ve açıklamayı göster

Cevap: Assessment: Deploy the Azure Migrate appliance and configure agentless dependency analysis. Database: Azure SQL Managed Instance. Identity: Microsoft Entra Connect with Password Hash Synchronization (PHS).

Cevap

The correct recommendation is to use agentless dependency analysis with the Azure Migrate appliance, migrate the database to Azure SQL Managed Instance, and implement hybrid identity using Microsoft Entra Connect with Password Hash Synchronization (PHS).
The correct option addresses all technical and organizational constraints. First, agentless dependency analysis with the Azure Migrate appliance maps application dependencies without installing software on the source virtual machines, meeting the security constraint. Second, Azure SQL Managed Instance provides near-100% compatibility with the on-premises SQL Server database engine, supporting legacy features like SQL Server Agent and cross-database queries within a Platform as a Service (PaaS) model. Third, Microsoft Entra Connect with Password Hash Synchronization (PHS) is the simplest hybrid identity configuration because it synchronizes password hashes to Microsoft Entra ID, allowing authentication requests to be handled entirely in the cloud without requiring on-premises authentication agents or federated authentication infrastructure.

Adım Adım Çözüm

1
Evaluate the assessment requirement for dependency mapping.
Determine that agentless dependency mapping using the Azure Migrate appliance must be configured.
The security team prohibits the installation of software agents on the source virtual machines, which rules out agent-based dependency mapping.
2
Evaluate the database tier requirements.
Select Azure SQL Managed Instance as the target database solution.
The application requires SQL Server Agent and cross-database queries. Azure SQL Database does not support these features natively. SQL Server on Azure Virtual Machines supports them but is an IaaS offering, violating the PaaS requirement.
3
Evaluate the hybrid identity synchronization requirements.
Select Microsoft Entra Connect with Password Hash Synchronization (PHS).
PHS is the simplest synchronization method and does not require on-premises authentication agent servers (unlike PTA) or federated authentication servers (unlike AD FS) to process or validate logins.

Anahtar Kavram

Selecting target migration services and assessment techniques based on technical compatibility, agent requirements, and operational complexity constraints.
Soru 300Soru →

Astraeus Telemetry is designing a secure Azure architecture for an IoT processing workload. The architecture includes a virtual network named VNet1 that contains a subnet hosting virtual machines. The virtual machines must make outbound connections to specific external fully qualified domain names (FQDNs) on the internet, such as *.api.weather.com and registry.npmjs.org, to fetch environmental data and software updates. The design must filter outbound traffic based on these FQDNs and support wildcard routing while minimizing administrative effort. Which component should you recommend including in the design?

Cevabı ve açıklamayı göster

Cevap: Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.

Cevap

Azure Firewall deployed in VNet1, with application rules configured to allow outbound traffic to the required fully qualified domain names.
The correct answer is the option recommending Azure Firewall with application rules. Azure Firewall operates as a fully managed cloud-based network security service that protects your Azure Virtual Network resources. Its application rules allow you to configure fully qualified domain names (FQDNs) that can be accessed from a subnet, which naturally supports wildcard configurations like '*.api.weather.com'. This satisfies both the security filtering requirement and the administrative overhead constraint.

Adım Adım Çözüm

1
Analyze the technical requirements: outbound traffic must be filtered by specific fully qualified domain names (FQDNs) and support wildcards (e.g., *.api.weather.com) with minimal administrative effort.
Identify that Network Security Groups (NSGs) and User Defined Routes (UDRs) cannot inspect or filter application-layer FQDNs directly.
NSGs and UDRs operate at the network and transport layers (Layers 3 and 4) and do not support dynamic wildcard FQDN filtering.
2
Evaluate the capabilities of Azure Firewall.
Confirm that Azure Firewall application rules are designed to filter outbound HTTP, HTTPS, and MSSQL traffic using FQDNs, including wildcard prefixes.
Azure Firewall provides built-in application-layer filtering to meet the requirement.
3
Evaluate administrative overhead of the options.
Azure Firewall is a managed service that automatically updates backend infrastructure and requires no manual maintenance of IP address changes for the external services.
This satisfies the requirement to minimize administrative effort.

Anahtar Kavram

Azure Firewall Application Rules for Outbound FQDN Filtering
ÖncekiSayfa 15 / 18Sonraki
Design Infrastructure Solutions Alıştırma Soruları — Microsoft Azure Solutions Architect (AZ-305) — Sayfa 15 | Examkin