Design Infrastructure Solutions

A financial services company is designing a new payment processing application on Azure. The architecture consists of a transaction processing API tier and a stateful database tier. The application design must satisfy the following requirements:

* The database tier requires at least 256 GB of memory and high temporary storage throughput. To minimize SQL Server core-based licensing costs, the operating system must only see 8 vCPUs, while the database continues to utilize the memory and I/O performance of a 32-core virtual machine size.
* The transaction processing API tier handles highly sensitive financial data in transit. It must run in a secure, hardware-isolated execution environment that protects data in memory from external access, including the host operating system, hypervisor, and cloud administrators.
* The database tier must remain highly available and survive a primary datacenter outage without unexpected interruptions or evictions.

Which two compute virtualization solutions or configurations should you recommend to meet these requirements?

An enterprise deploys a hub-and-spoke virtual network topology in Azure. The Hub Virtual Network (vnet-hub-prod, CIDR: 10.200.0.0/16) contains a subnet (snet-hub-nva, CIDR: 10.200.1.0/24) that hosts a firewall Network Virtual Appliance (NVA) at IP address 10.200.1.4. The Spoke Virtual Network (vnet-spoke-app, CIDR: 10.201.0.0/16) contains a subnet (snet-app-prod, CIDR: 10.201.1.0/24) hosting application servers. The virtual networks are peered.

The enterprise has the following requirements:
1. All outbound internet traffic from snet-app-prod must be routed through the NVA at 10.200.1.4 for security inspection.
2. Application servers in snet-app-prod must communicate directly with database servers in another subnet (snet-app-db, CIDR: 10.201.2.0/24) within the same virtual network without traversing the NVA, to minimize latency.
3. Access to public Azure Key Vault instances must go directly over the Azure backbone network using service tags.

A junior administrator creates a custom Route Table, associates it with snet-app-prod, and defines the following user-defined routes (UDRs):
- Route 1: Address prefix 0.0.0.0/0 -> Next hop: Virtual appliance (10.200.1.4)
- Route 2: Address prefix 10.201.0.0/16 -> Next hop: Virtual appliance (10.200.1.4)
- Route 3: Address prefix AzureKeyVault (Service Tag) -> Next hop: Internet

Following this configuration, application servers in snet-app-prod lose all connectivity to database servers in snet-app-db.

Which modification to the Route Table will restore the required network connectivity?

A biotechnology firm is designing a serverless container-based system on Azure to process genomic sequencing data. The architecture must support the following workloads:

* Workload 1: A research portal web application that accepts sequencing requests. The application must scale dynamically based on HTTP traffic, scale down to zero instances during idle periods to minimize costs, and support custom domain names with TLS termination.
* Workload 2: A sequencing analysis processor. Each execution is triggered by a new message in an Azure Service Bus queue, runs to completion, and can take up to three hours to finish. The processor must automatically scale its instances horizontally based on the number of messages in the queue.

You need to recommend the container compute solutions for both workloads. The solution must minimize administrative and operational overhead.

Which services should you recommend?

A logistics company is designing the Azure infrastructure for a new core order-tracking application. The application will run on Azure Virtual Machines, requires a $99.99\%$ availability SLA, and must remain operational even if a primary datacenter within the Azure region experiences a power outage. Which virtualization deployment strategy should you recommend?

A financial services company is designing a container-based credit scoring application on Azure. The application has the following design requirements:

* A real-time scoring API that must scale dynamically to zero during periods of inactivity and automatically scale up in response to HTTP request spikes, with minimal administrative and infrastructure management effort.
* A batch risk-processing engine that executes long-running, CPU-intensive simulation tasks that can take up to 4 hours to complete.

Which two container hosting solutions should you recommend to meet these requirements?

Your company has an Azure environment with a hub virtual network named `vnet-hub-core` ($10.10.0.0/16$) and a spoke virtual network named `vnet-prod-spoke` ($10.20.0.0/16$). The virtual networks are peered. A firewall is deployed in the hub virtual network with the private IP address $10.10.1.4$. You are configuring a route table for the subnets in `vnet-prod-spoke` to ensure all internet-bound traffic is routed through the firewall in the hub. Which route should you add to the route table to meet this requirement without breaking local communication within the spoke virtual network?

A company is planning the deployment of two workloads to Azure Virtual Machines:
- Workload 1: A non-critical development testing application that runs intermittently, can tolerate interruptions, and requires the lowest possible compute cost.
- Workload 2: A production database that runs continuously in a steady state and requires high availability.

Which two of the following VM configuration strategies should you include in the design?

A logistics enterprise is designing a containerized system to process real-time shipping telemetry data. The system must meet the following requirements:

* Host containerized microservices that process messages from an Azure Service Bus queue.
* Scale compute instances dynamically down to zero when no messages are in the queue.
* Support long-running background tasks that run continuously for up to 20 minutes to aggregate data.
* Minimize administrative and operational overhead, as the development team has no experience managing container orchestrators.
* Ensure high availability for steady-state production workloads without the risk of infrastructure eviction.

Which Azure compute service should you recommend to host this containerized system?

You are designing a serverless background processing solution in Azure. The solution must run a data import job once daily. The job takes approximately 25 minutes to complete. You need to select an Azure Functions hosting option that supports this execution duration while minimizing cost and management overhead. Which hosting plan should you recommend?

An enterprise is designing a hub-and-spoke virtual network topology in Azure with the following resource allocations:

* Hub VNet (`vnet-hub-prod`): CIDR $10.200.0.0/16$ containing a Network Virtual Appliance (NVA) at IP address $10.200.1.10$.
* Spoke VNet A (`vnet-spoke-web`): CIDR $10.201.0.0/16$.
* Spoke VNet B (`vnet-spoke-data`): CIDR $10.202.0.0/16$.

Virtual network peering is configured between `vnet-hub-prod` and `vnet-spoke-web`, and between `vnet-hub-prod` and `vnet-spoke-data`. No direct peering exists between the two spokes.

You are designing the routing tables for `vnet-spoke-web` to satisfy these requirements:
1. All outbound traffic destined for the database servers in `vnet-spoke-data` must transit through the NVA.
2. All outbound traffic destined for the management services in the hub VNet (`vnet-hub-prod`) must transit through the NVA.
3. Subnet-to-subnet traffic within `vnet-spoke-web` must remain direct and must not be sent to the NVA.

Which two routing configurations should you implement in the route table associated with the subnets in `vnet-spoke-web`?

An insurance firm is designing a container-based application that processes claims from an Azure Service Bus queue. The design must satisfy the following requirements:

* Scale dynamically from zero to hundreds of instances using Kubernetes Event-driven Autoscaling (KEDA) based on the queue depth.
* Establish private connectivity to secure back-end databases within an Azure Virtual Network.
* Minimize the administrative effort required to manage the container orchestration platform.
* Support execution times of up to 15 minutes per message without timeout.

Which two components should you include in the design? (Select two.)

An enterprise is designing a multi-region container-based solution on Azure. The solution requires hosting two distinct workloads:

- Workload 1: A backend service that must scale from zero dynamically based on the volume of messages in an Azure Service Bus queue. The enterprise wants to minimize ongoing administrative overhead and avoid managing container orchestration infrastructure.
- Workload 2: A security monitoring tool that requires direct access to the underlying Kubernetes API, custom daemonsets for host-level network packet inspection, and custom kernel parameter modifications.

Additionally, regulatory compliance policies mandate that log data must be isolated regionally and cannot leave the respective geographic boundaries of each deployment region.

Which two configurations should you include in the design to meet these requirements?

An enterprise plans to migrate a mission-critical, stateful database application to Azure. The application has the following requirements:
- Strict regulatory compliance mandates physical isolation at the hardware level, ensuring no other customer workloads run on the same physical host.
- The database is highly memory-intensive, requiring a memory-to-vCPU ratio of at least 8:1.
- The transaction log storage requires at least 80,000 IOPS with consistent sub-millisecond latency.
- The compute infrastructure must achieve a 99.99% availability service level agreement (SLA).
- The solution must support Azure Hybrid Benefit to minimize licensing costs.

Which compute and storage architecture should you recommend to meet these requirements?

An enterprise is designing virtual network routing for a spoke virtual network named `vnet-prod-spoke` (address space: $10.200.0.0/16$). The spoke VNet contains two subnets: `snet-app` ($10.200.1.0/24$) and `snet-db` ($10.200.2.0/24$). The spoke VNet is peered with a hub virtual network named `vnet-hub-weur` (address space: $10.100.0.0/16$), which hosts a Network Virtual Appliance (NVA) firewall at IP address $10.100.1.4$.

You configure a route table named `rt-app` and associate it with the `snet-app` subnet to meet the following requirements:
- Requirement 1: All traffic to the on-premises network ($172.16.0.0/12$) must be routed through the NVA firewall.
- Requirement 2: Traffic to other subnets within `vnet-prod-spoke` must route directly (not through the NVA) to minimize latency.
- Requirement 3: Traffic to the hub virtual network ($10.100.0.0/16$) must be routed through the NVA firewall.

To implement this, you add the following user-defined routes to `rt-app`:
- `Route_Hub`: Prefix $10.100.0.0/16$, Next hop: Virtual appliance ($10.100.1.4$)
- `Route_OnPrem`: Prefix $172.16.0.0/12$, Next hop: Virtual appliance ($10.100.1.4$)
- `Route_Local`: Prefix $10.200.0.0/16$, Next hop: Virtual appliance ($10.100.1.4$)

Which of the following statements correctly describe the impact of this configuration and the required action to satisfy the requirements? (Select TWO.)

You are designing the hosting infrastructure for two new workloads in Azure:
- Workload 1: A lightweight microservice that processes HTTP requests and must scale down to zero instances to minimize costs during idle periods.
- Workload 2: A data processing job that executes triggered events and runs for up to $30$ minutes per execution.

Which of the following service plans should you recommend for these workloads? (Select TWO.)

An enterprise is designing a container-based application on Azure that consists of a payment microservice and three operational microservices.

The design must satisfy the following requirements:
* Scale the compute resources dynamically based on message queue depth using KEDA, including scaling down to zero when idle.
* Minimize the administrative effort of managing container infrastructure, including OS patching, cluster upgrades, and node scaling.
* Route the console and system logs of the payment microservice to a dedicated regional Log Analytics workspace to meet compliance requirements.
* Route the logs of the operational microservices to a separate, shared Log Analytics workspace.
* Enable all microservices to communicate with each other securely over a private network.

Which architecture should you recommend?

A transit authority is designing a containerized telemetry processing system to monitor municipal bus fleets across two geographical sectors. The system consists of multiple microservices that ingest GPS coordinates and engine diagnostics from an Azure IoT Hub.

The architecture must meet the following requirements:
- Support event-driven scaling using KEDA based on message queue depth.
- Minimize administrative effort and operational overhead for managing the underlying compute infrastructure.
- Satisfy strict regional compliance regulations by ensuring that telemetry logs from each sector are stored exclusively within their respective Azure regions and are not co-mingled.

Which infrastructure design should you recommend?

An organization deploys an Azure virtual network named `vnet-prod-eastus` with the address space $10.95.0.0/16$. The virtual network contains three subnets:
* `snet-web` ($10.95.1.0/24$)
* `snet-db` ($10.95.2.0/24$)
* `snet-nva` ($10.95.10.0/24$), which hosts a Network Virtual Appliance (NVA) at the IP address $10.95.10.4$.

The organization intends to inspect all traffic from `snet-web` to `snet-db` using the NVA. An administrator creates a route table named `rt-prod-web`, associates it with `snet-web`, and adds a user-defined route (UDR) with the address prefix $10.95.0.0/16$ and the next hop pointing to the NVA.

After applying the route table, virtual machines in `snet-web` can no longer communicate with each other, and all intra-subnet traffic within `snet-web` fails.

What is the primary cause of this communication failure?

An enterprise implements a hub-and-spoke network topology in Azure. The topology contains a hub virtual network named `vnet-weur-hub` ($10.10.0.0/16$) and a spoke virtual network named `vnet-weur-spoke` ($10.20.0.0/16$). A network virtual appliance (NVA) is deployed in the hub at $10.10.1.4$.

You need to configure routing for the subnets in `vnet-weur-spoke` to meet the following requirements:
1. All traffic destined for the internet must route through the NVA at $10.10.1.4$.
2. All traffic destined for resources within `vnet-weur-spoke` must route directly between those resources.

Which two routes must be active in the effective routes of `vnet-weur-spoke` to meet these requirements? (Select two.)

A financial institution is designing the Azure compute infrastructure for two separate workloads:

- Workload 1: A core transaction processing system that runs steady-state, 24/7, requires physical isolation at the physical hardware level to meet regulatory compliance, and must be deployed across multiple availability zones to ensure zone-level high availability.
- Workload 2: A batch risk-modeling application that runs on weekends, is highly parallelizable, tolerant of interruptions, and must be deployed at the lowest possible cost.

Which two compute virtualization strategies should you recommend to meet these requirements? (Select two.)