Design Infrastructure Solutions

An enterprise is designing a hub-and-spoke virtual network topology in Azure. The hub virtual network, `vnet-hub-weur` ($10.200.0.0/16$), contains a Virtual Network Gateway connected to an on-premises network. A spoke virtual network, `vnet-spoke-prod` ($10.201.0.0/16$), contains a workload subnet named `snet-app` ($10.201.1.0/24$). A pair of network virtual appliances (NVAs) is deployed in the hub and sits behind an internal load balancer at $10.200.4.100$.

The Virtual Network Gateway receives BGP route advertisements from on-premises, including a summary route of $172.16.0.0/12$ and a specific database subnet prefix of $172.16.50.0/24$. To inspect all on-premises bound traffic, you associate a route table named `rt-spoke-app` with the `snet-app` subnet and add a user-defined route (UDR) for $172.16.0.0/12$ pointing to the load balancer at $10.200.4.100$. Gateway route propagation is enabled on `rt-spoke-app`.

During testing, you observe that traffic from `snet-app` to the database tier ($172.16.50.10$) bypasses the NVAs and goes directly to the Virtual Network Gateway. Which action should you recommend to ensure all on-premises bound traffic is inspected by the NVAs?

A meteorological modeling company is designing the Azure compute virtualization infrastructure for two distinct workloads:

* Workload 1: A weather simulation model that runs daily. The model requires Message Passing Interface (MPI) support with sub-millisecond node-to-node latency, high CPU performance, and cannot tolerate interruptions during its four-hour execution window.
* Workload 2: A public-facing web API providing real-time weather alerts that requires a minimum availability SLA of 99.99% and must scale automatically to handle sudden traffic spikes.

Which two virtual machine configurations should you recommend to meet the requirements? (Select two.)

An enterprise is designing the network routing topology for an Azure environment. The topology includes the following components:
- A hub virtual network named `vnet-hub-cus` ($10.100.0.0/16$) containing an Azure Firewall with the private IP address $10.100.2.4$ and an ExpressRoute virtual network gateway.
- A production spoke virtual network named `vnet-prod-spoke` ($10.110.0.0/16$) with a subnet named `snet-prod-app` ($10.110.1.0/24$).
- A shared services spoke virtual network named `vnet-shared-spoke` ($10.120.0.0/16$) with a subnet named `snet-shared-db` ($10.120.1.0/24$).

The virtual networks `vnet-prod-spoke` and `vnet-shared-spoke` are peered directly with `vnet-hub-cus` but are not peered with each other.

The design must meet the following requirements:
- All traffic between `snet-prod-app` and `snet-shared-db` must be routed through the Azure Firewall for inspection.
- Virtual machines in `snet-prod-app` must be able to communicate with the on-premises network ($172.16.0.0/12$) via the ExpressRoute gateway.
- Traffic between virtual machines within the same subnet (`snet-prod-app`) must remain local and bypass the Azure Firewall.

Which TWO configurations should you implement to meet these requirements?

An organization is planning to migrate their on-premises VMware vSphere virtual machines (VMs) to Azure using Azure Migrate. Before scheduling the migration, they want to analyze the network connections and dependencies between their servers to ensure no critical connections are broken. Which two methods can they use to perform dependency analysis in Azure Migrate? (Choose two.)

An enterprise is designing the network security for a two-tier application in Azure. The design includes:

* A virtual network named VNet1 containing two subnets: WebSubnet and DataSubnet.
* WebSubnet hosts web server virtual machines (VMs) that do not have public IP addresses.
* DataSubnet hosts a Private Endpoint for an Azure SQL Database named sql-db1.
* WebSubnet is associated with a Network Security Group (NSG) named NSG-Web.
* DataSubnet is associated with an NSG named NSG-Data.

The design must meet the following requirements:
* The web servers must connect to sql-db1 securely over its private IP address.
* All outbound traffic from WebSubnet to the internet must be blocked.
* Outbound traffic from WebSubnet must be restricted so that the web servers can only communicate with the Private Endpoint of sql-db1 and no other resources in VNet1.
* The design must minimize administrative effort by avoiding the use of individual, hardcoded IP addresses in NSG rules.

Which two configurations should you include in the design? (Choose two.)

An enterprise is designing a hub-and-spoke network topology in Azure to host a secure multi-tier application. The architecture consists of:

* A hub virtual network named `vnet-hub-core` ($10.100.0.0/16$) that hosts a central firewall Network Virtual Appliance (NVA) at IP address $10.100.2.4$.
* A spoke virtual network named `vnet-prod-spoke` ($10.150.0.0/16$) that contains two subnets: `snet-web` ($10.150.1.0/24$) and `snet-db` ($10.150.2.0/24$).
* Virtual network peering established between `vnet-hub-core` and `vnet-prod-spoke` with gateway transit and remote gateway options enabled.

A route table named `rt-web-tier` is associated with `snet-web` and contains a user-defined route (UDR) for $10.150.2.0/24$ with a next hop pointing to the NVA ($10.100.2.4$) to inspect all database-bound traffic. However, when web servers in `snet-web` attempt to establish database connections to VMs in `snet-db`, the connections time out. The database servers are verified as active, and Network Security Groups (NSGs) allow the traffic.

Which of the following routing configurations is the most appropriate solution to resolve the connectivity issue?

Your company is assessing the migration of an on-premises Microsoft SQL Server database to Azure. The database relies on cross-database queries and SQL Server Agent jobs to perform nightly transactional processing. Which Azure SQL deployment option should you select to support these features with minimal modification to the database or application code?

An enterprise is designing a hub-and-spoke virtual network topology in Azure to support a multi-tier application. The topology consists of the following components:
- A hub virtual network named `vnet-hub-eus` ($10.100.0.0/16$) that contains an Azure Firewall at IP address `10.100.1.4` and a Virtual Network Gateway connected to an on-premises environment via ExpressRoute.
- A spoke virtual network named `vnet-prod-spoke` ($10.101.0.0/16$) containing a subnet named `snet-web` ($10.101.1.0/24$).
- A virtual network peering connection between `vnet-hub-eus` and `vnet-prod-spoke` with gateway transit configured to allow the spoke to use the hub's gateway.

The on-premises network advertises specific subnets including `192.168.10.0/24` and `192.168.20.0/24` via BGP. You associate a new route table named `rt-prod-web` with the `snet-web` subnet.

You need to design a routing solution that meets the following requirements:
- All traffic from `snet-web` to the internet and to the on-premises subnets must be routed through the Azure Firewall.
- All traffic within the `vnet-prod-spoke` virtual network must route directly between resources and must not go through the Azure Firewall.
- The solution must minimize administrative overhead and avoid configuring individual routes for each on-premises subnet.

Which two actions should you perform to meet the requirements?

A financial services firm is modernizing its payment processing platform by migrating key workloads to Azure. The architecture team is designing a load balancing and traffic delivery solution that must meet the following requirements:

* External client transactions over HTTPS must be routed globally to regional endpoints using path-based rules (e.g., routing `/process` and `/refund` requests to dedicated backend services) with SSL/TLS termination performed at the edge.
* The internal backend database tier, which communicates over TCP port $1433$, must be load-balanced regionally across virtual machines in a virtual network.
* The database virtual machines currently have legacy Basic SKU Public IP addresses assigned for administrative access.
* The solution must support high-availability configurations for all load balancers without validation or deployment failures.

Which architecture configuration should you recommend to meet these requirements?

An organization is designing a secure hybrid network environment in Azure. A subnet named Subnet-App in VNet1 hosts virtual machines that must connect to the following resources:
- An Azure Key Vault named vault1 via a Private Endpoint deployed in Subnet-PE (IP range 10.0.2.0/24) in VNet1.
- An Azure Storage account named storage1 via a Private Endpoint deployed in Subnet-PE.
- Microsoft Entra ID for authentication.
- A public partner API (api.partner.com).

The design must satisfy the following requirements:
- Minimize administrative effort when Azure public IP addresses change.
- Route all public internet traffic (including api.partner.com) through an Azure Firewall in a peered hub virtual network.
- Restrict outbound traffic from Subnet-App using a Network Security Group (NSG) to block all outbound traffic by default, except for the minimum necessary traffic required to meet the connectivity requirements.

Which configuration should you recommend for the route table and NSG outbound rules on Subnet-App?

An enterprise is designing a hybrid network architecture to connect an on-premises datacenter to an Azure virtual network named `VNet1` using an ExpressRoute connection. A subnet in `VNet1` named `Subnet1` hosts virtual machines that must access an Azure SQL Database.

The design must meet the following requirements:
- The Azure SQL Database must not expose a public endpoint and must be accessible only via a private IP address within `VNet1`.
- On-premises applications must be able to resolve the database's fully qualified domain name (FQDN) to its private IP address.
- Outbound traffic from `Subnet1` to the database must be restricted at the network layer using Network Security Groups (NSGs).
- Administrative effort for managing DNS routing and network security rules must be minimized.

Which design should you recommend?

A healthcare provider is deploying a multi-tier clinical application across two Azure regions: East US 2 and West US 2.

The architecture team specifies the following technical requirements for the application:
1. Global Traffic Ingress: Client traffic must be dynamically routed to the closest healthy region based on latency. The ingress layer must support SSL/TLS termination, URL path-based routing (routing `/api/*` traffic to API clusters and `/static/*` traffic to static assets), and Web Application Firewall (WAF) protection at the network edge.
2. Regional Backend Load Balancing: In each region, internal services communicating over TCP port 5005 must be load balanced across a backend pool of virtual machines. The load balancer must support High Availability (HA) ports.
3. Administrative Access: During a temporary transition phase, the backend virtual machines must maintain their existing direct administrative access using Basic SKU public IP addresses attached to their network interfaces.

You need to design a load balancing and delivery solution that satisfies all of the application's requirements while ensuring the deployment passes Azure validation.

Which two of the following components or configurations should you include in the design?

An enterprise has a hub-and-spoke network topology in Azure to support a multi-tier application. The topology contains the following configurations:

* Hub VNet (`vnet-hub-weur`): Address space $10.100.0.0/16$. It contains an Azure Route Server and a Network Virtual Appliance (`nva-core` at $10.100.1.4$) that dynamically advertises the prefix $192.168.10.0/24$ via BGP.
* Spoke VNet (`vnet-prod-spoke`): Address space $10.101.0.0/16$. It contains a subnet named `subnet-prod` ($10.101.1.0/24$). The spoke VNet is peered with the hub VNet with gateway transit enabled so that it receives the routes propagated by the Route Server.
* **Security Scanner (`nva-scan` at $10.100.2.4$)**: Deployed in the hub VNet for inspecting traffic destined to specific security zones.

You need to design a routing solution for resources in `subnet-prod` to ensure that all traffic destined for the $192.168.10.0/24$ network is routed through the security scanner (`nva-scan`) instead of the core NVA (`nva-core`).

Which of the following configurations should you recommend?

An organization is designing the network security for an Azure environment. A subnet named Subnet1 in a virtual network named VNet1 hosts virtual machines that run batch processing jobs. The virtual machines must access Azure Key Vault and Azure SQL Database instances over their public endpoints. You need to configure a Network Security Group (NSG) associated with Subnet1 to restrict outbound traffic so that the virtual machines can access only these specific Azure services and are blocked from all other public internet destinations. The solution must minimize administrative overhead. Which two actions should you recommend?

A logistics corporation is migrating a core ERP and dispatch system to Azure. The system has two distinct components:
1. An HTTP/HTTPS web application that requires cookie-based session affinity, SSL/TLS termination at the load balancer, and routing traffic to different backend pools based on the URL path.
2. A high-throughput database replication service that communicates over a custom TCP port 1445 and requires regional high availability.

All backend virtual machines (VMs) for both components are deployed within a single virtual network in the North Europe region. The VMs are currently associated with Basic SKU Public IP addresses. The entire load balancing architecture must support availability zones for zone redundancy and must not trigger deployment validation failures.

Which configuration should you recommend to meet these requirements?

A company is designing a secure hub-and-spoke network topology in Azure. The hub virtual network contains an Azure Firewall with the private IP address $10.1.1.4$. The spoke virtual network uses the address space $10.2.0.0/16$ and contains two subnets: `Prod-App-Subnet` ($10.2.1.0/24$) hosting application virtual machines associated with the Application Security Group (ASG) `AppVM-ASG`, and `Prod-Db-Subnet` ($10.2.2.0/24$) hosting a private endpoint for an Azure SQL Database with the private IP address $10.2.2.5$.

The network security design must satisfy the following technical requirements:
1. All traffic from `Prod-App-Subnet` to the Azure SQL Database private endpoint must be routed through and inspected by the Azure Firewall.
2. The Network Security Group (NSG) associated with `Prod-App-Subnet` must allow outbound database traffic to the private endpoint while blocking all other outbound traffic to the public internet.
3. Administrative overhead for managing network rules and IP changes must be minimized.
4. Network security policies must be enforced on `Prod-Db-Subnet`.

Which configuration should you recommend to meet these requirements?

A multinational finance company is designing a secure hybrid networking architecture in Azure. The architecture must connect their on-premises datacenter to an Azure virtual network ($VNet1$) via an ExpressRoute circuit. The company is deploying an Azure SQL Database named $FinanceDB1$ and wants to ensure that:

- VMs in $VNet1$ and on-premises database client tools can access $FinanceDB1$ privately.
- VMs in $VNet1$ are strictly blocked from accessing any other Azure SQL Database instances in any region (preventing database data exfiltration).
- The on-premises clients must resolve the private endpoint of $FinanceDB1$ using their existing local DNS servers.
- Administrative overhead and maintenance of custom DNS forwarder virtual machines must be minimized.

Which two configurations should you include in the design?

An enterprise has a hub-and-spoke virtual network topology in the West US 2 region. The hub virtual network, `vnet-usw2-hub` ($10.200.0.0/16$), contains an Azure Route Server and a pair of active-active network virtual appliances (NVAs) in the subnet `snet-usw2-nva` ($10.200.1.0/24$). The NVAs use BGP to peer with the Azure Route Server. The spoke virtual network, `vnet-usw2-spoke` ($10.201.0.0/16$), contains a subnet named `snet-usw2-app` ($10.201.1.0/24$) and is peered with `vnet-usw2-hub` with gateway transit enabled.

Initially, the NVAs advertise the on-premises range $172.16.0.0/12$ via BGP. To force all on-premises traffic from `snet-usw2-app` through the NVAs, a route table is associated with `snet-usw2-app` containing a user-defined route (UDR) for $172.16.0.0/12$ with the next hop set to the NVAs' internal load balancer IP address ($10.200.1.100$).

A new branch office is added on-premises, and the Virtual Network Gateway in `vnet-usw2-hub` dynamically learns the specific subnet route $172.20.100.0/24$ via ExpressRoute BGP propagation. Azure Route Server propagates this route to `vnet-usw2-spoke`. Security audits show that traffic from `snet-usw2-app` destined for the new branch ($172.20.100.0/24$) is bypassing the NVAs.

You need to ensure that traffic from `snet-usw2-app` to the new branch office is inspected by the NVAs.

What should you do?

Your company, Aetheris Manufacturing, is designing a secure network architecture in Azure. The architecture consists of a Hub virtual network (VNet) and a Spoke VNet peered together. Subnet-App ($10.20.1.0/24$) in the Spoke VNet hosts virtual machines running a production application. Subnet-PrivateLink ($10.20.2.0/24$) in the Spoke VNet contains Private Endpoints for an Azure SQL Database (sqldb-prod.database.windows.net) and an Azure Key Vault (kv-prod.vault.azure.net). Public network access is disabled on both the SQL Database and the Key Vault. You must block all outbound traffic from Subnet-App to the public internet and ensure that the virtual machines can only communicate with the specific SQL Database and Key Vault instances. The solution must minimize administrative overhead. Which network security configuration should you recommend for Subnet-App?

A logistics company is designing the Azure compute virtualization infrastructure for its operations platform. The platform consists of two workloads:

* Workload A: A fleet telemetry ingestion service that runs continuously, requires a $99.99\%$ availability SLA, and cannot tolerate unexpected interruptions or evictions.
* Workload B: A monthly inventory forecasting simulation that can run asynchronously, can be paused and resumed, and must minimize costs as much as possible.

Which two compute configurations should you recommend to meet these requirements? (Select two.)