Design Infrastructure Solutions

An organization is designing a hub-and-spoke virtual network topology in Azure to host a multi-tier web application. The topology consists of the following components:

* A hub virtual network named `vnet-eus-hub` ($10.100.0.0/16$) hosting an Azure Firewall at IP address $10.100.10.4$.
* A production spoke virtual network named `vnet-eus-prod` ($10.101.0.0/16$) peered with the hub virtual network.
* Three subnets inside `vnet-eus-prod`:
* `subnet-web` ($10.101.1.0/24$)
* `subnet-app` ($10.101.2.0/24$)
* `subnet-db` ($10.101.3.0/24$)

The design must satisfy the following routing requirements:
1. All outbound internet traffic from `subnet-web` must be inspected by the Azure Firewall in the hub.
2. All traffic between `subnet-web` and `subnet-app` must be inspected by the Azure Firewall in the hub.
3. Traffic between `subnet-app` and `subnet-db` must bypass the Azure Firewall and remain local within `vnet-eus-prod` to minimize latency.
4. You must minimize administrative overhead and avoid configuring redundant route rules.

Which route table configuration should you implement to meet the requirements?

You are designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-prod` ($10.100.0.0/16$), contains an active Virtual Network Gateway connected to your on-premises datacenter. The spoke virtual network, `vnet-spoke-app` ($10.101.0.0/16$), contains your application workloads. You configure virtual network peering between `vnet-hub-prod` and `vnet-spoke-app`. You need to ensure that the resources in `vnet-spoke-app` can communicate with the on-premises datacenter by using the gateway in `vnet-hub-prod`. Which two configurations should you perform to meet these requirements?

You are designing the serverless hosting infrastructure for an enterprise application that contains two distinct workloads:

* Workload 1: An HTTP-triggered API that processes incoming vendor requests. The API must access a backend database located in a secured Azure Virtual Network (VNet). The traffic is highly intermittent, with several hours of inactivity followed by unpredictable spikes. To minimize operating costs, the solution must scale to zero instances and incur no compute charges when idle.
* Workload 2: A queue-triggered background job that performs daily inventory synchronization. Each execution takes approximately 18 minutes to complete. The job must run on a serverless compute model that scales to zero when the queue is empty, and it must not experience timeout failures.

Which two hosting plans should you recommend to meet the requirements for both workloads? (Select two.)

An organization is designing a hub-and-spoke network topology in Azure. The hub virtual network, `vnet-hub-core` (address space: $10.1.0.0/16$), hosts a central network virtual appliance (NVA) at IP address $10.1.1.4$ that provides firewall and inspection services. The spoke virtual network, `vnet-spoke-data` (address space: $10.2.0.0/16$), contains two subnets: `snet-db` ($10.2.1.0/24$) hosting database servers, and `snet-app` ($10.2.2.0/24$) hosting application servers. The networks are connected via virtual network peering.

The security policy requires that all outbound internet traffic from the database servers in `snet-db` must be inspected by the hub NVA. However, database servers must communicate directly with application servers in `snet-app` within the same virtual network without routing through the hub NVA, minimizing latency and transaction costs.

To achieve this configuration, a custom route table will be associated with the `snet-db` subnet. Which route configuration should be added to the route table?

You are designing a secure network architecture for an application in Azure. The application consists of Azure Virtual Machines deployed in a subnet named Subnet1 within a virtual network named VNet1. The virtual machines must access an Azure Storage account named storage1 to retrieve configuration files. You need to recommend a solution that ensures all traffic from Subnet1 to storage1 flows over the Microsoft backbone network and that public access to storage1 from the internet is completely blocked. Which two actions should you include in the recommendation?

An organization needs to host a containerized background processing application in Azure. The application retrieves items from an Azure Queue Storage queue and processes them. The processing time for a single queue item is consistently $15$ minutes. The architecture team requires that the solution automatically scales based on the number of queue messages, minimizes management effort, and avoids paying for compute resources when the queue is empty. Which Azure compute solution should you recommend?

You are designing the routing for a subnet in an Azure virtual network named `vnet-prod-spoke` ($10.20.0.0/16$). You need to route all outbound internet traffic from the subnet to a firewall virtual appliance located in a peered virtual network. Traffic within `vnet-prod-spoke` ($10.20.0.0/16$) must continue to route directly between subnets without passing through the firewall. Which route should you add to the User-Defined Route (UDR) table associated with the subnet?

A company is designing a network security solution for its virtual machines (VMs) deployed in an Azure virtual network subnet. The VMs must be allowed outbound access to Azure Storage accounts only within the East US region to download updates. Outbound access to the public internet and storage accounts in other regions must be blocked. The solution must minimize administrative effort.

Which configuration should you recommend for the Network Security Group (NSG) associated with the VM subnet?

A financial company is designing a new event-driven transaction processing system on Azure. The system has the following requirements:
- Web APIs and background workers must scale dynamically based on the number of messages in an Azure Service Bus queue, including scaling down to zero instances.
- The background workers must support event-driven autoscaling using KEDA.
- You must run ad-hoc data reconciliation tasks that execute to completion and then terminate.
- You must minimize the administrative and operational effort required to manage the container infrastructure.
- Logs for the container workloads must be collected. For regulatory compliance, the production environment logs and test environment logs must be isolated and stored in different geographic regions.

Which two configurations should you recommend? (Select two.)

An energy utility company is designing a new container-based monitoring solution on Azure. The solution must support two environments: Production and Test.

The design must satisfy the following requirements:
* The containerized workloads in Production and Test must be completely isolated from each other at the network and compute levels.
* Administrative and operational overhead for managing the container infrastructure must be minimized.
* System logs from the Production environment must be stored in a different Log Analytics workspace than the Test environment logs to comply with strict data sovereignty policies.

Which two recommendations should you include in the infrastructure design? (Select two.)

An enterprise is designing a hub-and-spoke network topology in Azure to support dynamic routing between on-premises branch offices and Azure resources. The topology consists of the following:

* A hub virtual network named `vnet-use-hub` ($10.100.0.0/16$) containing:
* `GatewaySubnet` ($10.100.0.0/24$) with an ExpressRoute gateway.
* `RouteServerSubnet` ($10.100.1.0/24$) hosting an Azure Route Server.
* `subnet-nva` ($10.100.2.0/24$) hosting a pair of SD-WAN Network Virtual Appliances (NVAs) that establish BGP sessions with the Azure Route Server.
* A spoke virtual network named `vnet-prod-spoke` ($10.101.0.0/16$) containing application workloads in `subnet-app` ($10.101.1.0/24$).

A virtual network peering connects `vnet-use-hub` and `vnet-prod-spoke` with gateway transit enabled on the hub side.

The design must satisfy these requirements:
* Application workloads in `subnet-app` must dynamically learn and route traffic to on-premises branch offices via the SD-WAN NVAs.
* You must minimize manual administrative effort by avoiding static user-defined routes (UDRs) in the spoke virtual network.
* Direct traffic between `vnet-prod-spoke` and the hub VNet `vnet-use-hub` must be maintained without routing through the SD-WAN NVAs to ensure optimal latency.
* The Azure Route Server must exchange routing information between the SD-WAN NVAs and the ExpressRoute gateway.

Which two actions should you include in the design?

An organization hosts a multi-tier application on Azure Virtual Machines. The application VMs must upload diagnostic metrics to Azure Monitor. To comply with security policies, all outbound internet traffic from the virtual machine subnet must be blocked except for traffic destined for Azure Monitor. The design must minimize administrative overhead. Which network configuration should you recommend?

An enterprise is designing a hub-and-spoke virtual network topology in Azure to host a multi-tier application. The architecture includes:
- A hub virtual network named `vnet-hub-core` ($10.50.0.0/16$) that hosts a central Azure Firewall with a private IP address of $10.50.4.4$.
- A spoke virtual network named `vnet-spoke-web` ($10.60.0.0/16$) containing a subnet named `web-subnet` ($10.60.1.0/24$).
- A spoke virtual network named `vnet-spoke-db` ($10.70.0.0/16$) containing a subnet named `db-subnet` ($10.70.1.0/24$).

Virtual network peering is configured between the hub and each spoke virtual network. Direct virtual network peering is not configured between the two spoke virtual networks.

You need to configure the routing to meet the following requirements:
- All traffic between `web-subnet` and `db-subnet` must be routed through the Azure Firewall for inspection.
- Traffic within each spoke virtual network must remain local and bypass the Azure Firewall.

Which two configurations should you implement?

An enterprise is designing a high-availability hybrid network topology in Azure to support dynamic routing and traffic inspection. The design includes the following components:

* A hub virtual network named `vnet-hub-useast` ($10.10.0.0/16$) containing an Azure Route Server in the `RouteServerSubnet` ($10.10.1.0/24$) and two active-active Network Virtual Appliances (NVAs) in `subnet-nva` ($10.10.2.0/24$).
* A spoke virtual network named `vnet-spoke-prod` ($10.20.0.0/16$) containing `subnet-web` ($10.20.1.0/24$).
* A spoke virtual network named `vnet-spoke-data` ($10.30.0.0/16$) containing `subnet-db` ($10.30.1.0/24$).

The NVAs establish BGP sessions with the Azure Route Server. The Route Server is configured with Branch-to-Branch enabled to exchange routes between the NVAs and an ExpressRoute Gateway in the hub.

You need to design a routing solution that meets the following requirements:
1. Subnets in `vnet-spoke-prod` and `vnet-spoke-data` must dynamically receive the on-premises routes advertised by the NVAs via BGP.
2. All spoke-to-spoke traffic (between `vnet-spoke-prod` and `vnet-spoke-data`) must be directed through the NVAs for security inspection.
3. Local traffic within `vnet-spoke-prod` (destined within $10.20.0.0/16$) must not be sent to the NVAs.

Which two configurations should you include in the design? (Select two.)

An organization is designing a secure architecture for a cloud application. The application database layer runs on an Azure SQL Database. The application logic runs on Azure Virtual Machines (VMs) deployed in a subnet named AppSubnet within an Azure Virtual Network.

The network security requirements are:
1. Prevent all public internet access to the Azure SQL Database.
2. Allow VMs in AppSubnet to connect securely to the Azure SQL Database.
3. Restrict outbound database traffic from AppSubnet to only the required SQL database.
4. Minimize administrative effort for managing changes to IP addresses.

Which two configurations should you recommend in the design?

An automotive manufacturing corporation is designing a container-based telemetry and diagnostics platform on Azure. The platform will be deployed across two European regions. The design must meet the following requirements:
- A set of internal REST APIs must process incoming vehicle diagnostics data.
- A background analytics engine must process messages from an Azure Service Bus queue and scale to zero when no messages are present.
- A third-party security agent must run as a privileged DaemonSet on every container host node to inspect kernel-level system calls.
- Telemetry and logs collected from the workloads in each region must be isolated and stored only within that specific region to meet strict local data residency compliance.

You need to recommend the container hosting and monitoring architecture.

Which solution should you recommend?

A manufacturing company is designing a container-based quality control system on Azure. The system will run image classification models on images uploaded by factory cameras. The workloads have the following requirements:
- Scale up rapidly in response to a sudden influx of images uploaded to an Azure Blob Storage container.
- Scale down to zero when there are no images to process to minimize idle compute costs.
- Support event-driven scaling using KEDA without requiring the team to manage Kubernetes APIs, node pools, or cluster upgrades.

Which compute solution should you recommend?

An organization is designing a serverless backend for an enterprise batch import system. The system must process files uploaded to an Azure Blob Storage container. The architectural design must satisfy the following technical constraints:

- Execution Time: The file processing logic is single-threaded and can take up to 15 minutes to complete for large payloads.
- Network Isolation: The compute resource must securely access an Azure SQL Database and storage accounts via private endpoints within an Azure Virtual Network (VNet).
- Cost Efficiency: The compute resource must automatically scale down to zero instances when there are no files to process, ensuring zero billing during idle periods.
- Operational Overhead: Minimize administrative overhead by avoiding the need to configure, build, or deploy custom Docker container images or manage container registries.

Which Azure compute hosting option should you recommend to meet these requirements?

Your company has an on-premises datacenter connected to an Azure Virtual Network (VNet) via a site-to-site VPN. You are designing a secure private access solution for a business-critical application running on virtual machines in the VNet. The application needs to connect to an Azure SQL Database. You must meet the following requirements:
- The Azure SQL Database must not accept connections from the public internet.
- The virtual machines must access the database using private IP addresses.
- On-premises database administrators must be able to manage the database using private IP addresses.
- On-premises DNS servers must resolve the database FQDN to its private IP address.
- Administrative overhead for security rule maintenance and DNS routing must be minimized.

Which network security design should you recommend?

Your company has an Azure environment with a hub virtual network named `vnet-hub-prod` ($10.10.0.0/16$) that contains a Virtual Network Gateway, and a spoke virtual network named `vnet-spoke-app` ($10.20.0.0/16$). You configure Virtual Network Peering between `vnet-hub-prod` and `vnet-spoke-app`. You need to ensure that virtual machines in `vnet-spoke-app` can access your on-premises network through the gateway in `vnet-hub-prod`. Which two configuration settings should you select? (Select two.)