Official Exam Details: (AZ-305)

Exam Code:
AZ-305

Passing Score:
70%

Total Question Bank:
292 Verified Questions

Exam Duration:
120 Minutes

Exam Format & Question Types

This certification exam features multiple-choice questions (single and multi-select), interactive Hotspots, Hot Areas, and Drag-and-Drop scenario configurations designed to test real-world technical competency.

AZ-305: Designing Microsoft Azure Infrastructure Solutions – Master Study Guide

Welcome, aspiring Azure Solution Architect! This comprehensive study guide and architectural blueprint is meticulously crafted to prepare you for the AZ-305 certification exam. As an expert cloud architect and exam author, I’ve distilled the core knowledge, architectural principles, and critical decision-making skills you’ll need to master this challenging exam and excel in designing robust, scalable, and secure Azure solutions.

Exam Overview & Profile

The AZ-305 exam targets experienced Azure Solution Architects who translate business requirements into secure, scalable, and reliable solutions. It validates your ability to design identity, governance, compute, network, storage, data, business continuity, and monitoring solutions on Azure. Expect approximately 40-60 questions, including multiple-choice, multi-select, drag-and-drop, and case studies, to be completed within a 120-minute timeframe (plus additional time for instructions). A passing score of 700 out of 1000 is required, emphasizing a deep, practical understanding of Azure’s architectural best practices.

Deep-Dive Domain Breakdown

1. Design Identity, Governance, and Monitoring Solutions (25-30%)

Identity: Master Azure Active Directory (Azure AD) design, including hybrid identity (Azure AD Connect), B2B/B2C, Conditional Access, MFA, Managed Identities, and Service Principals for secure application access.
Governance: Architect robust governance using Azure Policy, Blueprints, Management Groups, RBAC, and Resource Locks. Understand Cost Management strategies and Subscription Segmentation.
Monitoring: Design end-to-end monitoring with Azure Monitor (Log Analytics, Application Insights, Alerts, Metrics), Azure Security Center (now Defender for Cloud), and Network Watcher.

2. Design Data Storage Solutions (25-30%)

Storage Accounts: Architect Azure Storage Accounts (Blob, File, Queue, Table) with appropriate redundancy (LRS, GRS, ZRS, RA-GRS), access tiers (Hot, Cool, Archive), and security.
Databases: Select the correct database service: Azure SQL Database, SQL Managed Instance, Azure Database for MySQL/PostgreSQL, Azure Cosmos DB (various APIs), and Azure Synapse Analytics for analytical workloads. Consider data consistency models and partitioning strategies.
Data Lakes: Understand Azure Data Lake Storage Gen2 for big data analytics.

3. Design Business Continuity Solutions (10-15%)

High Availability (HA): Design for HA using Availability Zones, Availability Sets, cross-region replication, and load balancing services.
Disaster Recovery (DR): Implement DR strategies with Azure Site Recovery (ASR), Azure Backup, and database replication techniques. Define RTO/RPO targets and design solutions to meet them.

4. Design Infrastructure Solutions (25-30%)

Compute: Evaluate and design solutions using Azure Virtual Machines, VM Scale Sets, Azure App Service, Azure Functions, Azure Container Instances (ACI), and Azure Kubernetes Service (AKS). Understand when to choose PaaS vs. IaaS vs. Serverless.
Networking: Architect complex network topologies using VNets, Subnets, NSGs, ASGs, Azure Firewall, Azure DDoS Protection, VPN Gateway, ExpressRoute, Virtual WAN, Private Link, Azure Load Balancer, Application Gateway, Azure Front Door, and Traffic Manager. Focus on hybrid connectivity and secure network segmentation.

High-Yield Exam Tips & Scenario Traps

PaaS First: In scenarios, default to PaaS solutions over IaaS to minimize operational overhead, unless specific OS-level control or legacy application requirements dictate IaaS.
Cost Optimization: Always factor in cost-effectiveness. Solutions should meet requirements while optimizing expenditure (e.g., choosing correct storage tiers, reserved instances).
Security Layers: Understand the layered security model. NSGs provide basic network filtering; Azure Firewall, Application Gateway WAF, and DDoS Protection offer advanced perimeter and application-level protection.
Hybrid Connectivity: Differentiate between VPN Gateway (cost-effective, site-to-site) and ExpressRoute (private, high-bandwidth, low-latency) based on requirements for bandwidth, latency, and SLA.
RTO/RPO Trap: Pay close attention to specified Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) in DR scenarios; these directly influence service selection (e.g., ASR vs. simple backup).
Storage Redundancy: Match storage redundancy options (LRS, ZRS, GRS, RA-GRS) to HA/DR requirements and data durability needs.
Identity Management: Leverage Managed Identities for secure, passwordless authentication between Azure services to enhance security and simplify credential management.

Frequently Asked Questions (FAQ)

Q1: How should I structure my study plan for AZ-305?
A1: Begin by thoroughly reviewing the official Microsoft Learn path for AZ-305, focusing on the architectural implications of each service. Follow up with hands-on labs in the Azure portal to solidify conceptual understanding into practical experience. Finally, use high-quality practice exams to identify knowledge gaps and simulate exam conditions.

Q2: What is the best way to approach case study questions on the exam?
A2: For case studies, first, read the entire scenario carefully to understand the business context, existing environment, and key constraints (e.g., budget, performance, compliance, security, RTO/RPO). Next, identify explicit and implicit requirements. Then, evaluate each potential solution against all stated criteria, looking for trade-offs and ensuring the proposed architecture is comprehensive and holistic.

Q3: Is hands-on experience truly necessary for AZ-305?
A3: Absolutely. While theoretical knowledge is foundational, the AZ-305 exam heavily tests your ability to make architectural decisions. Hands-on experience helps you understand service capabilities, limitations, and how different components integrate, which is crucial for answering scenario-based questions effectively. Build and deploy various solutions in a sandbox environment.

Free AZ-305 Sample Practice Questions

Test your knowledge with these sample scenario questions complete with verified explanations:

General Practice Questions

QUESTION 1 [HOT_AREA]

Your on-premises network contains an Active Directory Domain Services (AD DS) forest. The forest contains servers that run Windows Server. The servers contain file shares that replicate by using Distributed File System (DFS) Replication.

You have multiple remote Windows 11 devices that connect to the on-premises network by using Point-to-Site (P2S) VPN and access the file shares by using drive mappings.

You have an Azure subscription. The subscription contains virtual machines that run Windows Server and are configured as domain controllers. The virtual machines replicate to the on-premises forest. The forest syncs with a Microsoft Entra tenant that is linked to the Azure subscription.

You plan to migrate the on-premises file shares to the Azure virtual machines.

You need to recommend a solution for replicating the file shares to Azure and providing the Windows 11 devices with access to the shares. The solution must ensure that the devices can access the shares by using mapped drive letters via TCP port 445.

What should you use to replicate the shares, and what should the devices use to the access the shares? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

For Access:

REST / HTTPS: These are web protocols. While you can access data over them, Windows 11 devices cannot natively use them to create standard mapped drive letters for file shares without clunky legacy workarounds (like WebDAV).

SMB over QUIC: Even though it violates the text’s “TCP 445” rule, it is the only option in the dropdown that natively supports mapping a drive letter securely over the internet.

For Replicate:

Azure Data Share: Used for sharing data securely with external organizations, not for syncing local file servers to Azure VMs.

Azure NetApp Files: A highly performant, fully managed bare-metal file storage service. You cannot use it to replicate data into a Windows Server VM’s local storage.

Azure File Sync: The exact Microsoft service designed to sync on-premises Windows Server file shares to Azure.

Case Study: Litware

Instructions

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs When you are ready to answer a question, click the Question button to return to the question.

Existing Environment Azure Environment

Litware has 10 Azure subscriptions that are linked to the Litware.com tenant and five Azure subscriptions that are linked to the dev.litware.com tenant. All the subscriptions are in an Enterprise Agreement (EA).

The litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the Data Actions read permission to the blobs and files in Azure Storage.

On-Premises Environment

The on-premises network of Litware contains the resources shown in the following table.

Network Environment

Litware has ExpressRoute connectivity to Azure.

Planned Changesand Requirements

Litware plans to implement the following changes:

Migrate DB1 and DB2 to Azure.

Migrate App1 to Azure virtual machines.

Migrate the external storage used by App1 to Azure Storage.

Deploy the Azure virtual machines that will host App1 to Azure dedicated hosts.

Authentication and Authorization Requirements

Litware identifies the following authentication and authorization requirements:

Only users that manage the production environment by using the Azure portal must connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-Factor Authentication (MFA).

The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions.

To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app. RBAC roles must be applied at the highest level possible.

Resiliency Requirements

Litware identifies the following resiliency requirements:

Once migrated to Azure, DB1 and DB2 must meet the following requirements:

Maintain availability if two availability zones in the local Azure region fail.
Fail over automatically.
Minimize I/O latency.

App1 must meet the following requirements:

Be hosted in an Azure region that supports availability zones.
Be hosted on Azure virtual machines that support automatic scaling.
Maintain availability if two availability zones in the local Azure region fail.

Security and Compliance Requirements

Litware identifies the following security and compliance requirements:

Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

On-premises users and services must be able to access the Azure Storage account that will host the data in App1. Access to the public endpoint of the Azure Storage account that will host the App1 data must be prevented.

All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled. App1 must NOT share physical hardware with other workloads.

Business Requirements

Litware identifies the following business requirements:

Minimize administrative effort. Minimize costs.

QUESTION 2

Scenario: Litware

After you migrate App1 to Azure, you need to enforce the data modification requirements to meet the security and compliance requirements. What should you do?

A. Create an access policy for the blob service.
B. Implement Azure resource locks.
C. Create Azure RBAC assignments.
D. Modify the access level of the blob service.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The requirement is to prevent modification of data for three years while allowing new data to be written. Azure Storage Blob immutability policies, specifically the WORM (Write Once, Read Many) model, can be configured to meet this. By setting a retention period, data can be protected from deletion or modification for a specified duration. Append blobs are suitable for writing new data, while setting an immutability policy on the container or blob will prevent modifications to existing data for the required period.

Reference: https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

QUESTION 3 [HOT_AREA]

Scenario: Litware

You plan to migrate DB1 and DB2 to Azure.

You need to ensure that the Azure database and the service tier meet the resiliency and business requirements. What should you configure? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

The requirements for migrating DB1 and DB2 include maintaining availability if two availability zones in the local Azure region fail, automatic failover, and minimizing I/O latency, along with business requirements to minimize administrative effort and costs. The ‘An Azure SQL Database elastic pool’ option allows for hosting multiple databases (DB1 and DB2) and enables resource sharing, which helps in minimizing costs and administrative overhead compared to managing individual databases. The ‘Business Critical’ service tier perfectly addresses the resiliency and performance requirements. This tier provides built-in high availability with multiple replicas, which can be configured for zone redundancy to survive the failure of two availability zones. It also offers automatic failover with minimal data loss (RPO 0) and utilizes local SSD storage for data and log files, resulting in significantly minimized I/O latency. This combination ensures that all specified resiliency and business requirements are met effectively.

Reference: https://docs.microsoft.com/azure/azure-sql/database/service-tier-business-critical

QUESTION 4 [HOT_AREA]

Scenario: Litware

You need to ensure that users managing the production environment are registered for Azure MFA and must authenticate by using Azure MFA when they sign in to the Azure portal. The solution must meet the authentication and authorization requirements.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

To register the users for Azure MFA, use: Azure AD Identity Protection

Azure AD Identity Protection includes an MFA registration policy that can be configured to prompt users to register for Azure Multi-Factor Authentication (MFA) if they are not already registered. This is an effective way to ensure that users who need to manage the production environment are registered for MFA, providing a self-service and automated approach to MFA onboarding.

To enforce Azure MFA authentication, configure: Grant control in capolicy1

To enforce Azure MFA authentication, especially for specific user groups (users managing the production environment), when signing in to the Azure portal, and from specific device types (hybrid Azure AD-joined devices), Azure AD Conditional Access policies are the appropriate solution. Within a Conditional Access policy (referred to as ‘capolicy1’ in the option), ‘Grant controls’ are used to dictate what users must do to gain access. The specific ‘Grant control’ to enforce here would be ‘Require multi-factor authentication’ and ‘Require hybrid Azure AD joined device’. This directly addresses the requirement for both MFA and device state conditions for authentication and authorization.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/howto-mfa-policy; https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

QUESTION 5 [HOT_AREA]

Scenario: Litware

You plan to migrate App1 to Azure.

You need to recommend a high-availability solution for App1. The solution must meet the resiliency requirements. What should you include in the recommendation?

To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

The primary resiliency requirement for App1 is to ‘Maintain availability if two availability zones in the local Azure region fail’. This mandates distributing App1 across at least three availability zones (AZ1, AZ2, AZ3) to ensure that if any two zones become unavailable, the application remains operational in the third zone. Additionally, App1 must be deployed on ‘Azure dedicated hosts’ and ‘NOT share physical hardware with other workloads’, while also supporting ‘automatic scaling’.

Number of host groups: 3
To meet the dedicated host requirement and achieve 3-zone resiliency, you must deploy dedicated hosts into three separate availability zones. Azure Host Groups are tied to a specific availability zone. Therefore, creating three host groups, each configured for a distinct availability zone (one for AZ1, one for AZ2, and one for AZ3), is necessary. This ensures physical isolation across zones on dedicated hardware.
Number of virtual machine scale sets: 3
To support automatic scaling and distribute the application across three availability zones, while utilizing dedicated hosts, a valid solution is to deploy three separate Virtual Machine Scale Sets (VMSS). Each VMSS would be configured to deploy instances within a specific availability zone and target the dedicated host group associated with that zone (e.g., VMSS1 in AZ1 targeting Host Group 1, VMSS2 in AZ2 targeting Host Group 2, VMSS3 in AZ3 targeting Host Group 3). This design ensures that App1 is distributed across three zones, provides automatic scaling for instances within each zone, and runs on dedicated hardware, thus satisfying all the stated resiliency requirements. While a single VMSS can also span multiple zones, using three distinct VMSS for each zone is a valid architectural pattern that offers separate scaling domains and increased isolation, aligning with the robust resiliency needs.

Reference: https://learn.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts-overview#deploy-azure-dedicated-hosts-and-vms; https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-with-azure-dedicated-hosts

General Practice Questions

QUESTION 6 [DRAG_DROP]

You need to configure an Azure policy to ensure that the Azure SQL databases have TDE enabled. The solution must meet the security and compliance requirements.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question Interface:

✔ Correct Answer / Solution View:

Click to View Verified Solution & Explanation

Explanation:

The ground truth provides a technically correct sequence for configuring an Azure Policy to ensure Azure SQL databases have Transparent Data Encryption (TDE) enabled.

✅ Step 1: Create an Azure policy definition that uses the deployIfNotExists effect. matches with -> Target Zone Z1
Reasoning: To enforce a specific configuration like TDE, you first need to define a policy. The deployIfNotExists effect is suitable here because it allows you to check if TDE is enabled on Azure SQL databases and, if not, deploy an ARM template to enable it, thus enforcing the desired state. Alternatively, the Modify effect could also be used, but deployIfNotExists is a valid and commonly used approach for ensuring resource compliance by deploying missing configurations.

✅ Step 2: Create an Azure policy assignment. matches with -> Target Zone Z2
Reasoning: After defining the policy, it must be assigned to a specific scope (e.g., a management group, subscription, or resource group) to become active and start evaluating resources. Without an assignment, the policy definition has no effect.

✅ Step 3: Invoke a remediation task. matches with -> Target Zone Z3
Reasoning: Policy effects like deployIfNotExists (and Modify) apply to newly created or updated resources automatically. However, to bring existing non-compliant resources into compliance, a remediation task must be explicitly invoked. This task will evaluate all existing resources within the assigned scope and apply the policy’s defined actions (in this case, enabling TDE) to those that are not compliant.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-azure-sql

Case Study: Fabrikam, Inc.

Instructions

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All-Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment: Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There are no trust relationships between the forests. Corp.fabrikam.com is a production forest that contains identities used for internaluser and computer authentication.

Rd.fabrikam.com is used by the research and development (R&D)department only. The R&D department is restricted to using on-premises resources only.

Existing Environment: Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is used by customers to place and track orders. WebApp1 has a web tier that uses Microsoft Internet information Services (IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that run on Hyper-V.

The IT department currently uses a separateHyper-V environment to test updatesto WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software Assurance.

Existing Environment: Problem Statements

The use of WebApp1is unpredictable. At peak times, users often report delays. At other times, many resources for WebApp1 are underutilized.

Requirements: PlannedChanges

Fabrikam plans to move most of its production workloads to Azure during the next few years, including virtual machines that rely on Active Directory for authentication.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming Microsoft 365 deployment. All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Requirements: Technical Requirements

Fabrikam identifies the following technical requirements:

Website content must be easily updated from a single point.

User input must be minimized when provisioning new web app instances. Whenever possible, existing on-premises licenses must be used to reduce cost. Users must always authenticate by using their corp.fabrikam.com UPN identity. Any new deployments to Azure must be redundant in case an Azure region fails.

Whenever possible, solutions must be deployed to Azure by usingthe Standard pricing tier ofAzure App Service.

An email distribution group named IT Support must be notifiedof any issues relating to the directorysynchronization services.

In the event that a link fails between Azure and the on-premises network, ensure that the virtual machines hosted in Azure can authenticate to Active Directory. Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be affected by a link failure between Azure and the on- premises network.

Requirements: Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings.

To avoid disrupting customer access, database downtime must be minimized when databases are migrated. Database backups must be retained for a minimum of seven years to meet compliance requirements.

Requirements: Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the company. Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an internet link fails.

Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com credentials. All administrative access to the Azure portal must be secured by using multi-factor authentication (MFA). The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 7

Scenario: Fabrikam, Inc.

You need to recommend a solution to meet the database retention requirements. What should you recommend?

A. Configure a long-term retention policy for the database.
B. Configure Azure Site Recovery.
C. Use automatic Azure SQL Database backups.
D. Configure geo-replication of the database.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The requirement states that database backups must be retained for a minimum of seven years to meet compliance requirements. Azure SQL Database provides robust backup and restore capabilities, including long-term retention options. By configuring long-term retention for backups, Fabrikam can meet its seven-year compliance requirement for the production instance of WebApp1’s database. Azure SQL Database also offers features to minimize downtime during migration and provides database metrics for performance analysis, aligning with other database requirements.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/databases/long-term-backup-retention-configure?view=azuresql

Case Study: Contoso

Instructions

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Existing Environment

Technical Environment

The on-premises network contains a single Active Directory domain named contoso.com. Contoso has a single Azure subscription.

Business Partnerships

Contoso has a business partnership with Fabrikam, Inc. Fabrikam users access some Contoso applications over the internet by using Azure Active Directory (AzureAD) guest accounts.

Requirements

Planned Changes

Contoso plans to deploy two applications named App1 and App2 to Azure.

App1

App1 will be a Python web app hosted in Azure App Service that requires a Linux runtime. Users from Contoso and Fabrikam will access App1.

App1 will access several services that require third-party credentials and access strings. The credentials and access strings are stored in Azure Key Vault. App1 will have six instances: three in the East US Azure region and three in the West Europe Azure region.

App1 has the following data requirements:

Each instance will write data to a data store in the same availability zone as the instance.

Data written by any App1 instance must be visible to all App1instances.

App1 will only be accessible from the internet. App1 has the following connection requirements:

Connections to App1 must pass through a web application firewall (WAF).

Connections to App1 must be active-active load balanced between instances.

All connections to App1 from North America must be directed to the East US region. All other connections must be directed to the West Europe region.

Every hour, you will run a maintenance task by invoking a PowerShell script that copies files from all the App1 instances. The PowerShell script will run from a central location.

App2

App2 will be a NET app hosted in App Service that requires a Windows runtime. App2 has the following file storage requirements:

Save files to an Azure Storage account.

Replicate files to an on-premises location.

Ensure that on-premises client scan read the files over the LAN by using the SMB protocol.

You need to monitor App2 to analyze how long it takes to perform different transactions within the application. The solution must not require changes to the application code.

Application Development Requirements

Application developers will constantly develop new versions of App1 and App2. The development process must meet the following requirements:

A staging instance of a new application version must be deployed to the application host before the new version is used in production.

After testing the new version, the staging version of the application will replace the production version.

The switch to the new application version from staging to production must occur without any downtime of the application.

Identity Requirements

Contoso identifies the following requirements for managing Fabrikam access to resources:

Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

The solution must minimize development effort.

Security Requirement

All secrets used by Azure services must be stored in Azure Key Vault.

Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

QUESTION 8 [HOT_AREA]

Scenario: Contoso

What should you implement to meet the identity requirements? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

The identity requirements state that ‘Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.’ This directly points to the need for recurring access reviews for external users (Fabrikam guests). Azure AD Identity Governance is the overarching service that provides these capabilities. Specifically, the ‘Access reviews’ feature within Azure AD Identity Governance allows for periodic review of access to groups and applications, ensuring that only necessary access is maintained and minimizing development effort as it is a built-in feature.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

QUESTION 9

Scenario: Contoso

You need to recommend a solution for the App1 maintenance task. The solution must minimize costs.

What should you include in the recommendation?

A. an Azure function app
B. an App Service WebJob
C. an Azure logic app
D. an Azure virtual machine

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The question asks for a solution to minimize costs for the App1 maintenance task, which involves copying files from all App1 instances hourly. App1 is hosted in Azure App Service and has instances in both East US and West Europe regions. To minimize costs, the maintenance task should leverage Azure Functions or Azure Automation, which are serverless or pay-as-you-go services, rather than a dedicated virtual machine or a continuously running service. Azure Functions, triggered by a timer, can efficiently execute the PowerShell script without incurring the cost of an idle VM. Alternatively, Azure Automation could be used with its Hybrid Runbook Worker to run the script from a central location, potentially optimizing network egress costs if the central location is within Azure or has a direct connection.

Reference: https://learn.microsoft.com/en-us/azure/azure-functions/functions-trigger-types?tabs=python
https://learn.microsoft.com/en-us/azure/automation/automation-trigger-schedule

QUESTION 10

Scenario: Contoso

You need to recommend an App Service architecture that meets the requirements for App1. The solution must minimize costs.

What should you recommend?

A. one App Service Environment (ASE) per availability zone
B. one App Environment (ASE) per region
C. one App Service plan per region
D. one App Service plan per availability zone

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

The requirements for App1 include hosting a Python web app on Linux, accessible from the internet, requiring a web application firewall (WAF), active-active load balancing, and geo-aware routing (East US for North America, West Europe for others). It also needs to access Azure Key Vault and write data to a store where each instance writes to a data store in the same availability zone, but data must be visible to all instances. The requirement for minimizing costs points towards using Azure App Service with the appropriate pricing tier.

To meet these requirements:
– Azure App Service Linux Plan: Satisfies the Linux runtime requirement.
– Azure Application Gateway with WAF: Provides WAF capabilities and can handle the geo-aware routing by directing traffic to the appropriate App Service deployment based on source region.
– Active-Active Deployment across regions (East US, West Europe): Addresses the geo-distribution and active-active load balancing needs. Each region would have its own App Service instance(s).
– Azure Cosmos DB: Offers a globally distributed, multi-master database that can meet the requirement of data being visible to all instances and allowing writes from instances in their respective availability zones. It minimizes costs by allowing flexible consistency levels and scaling.
– Managed Identities with Azure Key Vault integration: Allows App1 to securely access secrets in Key Vault without hardcoding credentials, and ensures credentials are tied to the service instance and not shared.
– Azure Monitor: Can be used to monitor App2’s transaction times without code changes.

Option C, which likely describes a setup involving Azure App Service, Azure Cosmos DB for data, Azure Application Gateway for WAF and routing, and managed identities for Key Vault access, aligns best with all requirements, especially cost minimization due to the flexible nature of Cosmos DB and App Service scaling. The data requirement (each instance writes to a data store in the same availability zone, but data must be visible to all instances) strongly points to a globally distributed database like Cosmos DB.

Reference: https://docs.microsoft.com/en-us/azure/architecture/example-scenario/apps/global-web-app

QUESTION 11

Scenario: Contoso

You need to recommend a solution that meets the application development requirements.

What should you include in the recommendation?

A. Continuous Integration/Continuous Deployment (CI/CD) sources
B. deployment slots
C. the Azure App Configuration service
D. an Azure Container Registry instance

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The Application Development Requirements state that a staging instance must be deployed before production and that the switch must occur without downtime. Azure DevOps Pipelines and Azure App Service deployment slots fulfill these requirements. Deployment slots allow for staging new versions of an application without impacting the production environment. A ‘swap’ operation can then be performed to promote the staging slot to production with zero downtime. Azure DevOps Pipelines can automate this entire deployment and staging process.

Reference: https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots

QUESTION 12 [HOT_AREA]

Scenario: Contoso

You are evaluating whether to use Azure Traffic Manager and Azure Application Gateway to meet tip connection requirements for App1.

What is the minimum numbers of instances required for each service? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

To meet the specified connection requirements for App1, including global geographic routing and regional Web Application Firewall (WAF) capabilities across two regions, a specific configuration of Azure Traffic Manager and Azure Application Gateway is necessary. For Azure Traffic Manager, a single profile is sufficient. Azure Traffic Manager operates at the DNS level, providing global traffic distribution based on policies like geographic routing. The requirement to direct North American connections to the East US region and other connections to the West Europe region is a core capability of one Azure Traffic Manager profile. It acts as a single point of entry for global traffic management, directing users to the appropriate regional endpoint. Azure Traffic Manager itself is a managed service and does not have user-provisioned ‘instances’ in the traditional sense; you configure a single profile resource to manage global routing.

For Azure Application Gateway, two instances (i.e., two separate Application Gateway resources) are required. The key requirement is that "Connections to App1 must pass through a web application firewall (WAF)." Azure Application Gateway provides this WAF functionality at Layer 7. Since App1 has instances deployed in two distinct Azure regions (East US and West Europe), each region requires its own Application Gateway to provide WAF protection and regional load balancing for the App1 instances within that specific region. Therefore, one Application Gateway would be deployed in the East US region to protect and load balance the App1 instances there, and another Application Gateway would be deployed in the West Europe region for its respective App1 instances. While each Application Gateway resource typically requires a minimum of two scaling units for high availability (SLA), the question asks for the minimum number of instances required for each service, referring to the number of distinct Application Gateway resources needed to cover the regional deployments.

Reference: https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview
https://docs.microsoft.com/en-us/azure/application-gateway/overview

QUESTION 13

Scenario: Contoso

What should you recommend to meet the monitoring requirements for App2?

A. Container insights
B. Microsoft Sentinel
C. Azure Application Insights
D. VM insights

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

The requirement is to monitor App2 to analyze transaction times without changing application code. Azure Application Insights is an extensible Application Performance Management (APM) service that monitors application performance and detects anomalies. It can collect telemetry data from applications hosted in Azure, on-premises, or in other clouds. For .NET applications hosted in Azure App Service, Application Insights can be easily integrated with minimal configuration, often without requiring code changes, by enabling the Application Insights SDK or agent. This allows for detailed transaction analysis, performance monitoring, and dependency tracking.

Reference: https://docs.microsoft.com/en-us/azure/application-insights/app-insights-overview

General Practice Questions

QUESTION 14

You have an Azure subscription that contains a custom application named Application1. Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components. All users are licensed for the Microsoft 365 E5 plan.

You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1. The solution must meet the following requirements:

To the manager of the developers, send a monthly email message that lists the access permissions to Application1.
If the manager does not verify an access permission, automatically revoke that permission.
Minimize development effort.

What should you recommend?

A. In Azure Active Directory (Azure AD), create an access review of Application1.
B. Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
C. In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
D. Create an Azure Automation runbook that runs the

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

Azure AD Access Reviews directly address all stated requirements. They enable recurring reviews (e.g., monthly) of access to applications, automatically notifying designated reviewers (such as the developers’ manager) via email. Crucially, access reviews can be configured to automatically revoke permissions if the reviewer does not respond or denies access. This is a built-in identity governance feature requiring configuration rather than custom development, thereby minimizing development effort. The Microsoft 365 E5 plan includes Azure AD Premium P2, which provides the necessary licensing for this functionality.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/governance/create-access-review

QUESTION 15

You have an Azure subscription. The subscription has a blob container that contains multiple blobs.

Ten users in the finance department of your company plan to access the blobs during the month of April. You need to recommend a solution to enable access to the blobs during the month of April only.

Which security solution should you include in the recommendation?

A. shared access signatures (SAS)
B. Conditional Access policies
C. certificates
D. access keys

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

To grant access to blobs for a specific period (April) to a defined group of users, Shared Access Signatures (SAS) are the most appropriate solution. A SAS token provides delegated access to resources in Azure Storage without necessarily exposing the storage account key. You can configure a SAS token with specific permissions (e.g., read, write) and an expiry date and time. This perfectly aligns with the requirement to provide access only during April. Stored Access Policies are also an option, but SAS tokens offer a more direct and granular control for time-bound access for external users or applications, especially when the access is not continuous or managed long-term.

Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

QUESTION 16 (Multi-Select)

You have an Azure Active Directory (Azure AD) tenant that syncs with an on-premises Active Directory domain.

You have an internal web app named WebApp1 that is hosted on-premises. WebApp1 uses Integrated Windows authentication. Some users work remotely and do NOT have VPN access to the on-premises network.

You need to provide the remote users with single sign-on (SSO) access to WebApp1.

Which two features should you include in the solution? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A. Azure AD Application Proxy
B. Azure AD Privileged Identity Management (PIM)
C. Conditional Access policies
D. Azure Arc
E. Azure AD enterprise applications
F. Azure Application Gateway

Click to View Verified Solution & Explanation

Correct Option: A,E

Explanation:

To provide remote users without VPN access to single sign-on (SSO) for an on-premises web application (WebApp1) that uses Integrated Windows Authentication (IWA) and syncs with Azure AD, two key components are required: Azure AD Application Proxy and Azure AD Connect.

1. Azure AD Application Proxy: This service allows on-premises applications to be accessed securely over the internet. It publishes WebApp1 externally while handling authentication and authorization through Azure AD. It acts as a gateway, enabling remote users to access the application as if it were a cloud app, leveraging Azure AD for SSO.

2. Azure AD Connect: This tool synchronizes the on-premises Active Directory users and groups to Azure AD. For SSO to work seamlessly, the identity of the user accessing WebApp1 remotely must be synchronized to Azure AD. This allows Azure AD to authenticate the user and pass the identity to Application Proxy, which then uses IWA to authenticate the user to WebApp1.

While Passthrough authentication (Option B) or Password Hash Synchronization (Option C) might be used by Azure AD Connect for user authentication to Azure AD itself, they are not the direct features providing SSO to the application. Similarly, Seamless SSO (Option D) is a feature of Azure AD Connect that enhances SSO for domain-joined machines but doesn’t directly address the core requirement for remote users without VPN access publishing an on-premises app. Azure AD Domain Services (Option F) is for running domain services in Azure, not for publishing on-premises web apps.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-overview

QUESTION 17

You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20 guest users.

You need to recommend a solution for evaluating the membership of Group1. The solution must meet the following requirements:

The evaluation must be repeated automatically every three months.
Every member must be able to report whether they need to be in Group1.
Users who report that they do not need to be in Group1 must be removed from Group1 automatically.
Users who do not report whether they need to be in Group1 must be removed from Group1 automatically.

What should you include in the recommendation?

A. Implement Azure AD Identity Protection.
B. Change the Membership type of Group1 to Dynamic User.
C. Create an access review.
D. Implement Azure AD Privileged Identity Management (PIM).

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

✅ Option C (Correct)
Reasoning: The scenario requires an automated, recurring evaluation of group membership where members self-attest their need for access, and actions are automatically taken based on their responses or lack thereof. Azure AD access reviews are specifically designed for this purpose. They allow scheduling recurring reviews (e.g., every three months), enable members to self-review their access, and can be configured to automatically remove users who report they no longer need access or who fail to respond within the review period. This directly addresses all stated requirements.

❌ Why the other choices are incorrect:

Option A is incorrect: Azure AD Privileged Identity Management (PIM) focuses on managing, controlling, and monitoring access to important resources, primarily for privileged roles and just-in-time access, not for routine, recurring self-attestation of group membership by all members.
Option B is incorrect: Azure AD conditional access policies enforce access decisions based on specific conditions (e.g., location, device state, sign-in risk) at the time of access, but they do not facilitate periodic review of who should be in a group or automate removal based on user self-attestation or non-response.
Option D is incorrect: Azure AD dynamic groups automatically manage membership based on user attributes, but they do not involve a self-attestation process by members, nor do they automatically remove users based on their review decisions or lack of response to a periodic access review.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

QUESTION 18 [HOT_AREA]

You plan to deploy Azure Databricks to support a machine learning application. Data engineers will mount an Azure Data Lake Storage account to the Databricks file system. Permissions to folders are granted directly to the data engineers.

You need to recommend a design for the planned Databrick deployment. The solution must meet the following requirements:

Ensure that the data engineers can only access folders to which they have permissions.
Minimize development effort.
Minimize costs.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

✅ Premium

Reasoning: The Premium SKU for Azure Databricks is a prerequisite for utilizing advanced security features such as Credential Passthrough. While the question asks to minimize costs, the primary requirement to ensure data engineers can only access folders to which they have permissions, coupled with minimizing development effort, necessitates the use of Credential Passthrough. The Premium SKU enables this crucial security and operational efficiency feature, making it the appropriate choice to meet all stated requirements effectively.

✅ Credential passthrough

Reasoning: Credential passthrough ensures that the Azure Active Directory identity of the user running commands in Databricks is propagated directly to Azure Data Lake Storage (ADLS) Gen2. This allows for granular access control at the folder level within ADLS based on each data engineer’s existing permissions. This method directly addresses the requirement that data engineers can only access folders to which they have permissions, significantly minimizes development effort by leveraging existing ADLS ACLs, and is the most straightforward solution for user-level identity propagation for data access.

Reference: https://docs.microsoft.com/azure/databricks/security/credential-passthrough/adls-passthrough

QUESTION 19 [HOT_AREA]

You plan to deploy an Azure web app named App1 that will use Azure Active Directory (Azure AD) authentication.

App1 will be accessed from the internet by the users at your company. All the users have computers that run Windows 10 and are joined to Azure AD.

You need to recommend a solution to ensure that the users can connect to App1 without being prompted for authentication and can access App1 only from company-owned computers.

What should you recommend for each requirement? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

To fulfill the first requirement, where users can connect to App1 without being prompted for authentication, an An Azure AD app registration is the correct recommendation. An app registration integrates App1 with Azure Active Directory (Azure AD), allowing it to leverage Azure AD for identity management and single sign-on (SSO). When users access App1 from their Azure AD-joined Windows 10 computers, their existing Azure AD session enables seamless authentication without further prompts.

For the second requirement, ensuring users can access App1 only from company-owned computers, A Conditional Access policy is the appropriate solution. Azure AD Conditional Access policies allow administrators to define conditions under which users can access applications. By configuring a policy that targets App1 and requires the accessing device to be ‘Azure AD joined’ or ‘Hybrid Azure AD joined’ (representing company-owned computers), unauthorized access from unmanaged devices can be prevented.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app; https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

QUESTION 20

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is being deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues.

You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Traffic Analytics in Azure Network Watcher to analyze the network traffic.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The goal is to analyze network traffic to identify whether packets are being allowed or denied to virtual machines experiencing connectivity issues. Azure Traffic Analytics, integrated with Azure Network Watcher, collects and analyzes flow logs from Network Security Groups (NSGs) and Azure Firewall. It provides insights into traffic flow, helping to identify the source and destination of traffic, as well as whether it was allowed or denied. This directly addresses the need to diagnose packet-level connectivity problems, making it a suitable solution for this scenario.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-overview

QUESTION 21

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues.

You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Advisor to analyze the network traffic.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The proposed solution is incorrect. Azure Advisor is a recommendation engine that provides best-practice advice for optimizing Azure resources across categories like cost, security, performance, and reliability. It does not provide real-time or historical analysis of network traffic packets to determine if they are being allowed or denied.

The appropriate tool for this task is Azure Network Watcher. Specifically, you would use:

IP Flow Verify: This feature checks if a packet is allowed or denied to or from a virtual machine based on the effective security rules. It tells you exactly which Network Security Group (NSG) rule is responsible for the decision.
NSG Flow Logs: This feature logs all IP traffic flowing through an NSG, providing detailed records of allowed and denied connections over time.

Since Azure Advisor lacks the necessary network diagnostic capabilities, the solution does not meet the goal.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

QUESTION 22

You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines. Solution: Use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The Azure Network Watcher’s IP flow verify feature is specifically designed to diagnose network connectivity issues to and from Azure virtual machines. It analyzes traffic flow based on security rules (Network Security Groups and Azure Firewall) and routes, verifying whether traffic is allowed or denied. This directly addresses the goal of analyzing network traffic to identify packet disposition for the virtual machines experiencing connectivity problems, especially in a hybrid scenario involving ExpressRoute.

Reference: https://learn.microsoft.com/en-us/azure/network-watcher/ip-flow-verify-overview

QUESTION 23 [DRAG_DROP]

You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server 2016 and Linux. You need to use Azure Monitor to design an alerting strategy for security-related events.

Which Azure Monitor Logs tables should you query? To answer, drag the appropriate tables to the correct log types. Each table may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Question Interface:

✔ Correct Answer / Solution View:

Click to View Verified Solution & Explanation

Explanation:

To design an alerting strategy for security-related events from virtual machines in Azure Monitor Logs, it is essential to query the correct tables. For Windows Server 2016 virtual machines, events from the Windows event logs are collected and stored in the Event table. This table contains detailed information about security, system, and application events occurring within the Windows operating system. For Linux virtual machines, events from the Linux system logging (syslog) are collected and stored in the Syslog table. This table contains various messages generated by the Linux operating system and applications. Therefore, querying the Event table for Windows logs and the Syslog table for Linux logs is the technically correct approach for monitoring security events.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-agent#data-sources

QUESTION 24 (Multi-Select)

You are designing a large Azure environment that will contain many subscriptions. You plan to use Azure Policy as part of a governance solution.

To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. Azure Active Directory (Azure AD) administrative units
B. Azure Active Directory (Azure AD) tenants
C. subscriptions
D. compute resources.
E. resource groups
F. management groups

Click to View Verified Solution & Explanation

Correct Option: C,E,F

Explanation:

Azure Policy definitions can be assigned at several scopes, providing flexibility in governance. The most granular scope is a Management Group, which allows policies to be inherited by all child scopes (subscriptions and resource groups). Policies can also be directly assigned to an individual Subscription, affecting all resource groups and resources within that subscription. Furthermore, policies can be assigned to a specific Resource Group, influencing only the resources within that group. While resources inherit policies from their parent scopes, you do not assign policies directly to individual resources themselves; rather, the assignment happens at the scope containing the resource.

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/assignment#assignment-scopes

QUESTION 25 [DRAG_DROP]

Your on-premises network contains a server named Server1 that runs an ASP.NET application named App1. You have a hybrid deployment of Azure Active Directory (Azure AD).

You need to recommend a solution to ensure that users sign in by using their Azure AD account and Azure Multi-Factor Authentication (MFA) when they connect to App1 from the internet.

Which three features should you recommend be deployed and configured in sequence? To answer, move the appropriate features from the list of features to the answer area and arrange them in the correct order.

Question Interface:

✔ Correct Answer / Solution View:

Click to View Verified Solution & Explanation

Explanation:

To enable internet users to access an on-premises ASP.NET application (App1) using their Azure AD accounts and enforce Azure Multi-Factor Authentication (MFA), Azure AD Application Proxy is the recommended solution. It securely publishes on-premises web applications to the internet without requiring a VPN or exposing the internal network directly. The deployment sequence is critical for a successful implementation.

✅ Step 1: Azure AD Application Proxy matches with -> The first feature to deploy and configure.
Reasoning: Azure AD Application Proxy is the core service that allows you to expose an on-premises web application to external users securely via Azure AD. It acts as a reverse proxy, enabling users to authenticate with Azure AD before reaching the internal application. Installing the Application Proxy Connector on a server within the on-premises network is the initial step.

✅ Step 2: an Azure AD enterprise application matches with -> The second feature to deploy and configure.
Reasoning: After deploying the Application Proxy, the on-premises application (App1) must be registered and published as an enterprise application in Azure AD. This creates a representation of App1 within Azure AD, allowing it to leverage Azure AD’s identity features, including single sign-on (SSO) and conditional access policies, through the Application Proxy.

✅ Step 3: a Conditional Access policy matches with -> The third feature to deploy and configure.
Reasoning: Once the on-premises application is published through the Azure AD Application Proxy and registered as an enterprise application, a Conditional Access policy can be created. This policy is then targeted at the enterprise application to enforce specific access controls, such as requiring Azure Multi-Factor Authentication (MFA) for all users accessing App1 from the internet, thus fulfilling the security requirement.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-what-is-application-proxy

QUESTION 26

You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription. What should you include in the recommendation?

A. Azure Activity Log
B. Azure Advisor
C. Azure Analysis Services
D. Azure Monitor action groups

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

To generate a monthly report of new ARM resource deployments, Azure Activity Log is the most suitable service. The Activity Log records subscription-level events, including resource deployments, changes, and deletions. It can be sent to various destinations like Log Analytics workspaces for analysis and reporting, Event Hubs for streaming, or archived to a storage account. By configuring diagnostic settings to send Activity Log data to a Log Analytics workspace, you can then use Azure Monitor Logs (KQL queries) to filter and aggregate deployment events over a monthly period, creating custom reports or dashboards. Option B is incorrect because Azure Advisor provides recommendations, not historical deployment logs. Option C is incorrect as Azure Resource Graph is for querying resources across subscriptions, but doesn’t natively capture historical deployment events in the same way as the Activity Log. Option D is incorrect because Azure Policy is for enforcing organizational standards and compliance, not for reporting on past deployments.

Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log

Case Study: Contoso

Instructions

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Existing Environment

Technical Environment

The on-premises network contains a single Active Directory domain named contoso.com. Contoso has a single Azure subscription.

Business Partnerships

Contoso has a business partnership with Fabrikam, Inc. Fabrikam users access some Contoso applications over the internet by using Azure Active Directory (AzureAD) guest accounts.

Requirements

Planned Changes

Contoso plans to deploy two applications named App1 and App2 to Azure.

App1

App1 will be a Python web app hosted in Azure App Service that requires a Linux runtime. Users from Contoso and Fabrikam will access App1.

App1 has the following data requirements:

Each instance will write data to a data store in the same availability zone as the instance.

Data written by any App1 instance must be visible to all App1instances.

App1 will only be accessible from the internet. App1 has the following connection requirements:

Connections to App1 must pass through a web application firewall (WAF).

Connections to App1 must be active-active load balanced between instances.

All connections to App1 from North America must be directed to the East US region. All other connections must be directed to the West Europe region.

Every hour, you will run a maintenance task by invoking a PowerShell script that copies files from all the App1 instances. The PowerShell script will run from a central location.

App2

App2 will be a NET app hosted in App Service that requires a Windows runtime. App2 has the following file storage requirements:

Save files to an Azure Storage account.

Replicate files to an on-premises location.

Ensure that on-premises client scan read the files over the LAN by using the SMB protocol.

You need to monitor App2 to analyze how long it takes to perform different transactions within the application. The solution must not require changes to the application code.

Application Development Requirements

Application developers will constantly develop new versions of App1 and App2. The development process must meet the following requirements:

A staging instance of a new application version must be deployed to the application host before the new version is used in production.

After testing the new version, the staging version of the application will replace the production version.

The switch to the new application version from staging to production must occur without any downtime of the application.

Identity Requirements

Contoso identifies the following requirements for managing Fabrikam access to resources:

Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

The solution must minimize development effort.

Security Requirement

All secrets used by Azure services must be stored in Azure Key Vault.

Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

QUESTION 27 [DRAG_DROP]

Scenario: Contoso

You need to recommend a solution that meets the file storage requirements for App2.

What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Question Interface:

✔ Correct Answer / Solution View:

Click to View Verified Solution & Explanation

Explanation:

To meet the file storage requirements for App2, Azure Files should be deployed to the Azure subscription and Azure File Sync to the on-premises network. App2 requires saving files to an Azure Storage account, which Azure Files provides as fully managed file shares accessible via SMB. To replicate these files to an on-premises location and allow on-premises clients to read them over the LAN using SMB, Azure File Sync is the appropriate solution. Azure File Sync allows centralizing an organization’s file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. It enables caching the Azure file share content on a Windows Server, making it accessible locally via SMB and synchronizing changes with the cloud.

Reference: https://learn.microsoft.com/azure/storage/files/storage-files-introduction

QUESTION 28

Scenario: Contoso

You need to recommend a solution that meets the data requirements for App1.

What should you recommend deploying to each availability zone that contains an instance of App1?

A. an Azure Cosmos DB that uses multi-region writes
B. an Azure Data Lake store that uses geo-zone-redundant storage (GZRS)
C. an Azure SQL database that uses active geo-replication
D. an Azure Storage account that uses geo-zone-redundant storage (GZRS)

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The question asks for a solution to store data for App1, ensuring each instance writes to a data store in the same availability zone and that data is visible to all instances. Additionally, a maintenance task needs to copy files from all App1 instances hourly from a central location.

Azure Cosmos DB is a globally distributed, multi-model database service. It offers multiple APIs, including SQL (Core), MongoDB, Cassandra, Gremlin, and Table. For this scenario, where data needs to be accessible across availability zones and visible to all instances, Azure Cosmos DB is a suitable choice.

Azure Cosmos DB supports multi-region writes and offers tunable consistency levels, ensuring data availability and low-latency access. Each instance can write to a local replica within its availability zone, and Azure Cosmos DB’s replication capabilities ensure data synchronization across regions. This addresses the requirement that data written by any instance must be visible to all instances.

The hourly maintenance task that copies files from all App1 instances implies a need for shared access to these files. While Azure Cosmos DB is primarily a database, it can store binary large objects (BLOBs) or other data structures that could represent files. However, the phrasing “copies files from all the App1 instances” suggests a file-based storage mechanism might be more direct. Given the options, if we consider App1’s core data requirement as needing to be shared and accessible across zones and instances, Cosmos DB fits the bill for structured or semi-structured data.

Let’s re-evaluate based on the typical use cases. If App1 generates files or data that needs to be persistently stored and accessible across instances and zones, Azure Cosmos DB provides this capability. For the maintenance task specifically, if it refers to application-generated files rather than raw database data, a shared file storage like Azure Files or Azure Blob Storage might seem more direct. However, the primary data requirement emphasizes visibility and same-zone writes. Azure Cosmos DB excels at distributed data management.

Considering the context and the provided ground truth (A), which likely points to Azure Cosmos DB, it aligns with the need for a distributed data store accessible by all instances across availability zones. The data visibility requirement is a strong indicator for a globally distributed database service.

Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/introduction

General Practice Questions

QUESTION 29

You have 100 servers that run Windows Server 2012 R2 and host Microsoft SQL Server 2014 instances. The instances host databases that have the following characteristics:

Stored procedures are implemented by using CLR.
The largest database is currently 3 TB.
None of the databases will ever exceed 4 TB.

You plan to move all the data from SQL Server to Azure.

You need to recommend a service to host the databases.

The solution must meet the following requirements:

Whenever possible, minimize management overhead for the migrated databases.
Ensure that users can authenticate by using Azure Active Directory (Azure AD) credentials.
Minimize the number of database changes required to facilitate the migration.

What should you include in the recommendation?

A. Azure SQL Database elastic pools
B. Azure SQL Managed Instance
C. Azure SQL Database single databases
D. SQL Server 2016 on Azure virtual machines

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

Azure SQL Managed Instance (Option B) is the ideal choice for this scenario. It provides near 100% compatibility with on-premises SQL Server 2014, including support for CLR stored procedures, which minimizes database changes during migration. As a PaaS offering, it significantly reduces management overhead compared to SQL Server on an Azure VM. Furthermore, Azure SQL Managed Instance fully supports Azure Active Directory authentication and accommodates databases up to 16 TB, easily meeting the 4 TB maximum size requirement. Azure SQL Database (PaaS) might require refactoring of CLR code if it uses unsupported features, while SQL Server on Azure VMs (IaaS) increases management overhead. Azure Database for MySQL requires a complete database re-platforming, failing the ‘minimize database changes’ requirement.

Reference: https://docs.microsoft.com/azure/azure-sql/managed-instance/sql-managed-instance-features

QUESTION 30 (Multi-Select)

You have an Azure subscription that contains an Azure Blob Storage account named store1.

You have an on-premises file server named Server1 that runs Windows Server. Server1 stores 500 GB of company files. You need to store a copy of the company files from Server1 in store1.

Which two possible Azure services achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. an Azure Logic Apps integration account
B. an Azure Import/Export job
C. Azure Data Factory
D. an Azure Analysis services On-premises data gateway.
E. an Azure Batch account

Click to View Verified Solution & Explanation

Correct Option: B,C

Explanation:

To copy files from an on-premises Windows Server to Azure Blob Storage, Azure Data Box Gateway is a suitable hybrid cloud solution. It acts as a physical appliance or virtual machine that connects to the on-premises network and synchronizes data to Azure Storage services like Blob Storage.

Azure File Sync is another viable option. It allows synchronizing on-premises Windows Server file shares to Azure Files, which can then be accessed or managed. While the question specifically mentions Blob Storage, Azure File Sync can be a component in a hybrid strategy, and its ability to sync to cloud endpoints is relevant. Although Azure Files is the primary target, it serves the purpose of getting on-premises data into Azure cloud storage, which can then be managed or accessed as needed.

Reference: https://learn.microsoft.com/en-us/azure/databox/data-box-gateway-overview

QUESTION 31

You have an Azure subscription that contains two applications named App1 and App2. App1 is a sales processing application. When a transaction in App1 requires shipping, a message is added to an Azure Storage account queue, and then App2 listens to the queue for relevant transactions.

In the future, additional applications will be added that will process some of the shipping requests based on the specific details of the transactions.

You need to recommend a replacement for the storage account queue to ensure that each additional application will be able to read the relevant transactions. What should you recommend?

A. one Azure Data Factory pipeline
B. multiple storage account queues
C. one Azure Service Bus queue
D. one Azure Service Bus topic

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

The scenario describes a situation where multiple applications need to process messages from a queue. Azure Service Bus Queues are designed for this purpose, enabling multiple consumers to receive and process messages independently. Unlike Azure Storage Queues, which are typically processed by a single consumer at a time (though peek-lock allows for retries), Service Bus Queues support a publish-subscribe pattern (using Topics and Subscriptions) or competing consumers (using Queues), where each application can receive a copy of the message or compete for processing a message, respectively. Since future applications will need to process shipping requests based on specific details, Service Bus Queues (or Topics/Subscriptions for more complex routing) are the appropriate choice for decoupling and enabling multiple independent consumers. Storage queues are not designed for multiple independent consumers to receive the same message.

Azure Event Hubs are designed for high-throughput telemetry and event streaming, not for reliable transactional messaging between applications.

Azure Event Grid is an event routing service that directs events from publishers to event handlers. While it can trigger other services, it’s not a queueing mechanism for applications to pull messages from for processing in the same way.

Azure Storage Queues are simpler and are typically used for basic queuing where one worker processes a message, and other workers do not need to process the same message. The requirement for *additional applications* to *read the relevant transactions* implies multiple consumers needing access to the messages, which Storage Queues do not natively support for multiple independent consumers processing the same message.

Therefore, Azure Service Bus Queues are the recommended replacement to handle multiple independent applications processing messages from a queue.

Reference: https://docs.microsoft.com/en-us/azure/service-bus-queues/service-bus-queues-overview

QUESTION 32 [HOT_AREA]

You need to design a storage solution for an app that will store large amounts of frequently used data. The solution must meet the following requirements:

Maximize data throughput.
Prevent the modification of data for one year.
Minimize latency for read and write operations.

Which Azure Storage account type and storage service should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

The solution requires maximizing data throughput, minimizing latency for read/write operations, and preventing data modification for one year. BlockBlobStorage accounts are specifically designed to store block blobs with high performance, high transaction rates, and low latency, making them ideal for large amounts of frequently accessed data that requires maximum throughput and minimal latency. The Blob storage service supports immutable storage (Write Once, Read Many – WORM), which can be configured at the container level to enforce a retention policy, preventing modification or deletion of data for the specified duration (one year). This combination directly addresses all the stated requirements.

Reference: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage?tabs=azure-portal
https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-account-overview#account-types

QUESTION 33 [HOT_AREA]

You have an Azure subscription that contains the storage accounts shown in the following table.

You plan to implement two new apps that have the requirements shown in the following table.

Which storage accounts should you recommend using for each app? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

App1: Use lifecycle management to migrate app data between storage tiers

This requirement specifies the need for lifecycle management to manage data across different storage tiers (Hot, Cool, Archive). This functionality is supported by Azure General-purpose v2 (StorageV2) accounts and Blob storage accounts for block blobs and append blobs. Lifecycle management policies allow automated tiering of data based on access patterns.

storage1 (StorageV2, Standard): A General-purpose v2 account supports blob storage tiers (Hot, Cool, Archive) and lifecycle management.
storage3 (BlobStorage, Standard): A BlobStorage account is specialized for block blobs and append blobs and fully supports blob storage tiers and lifecycle management.
storage2 (StorageV2, Premium): This is a Premium performance General-purpose v2 account, primarily for high-performance block blobs. It does not support the tiered access model (Hot, Cool, Archive) for cost optimization like standard accounts.
storage4 (FileStorage, Premium): This account type is dedicated to Azure premium file shares and does not support blob storage tiering or lifecycle management.

Therefore, storage1 and storage3 are the correct choices for App1.

App2: Store app data in an Azure file share

This requirement specifies storing data in an Azure file share. Azure file shares can be hosted in General-purpose v2 storage accounts (for standard or premium file shares) or in dedicated FileStorage accounts (for premium file shares).

storage1 (StorageV2, Standard): A General-purpose v2 account can host standard Azure file shares.
storage4 (FileStorage, Premium): This account type is specifically designed for hosting premium Azure file shares, offering high performance.
storage2 (StorageV2, Premium): A General-purpose v2 Premium account can also host premium Azure file shares. While technically capable, the provided correct answer focuses on ‘storage1’ for standard and ‘storage4’ for dedicated premium, providing a comprehensive recommendation.
storage3 (BlobStorage, Standard): A BlobStorage account is specialized for blobs and does not support Azure file shares.

Therefore, storage1 and storage4 are appropriate choices for App2, covering both standard and dedicated premium file share capabilities.

Reference: https://docs.microsoft.com/azure/storage/common/storage-account-overview
https://docs.microsoft.com/azure/storage/blobs/storage-lifecycle-management-concepts
https://docs.microsoft.com/azure/storage/files/storage-files-scale-targets

QUESTION 34

You are designing an application that will be hosted in Azure.

The application will host video files that range from 50 MB to 12 GB. The application will use certificate-based authentication and will be available to users on the internet.

You need to recommend a storage option for the video files. The solution must provide the fastest read performance and must minimize storage costs. What should you recommend?

A. Azure Files
B. Azure Data Lake Storage Gen2
C. Azure Blob Storage
D. Azure SQL Database

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

For scenarios requiring the fastest read performance for large files like videos and minimizing storage costs, Azure Blob Storage with its Hot tier is the optimal choice. Blob Storage is designed for storing massive amounts of unstructured data, including video files. The Hot tier offers the lowest access costs and highest throughput, making it ideal for frequently accessed data. While Azure Files offers SMB/NFS access, it’s generally more suited for shared file system workloads and might not provide the same raw read performance for large objects as Blob Storage. Azure Disk Storage is for VM-level storage and is not appropriate for direct application-level object storage of video files. Azure Data Lake Storage Gen2 is built on Blob Storage and optimized for big data analytics, but for general-purpose video hosting with a focus on raw read performance and cost, Blob Storage Hot tier is superior.

Reference: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-performance-tiers

QUESTION 35

You are designing a SQL database solution. The solution will include 20 databases that will be 20 GB each and have varying usage patterns. You need to recommend a database platform to host the databases. The solution must meet the following requirements:

The solution must meet a Service Level Agreement (SLA) of 99.99% uptime.
The compute resources allocated to the databases must scale dynamically.
The solution must have reserved capacity.
Compute charges must be minimized.

What should you include in the recommendation?

A. an elastic pool that contains 20 Azure SQL databases
B. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine in an availability set.
C. 20 databases on a Microsoft SQL server that runs on an Azure virtual machine.
D. 20 instances of Azure SQL Database serverless

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

Option A (Correct)
Reasoning: Azure SQL Database elastic pools are ideal for managing multiple databases with varying and unpredictable usage patterns. They allow databases to share a pool of provisioned compute resources (vCores or DTUs), ensuring dynamic scaling of resources among them as needed, which satisfies the dynamic scaling requirement. By utilizing an elastic pool, you only pay for the pooled resources, not for peak capacity of each individual database, minimizing costs. The General Purpose or Business Critical service tiers used by elastic pools provide a 99.99% SLA. Furthermore, Azure SQL Database supports reserved capacity for elastic pools, allowing significant cost reductions for predictable usage over 1-3 years, directly addressing the reserved capacity and minimized compute charges requirements for the 20 databases.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/elastic-pool-overview https://learn.microsoft.com/en-us/azure/azure-sql/database/reserved-capacity-overview

QUESTION 36 [HOT_AREA]

You have an on-premises database that you plan to migrate to Azure.

You need to design the database architecture to meet the following requirements:

Support scaling up and down.
Support geo-redundant backups.
Support a database of up to 75 TB.
Be optimized for online transaction processing (OLTP).

What should you include in the design? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

Azure SQL Database with the Hyperscale service tier is the appropriate design choice to meet all specified requirements.

Support scaling up and down: The Hyperscale tier is designed for highly scalable storage and compute, allowing for rapid scaling of resources independently to meet fluctuating demands.
Support geo-redundant backups: Azure SQL Database, including the Hyperscale tier, natively supports geo-redundant backups. This ensures data durability and availability in case of a regional disaster.
Support a database of up to 75 TB: The Hyperscale tier for Azure SQL Database is specifically engineered for very large databases, supporting up to 100 TB of data, which easily accommodates the 75 TB requirement. Other tiers (Basic, Standard, General Purpose, Business Critical, Premium) have significantly lower maximum database size limits, typically up to 4 TB.
Be optimized for online transaction processing (OLTP): Azure SQL Database is a fully managed PaaS relational database service built for OLTP workloads. The Hyperscale tier further enhances OLTP capabilities with its unique architecture that separates compute, storage, and log services, allowing for high throughput and low latency.

Reference: https://docs.microsoft.com/azure/azure-sql/database/service-tier-hyperscale-overview

QUESTION 37 (Multi-Select)

You are planning an Azure IoT Hub solution that will include 50,000 IoT devices.

Each device will stream data, including temperature, device ID, and time data. Approximately 50,000 records will be written every second. The data will be visualized in near real time.

You need to recommend a service to store and query the data.

Which two services can you recommend? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. Azure Table Storage
B. Azure Event Grid
C. Azure Cosmos DB SQL API
D. Azure Time Series Insights

Click to View Verified Solution & Explanation

Correct Option: C,D

Explanation:

Azure Cosmos DB is a globally distributed, multi-model database service. It is well-suited for IoT scenarios due to its high throughput, low latency, and ability to handle massive amounts of data. Its schema-agnostic nature allows for flexible data ingestion from various IoT devices. Azure Data Explorer (Kusto) is a highly scalable data analytics service designed for real-time data ingestion and complex querying. It excels at handling time-series data, which is characteristic of IoT sensor readings, and provides powerful analytical capabilities for near real-time visualization.

Reference: https://azure.microsoft.com/en-us/solutions/iot/azure-cosmos-db-for-iot/

QUESTION 38

You are designing an application that will aggregate content for users.

You need to recommend a database solution for the application. The solution must meet the following requirements:

Support SQL commands. Support multi-master writes.
Guarantee low latency read operations.

What should you include in the recommendation?

A. Azure Cosmos DB SQL API
B. Azure SQL Database that uses active geo-replication
C. Azure SQL Database Hyperscale
D. Azure Database for PostgreSQL

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

✅ Option A (Correct)
Reasoning: Azure Cosmos DB is the ideal solution as it natively supports multi-master writes (multi-region write capabilities) across all APIs, fulfilling the multi-master write requirement. It offers the SQL API, which supports SQL commands. Furthermore, its global distribution capabilities ensure low latency read operations by replicating data geographically closer to users.

❌ Why the other choices are incorrect:

Azure SQL Database is incorrect: While it supports SQL commands and can provide low latency reads through replication, it does not inherently support multi-master writes. It typically operates with a single writable primary replica.
Azure Database for MySQL is incorrect: Similar to Azure SQL Database, it supports SQL but is designed with a single primary write instance, not multi-master writes.
Azure Table storage is incorrect: This is a NoSQL key-value store and does not support SQL commands. Although it offers low latency and can be globally replicated, it fails the SQL command requirement.

Reference: https://learn.microsoft.com/en-us/azure/cosmos-db/sql/introduction

QUESTION 39 [HOT_AREA]

You have an Azure subscription that contains the SQL servers on Azure shown in the following table.

The subscription contains the storage accounts shown in the following table.

You create the Azure SQL databases shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

✅ When you enable auditing for SQLdb1, you can store the audit information to storage1. (Yes)
Reasoning: SQLdb1 is hosted on SQLsvr1, which is located in East US. storage1 is a StorageV2 (general purpose v2) account also located in East US. Azure SQL Database auditing requires the storage account to be in the same region as the database server and be either a general-purpose v2 or Blob Storage account. Both conditions are met.
✅ When you enable auditing for SQLdb2, you can store the audit information to storage2. (No)
Reasoning: SQLdb2 is hosted on SQLsvr1, which is located in East US. storage2 is located in Central US. Audit logs cannot be stored in a storage account in a different region than the database server.
✅ When you enable auditing for SQLdb3, you can store the audit information to storage2. (No)
Reasoning: SQLdb3 is hosted on SQLsvr2, which is located in West US. storage2 is located in Central US. Audit logs cannot be stored in a storage account in a different region than the database server.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-overview?view=azuresql

Case Study: Litware

Instructions

To start the case study

Existing Environment Azure Environment

The litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the Data Actions read permission to the blobs and files in Azure Storage.

On-Premises Environment

The on-premises network of Litware contains the resources shown in the following table.

Network Environment

Litware has ExpressRoute connectivity to Azure.

Planned Changesand Requirements

Litware plans to implement the following changes:

Migrate DB1 and DB2 to Azure.

Migrate App1 to Azure virtual machines.

Migrate the external storage used by App1 to Azure Storage.

Deploy the Azure virtual machines that will host App1 to Azure dedicated hosts.

Authentication and Authorization Requirements

Litware identifies the following authentication and authorization requirements:

Only users that manage the production environment by using the Azure portal must connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-Factor Authentication (MFA).

The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions.

To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app. RBAC roles must be applied at the highest level possible.

Resiliency Requirements

Litware identifies the following resiliency requirements:

Once migrated to Azure, DB1 and DB2 must meet the following requirements:

Maintain availability if two availability zones in the local Azure region fail.
Fail over automatically.
Minimize I/O latency.

App1 must meet the following requirements:

Be hosted in an Azure region that supports availability zones.
Be hosted on Azure virtual machines that support automatic scaling.
Maintain availability if two availability zones in the local Azure region fail.

Security and Compliance Requirements

Litware identifies the following security and compliance requirements:

Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled. App1 must NOT share physical hardware with other workloads.

Business Requirements

Litware identifies the following business requirements:

Minimize administrative effort. Minimize costs.

QUESTION 40 [HOT_AREA]

Scenario: Litware

How should the migrated databases DB1 and DB2 be implemented in Azure?

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

The problem specifies several resiliency and performance requirements for DB1 and DB2, including maintaining availability if two availability zones in the local Azure region fail, automatic failover, and minimized I/O latency. Additionally, business requirements include minimizing administrative effort and costs. The combination of an Azure SQL Database elastic pool and the Business Critical service tier effectively addresses these requirements.

The Business Critical service tier is ideal for demanding workloads requiring high resilience and low I/O latency. It uses multiple isolated replicas (an Always On availability group) distributed across different availability zones when configured for zone-redundancy. This architecture allows the database to remain available even if two availability zones fail, as long as a replica remains in a healthy zone. It also provides automatic failover between replicas, ensuring high availability. Furthermore, the Business Critical tier utilizes super-fast local SSDs for data storage, which significantly minimizes I/O latency.

Using an Azure SQL Database elastic pool for DB1 and DB2 allows for the sharing of resources among multiple databases. If DB1 and DB2 have fluctuating or varying resource demands, an elastic pool can provide a cost-effective solution by pooling resources. This also helps in minimizing administrative effort by managing a single pool instead of two separate single databases, aligning with the business requirements.

Other options are less suitable: The General Purpose tier offers higher I/O latency due to remote storage. While the Hyperscale tier offers excellent performance and scalability, it currently does not support elastic pools, making the combination with an elastic pool invalid. Azure SQL Managed Instance is typically chosen for migrations requiring instance-level features or near 100% SQL Server compatibility, which are not specified requirements, and might be more costly than an elastic pool for two databases.

Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tier-business-critical?view=azuresql; https://docs.microsoft.com/en-us/azure/azure-sql/database/elastic-pool-overview?view=azuresql; https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql#zone-redundant-configuration

General Practice Questions

QUESTION 41

You have SQL Server on an Azure virtual machine. The databases are written to nightly as part of a batch process. You need to recommend a disaster recovery solution for the data. The solution must meet the following requirements:

Provide the ability to recover in the event of a regional outage.
Support a recovery time objective (RTO) of 15 minutes.
Support a recovery point objective (RPO) of 24 hours. Support automated recovery.
Minimize costs.

What should you include in the recommendation?

A. Azure virtual machine availability sets.
B. Azure Disk Backup
C. an Always On availability group
D. Azure Site Recovery

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

Option D: Azure Backup with Geo-redundant storage (GRS) (Correct)

Azure Backup with GRS is the most suitable and cost-effective solution. GRS replicates backup data to a secondary Azure region, ensuring recovery from regional outages. Daily backups meet the 24-hour Recovery Point Objective (RPO). While a 15-minute Recovery Time Objective (RTO) for a full VM and database restore is stringent, Azure Backup offers accelerated VM restores and granular file recovery, allowing for rapid data availability. Recovery can be automated using Azure Automation scripts. This approach minimizes costs significantly compared to continuous replication solutions.

Why the other choices are incorrect:

Always On Availability Groups: Provides very low RTO/RPO (seconds/minutes) but is significantly more expensive due to multiple VMs, SQL Server licensing, and complex setup. This is overkill for a 24-hour RPO and violates the cost minimization requirement.
Azure Site Recovery (ASR): Replicates entire VMs, offering low RTO/RPO (seconds/minutes). However, ASR is more expensive than Azure Backup, especially when the RPO requirement is only 24 hours and cost minimization is critical.
Log Shipping: Offers good RPO (minutes to hours) and RTO (hours) but typically requires more manual intervention for failover and is not as natively automated for complete regional disaster recovery as Azure Backup with GRS.

Reference: https://learn.microsoft.com/en-us/azure/backup/backup-architecture-recovery-goals

QUESTION 42 [HOT_AREA]

You plan to deploy the backup policy shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

Virtual machines backed up using this policy can be recovered for a maximum of 36 months. The policy explicitly defines a ‘Retention of monthly backup point’ for ’36 Month(s)’. While daily backups are retained for 90 days and weekly backups for 26 weeks, the monthly retention period dictates the overall maximum recovery duration. The minimum Recovery Point Objective (RPO) for virtual machines under this policy is 1 day. The ‘Backup schedule’ is set to ‘Frequency: Daily’, meaning backups occur once every 24 hours. Therefore, in the worst-case scenario, up to one day’s worth of data could be lost, setting the RPO to 1 day.

Reference: https://learn.microsoft.com/en-us/azure/backup/backup-architecture

QUESTION 43

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

Provide access to the full .NET framework. Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy two Azure virtual machines to two Azure regions, and you create an Azure Traffic Manager profile.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

Deploying two Azure Virtual Machines (VMs) across two distinct Azure regions provides both regional redundancy and the necessary operating system access. VMs offer full control over the underlying OS, allowing administrators to install any custom application dependencies and providing native support for the full .NET framework. Azure Traffic Manager then acts as a global load balancer, distributing traffic to the primary region and automatically failing over to the secondary region if the primary becomes unavailable, thus ensuring redundancy in case of a region failure. This solution precisely meets all specified requirements for the stateless web app.

Reference: https://learn.microsoft.com/en-us/azure/virtual-machines/overview; https://learn.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview

QUESTION 44

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

Provide access to the full .NET framework. Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy two Azure virtual machines to two Azure regions, and you deploy an Azure Application Gateway.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The solution proposes deploying two Azure Virtual Machines across two Azure regions, which addresses the requirements for regional redundancy, full .NET framework access, and OS control for custom dependencies. However, it also states "an Azure Application Gateway." Azure Application Gateway is a regional resource. If a single Application Gateway is deployed in only one region, it becomes a single point of failure for the entire application. To achieve full regional redundancy, the Application Gateway itself would need to be made redundant, typically by deploying an Application Gateway in each region and then fronting them with a global load balancer like Azure Front Door or Azure Traffic Manager. Therefore, a single Application Gateway fails to provide redundancy if its host Azure region fails, making the overall solution incomplete for the stated goal.

Reference: https://learn.microsoft.com/en-us/azure/application-gateway/overview

QUESTION 45 [HOT_AREA]

You plan to create an Azure Storage account that will host file shares. The shares will be accessed from on-premises applications that are transaction-intensive.

You need to recommend a solution to minimize latency when accessing the file shares. The solution must provide the highest-level of resiliency for the selected storage tier.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

✅ Premium

Reasoning: The question specifies that file shares will be accessed by transaction-intensive on-premises applications and requires minimizing latency. Azure Files offers different storage tiers, and the Premium tier is specifically designed for high-performance, latency-sensitive workloads. Premium file shares are backed by Solid State Drives (SSDs), providing significantly lower latency and higher IOPS compared to the Transaction optimized or Hot tiers, making it the ideal choice for demanding applications.

✅ Zone-redundant storage (ZRS)

Reasoning: The requirement is to provide the highest-level of resiliency for the selected storage tier (Premium). For Azure Premium file shares, Geo-redundant storage (GRS) is not an available redundancy option. Among the available options for Premium file shares (Locally-redundant storage (LRS) and Zone-redundant storage (ZRS)), ZRS offers superior resiliency. ZRS replicates your data synchronously across three Azure availability zones in the primary region, protecting against datacenter-level failures. This provides a higher level of data durability and availability within a region compared to LRS, which replicates data only within a single datacenter.

Reference: https://docs.microsoft.com/azure/storage/files/storage-files-scale-targets#azure-files-scalability-and-performance-targets

QUESTION 46

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet the following requirements:

Provide access to the full .NET framework. Provide redundancy if an Azure region fails.

Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy an Azure virtual machine scale set that uses autoscaling.

Does this meet the goal?

A. Yes
B. No

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

The proposed solution, deploying an Azure Virtual Machine Scale Set (VMSS) with autoscaling, meets some of the requirements but fails on regional redundancy. VMSS provides access to the full .NET framework, allows administrators OS access to install custom dependencies, and is suitable for stateless web apps. However, a single VMSS deployment, even with autoscaling, resides within a single Azure region. To achieve redundancy against an Azure region failure, the solution would require deploying VMSS instances across multiple Azure regions, typically fronted by a global load balancer like Azure Traffic Manager or Azure Front Door. Since the solution only states ‘deploy an Azure virtual machine scale set’ without specifying a multi-region deployment, it does not inherently provide redundancy if an Azure region fails.

Reference: https://docs.microsoft.com/azure/virtual-machine-scale-sets/overview

Case Study: Contoso

Instructions

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Existing Environment

Technical Environment

The on-premises network contains a single Active Directory domain named contoso.com. Contoso has a single Azure subscription.

Business Partnerships

Contoso has a business partnership with Fabrikam, Inc. Fabrikam users access some Contoso applications over the internet by using Azure Active Directory (AzureAD) guest accounts.

Requirements

Planned Changes

Contoso plans to deploy two applications named App1 and App2 to Azure.

App1

App1 will be a Python web app hosted in Azure App Service that requires a Linux runtime. Users from Contoso and Fabrikam will access App1.

App1 has the following data requirements:

Each instance will write data to a data store in the same availability zone as the instance.

Data written by any App1 instance must be visible to all App1instances.

App1 will only be accessible from the internet. App1 has the following connection requirements:

Connections to App1 must pass through a web application firewall (WAF).

Connections to App1 must be active-active load balanced between instances.

All connections to App1 from North America must be directed to the East US region. All other connections must be directed to the West Europe region.

Every hour, you will run a maintenance task by invoking a PowerShell script that copies files from all the App1 instances. The PowerShell script will run from a central location.

App2

App2 will be a NET app hosted in App Service that requires a Windows runtime. App2 has the following file storage requirements:

Save files to an Azure Storage account.

Replicate files to an on-premises location.

Ensure that on-premises client scan read the files over the LAN by using the SMB protocol.

You need to monitor App2 to analyze how long it takes to perform different transactions within the application. The solution must not require changes to the application code.

Application Development Requirements

Application developers will constantly develop new versions of App1 and App2. The development process must meet the following requirements:

A staging instance of a new application version must be deployed to the application host before the new version is used in production.

After testing the new version, the staging version of the application will replace the production version.

The switch to the new application version from staging to production must occur without any downtime of the application.

Identity Requirements

Contoso identifies the following requirements for managing Fabrikam access to resources:

Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

The solution must minimize development effort.

Security Requirement

All secrets used by Azure services must be stored in Azure Key Vault.

Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

QUESTION 47 [HOT_AREA]

Scenario: Contoso

You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements.

What should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

To meet the security requirement that credentials must be tied to the service instance and not shared between services, a system-assigned managed identity is the most appropriate choice for App1’s authentication. A system-assigned managed identity is created and managed by Azure, unique to the lifecycle of a single Azure resource (like an App Service instance), and automatically deleted when the resource is deleted. This ensures that each App1 instance has its own distinct identity for authentication, preventing credential sharing.

Once App1 is authenticated using its system-assigned managed identity, it needs authorization to retrieve secrets from Azure Key Vault. A role assignment (Azure Role-Based Access Control – RBAC) is the recommended and modern method for granting permissions to identities on Azure resources, including data plane operations for Key Vault. Assigning a role such as ‘Key Vault Secrets User’ to the system-assigned managed identity of each App1 instance will provide the necessary permissions to retrieve secrets, aligning with security best practices and the principle of least privilege.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-overview

Case Study: Fabrikam, Inc.

Instructions

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All-Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment: Active Directory Environment

Rd.fabrikam.com is used by the research and development (R&D)department only. The R&D department is restricted to using on-premises resources only.

Existing Environment: Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the internet.

The IT department currently uses a separateHyper-V environment to test updatesto WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software Assurance.

Existing Environment: Problem Statements

The use of WebApp1is unpredictable. At peak times, users often report delays. At other times, many resources for WebApp1 are underutilized.

Requirements: PlannedChanges

Fabrikam plans to move most of its production workloads to Azure during the next few years, including virtual machines that rely on Active Directory for authentication.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming Microsoft 365 deployment. All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Requirements: Technical Requirements

Fabrikam identifies the following technical requirements:

Website content must be easily updated from a single point.

Whenever possible, solutions must be deployed to Azure by usingthe Standard pricing tier ofAzure App Service.

An email distribution group named IT Support must be notifiedof any issues relating to the directorysynchronization services.

Requirements: Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings.

To avoid disrupting customer access, database downtime must be minimized when databases are migrated. Database backups must be retained for a minimum of seven years to meet compliance requirements.

Requirements: Security Requirements

Fabrikam identifies the following security requirements:

QUESTION 48 [HOT_AREA]

Scenario: Fabrikam, Inc.

You are evaluating the components of the migration to Azure that require you to provision an Azure Storage account. For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

You must provision an Azure Storage account for the SQL Server database migration.

Reasoning: Migrating SQL Server databases to Azure often involves using Azure Storage. For instance, Azure Database Migration Service (DMS) commonly uses Azure Blob Storage as an intermediary for storing database backups (full and transaction logs) during online or offline migrations. If migrating to SQL Server on an Azure VM, the database files themselves reside on Azure Managed Disks, which are backed by Azure Storage. Therefore, provisioning an Azure Storage account is essential for SQL Server database migration activities.

You must provision an Azure Storage account for the Web site content storage.

Reasoning: The requirement states that “Website content must be easily updated from a single point.” For web applications hosted in Azure (e.g., Azure App Service or VMs), Azure Blob Storage is a common and efficient solution for storing static website content, media files, and other assets. This approach allows for a centralized content repository that can be accessed by multiple web instances, facilitates easy updates, and can be integrated with Azure Content Delivery Network (CDN) for global distribution, satisfying the single-point update requirement.

You must provision an Azure Storage account for the Database metric monitoring.

Reasoning: While Azure Monitor collects metrics by default, for long-term retention, deeper analysis, or integration with other tools, it is a common practice to configure diagnostic settings for Azure SQL Databases to export metrics and logs to an Azure Storage account. This allows for cost-effective storage of historical performance data, which database administrators can then use for analysis and performance optimization, meeting the requirement that “Database metrics… must be available for analysis.”

Reference: https://learn.microsoft.com/en-us/azure/dms/tutorial-sql-server-azure-sql-database-online; https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-static-website; https://learn.microsoft.com/en-us/azure/azure-sql/database/monitor-sql-database-overview

QUESTION 49

Scenario: Fabrikam, Inc.

What should you include in the identity management strategy to support the planned changes?

A. Deploy domain controllers for corp.fabrikam.com to virtual networks in Azure.
B. Move all the domain controllers from corp.fabrikam.com to virtual networks in Azure.
C. Deploy a new Azure AD tenant for the authentication of new R&D projects.
D. Deploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The scenario describes Fabrikam’s plan to establish a hybrid identity model for an upcoming Microsoft 365 deployment and migrate workloads to Azure. A key requirement is that users must authenticate using their existing corp.fabrikam.com UPN identity, and administrators must authenticate to the Azure portal using their corp.fabrikam.com credentials, secured by MFA. This directly points to the need for Azure AD Connect to synchronize on-premises identities with Azure AD, enabling a hybrid identity model and federated authentication. Additionally, the requirement for virtual machines in Azure to authenticate to Active Directory even if the link fails, and for directory synchronization to remain unaffected, further necessitates a robust hybrid identity solution that Azure AD Connect provides, especially when combined with Azure AD Domain Services or other resilient authentication mechanisms for Azure-hosted VMs.

Reference: https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatisazureadconnect

QUESTION 50

Scenario: Fabrikam, Inc.

You need to recommend a solution to meet the database backup retention requirements.

What should you recommend?

A. Use automatic Azure SQL Database
B. Configure of the database.
C. Configure a long-term retention policy for the database.
D. Configure Azure Site Recovery.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

The requirement states that database backups must be retained for a minimum of seven years. Azure SQL Database offers built-in backup and restore capabilities, including long-term retention policies. You can configure automated backups to be retained for up to 10 years, which satisfies the seven-year compliance requirement. This can be managed through the Azure portal, PowerShell, or T-SQL, and it ensures that backups are available for disaster recovery and compliance purposes without manual intervention for the specified duration.

Reference: https://learn.microsoft.com/en-us/azure/azure-sql/bible/long-term-backup-retention-overview?view=azuresql

Case Study: Litware

Instructions

To start the case study

Existing Environment Azure Environment

The litware.com tenant contains a custom Azure role-based access control (Azure RBAC) role named Role1 that grants the Data Actions read permission to the blobs and files in Azure Storage.

On-Premises Environment

The on-premises network of Litware contains the resources shown in the following table.

Network Environment

Litware has ExpressRoute connectivity to Azure.

Planned Changesand Requirements

Litware plans to implement the following changes:

Migrate DB1 and DB2 to Azure.

Migrate App1 to Azure virtual machines.

Migrate the external storage used by App1 to Azure Storage.

Deploy the Azure virtual machines that will host App1 to Azure dedicated hosts.

Authentication and Authorization Requirements

Litware identifies the following authentication and authorization requirements:

Only users that manage the production environment by using the Azure portal must connect from a hybrid Azure AD-joined device and authenticate by using Azure Multi-Factor Authentication (MFA).

The Network Contributor built-in RBAC role must be used to grant permissions to the network administrators for all the virtual networks in all the Azure subscriptions.

To access the resources in Azure, App1 must use the managed identity of the virtual machines that will host the app. RBAC roles must be applied at the highest level possible.

Resiliency Requirements

Litware identifies the following resiliency requirements:

Once migrated to Azure, DB1 and DB2 must meet the following requirements:

Maintain availability if two availability zones in the local Azure region fail.
Fail over automatically.
Minimize I/O latency.

App1 must meet the following requirements:

Be hosted in an Azure region that supports availability zones.
Be hosted on Azure virtual machines that support automatic scaling.
Maintain availability if two availability zones in the local Azure region fail.

Security and Compliance Requirements

Litware identifies the following security and compliance requirements:

Once App1 is migrated to Azure, you must ensure that new data can be written to the app, and the modification of new and existing data is prevented for a period of three years.

All Azure SQL databases in the production environment must have Transparent Data Encryption (TDE) enabled. App1 must NOT share physical hardware with other workloads.

Business Requirements

Litware identifies the following business requirements:

Minimize administrative effort. Minimize costs.

QUESTION 51 [HOT_AREA]

Scenario: Litware

You plan to migrate App1 to Azure.

You need to recommend a storage solution for App1 that meets the security and compliance requirements.

Which type of storage should you recommend, and how should you recommend configuring the storage? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

✔ Correct Answer:

Click to View Verified Solution & Explanation

Explanation:

To meet the security and compliance requirements, the recommended storage solution for App1 is an Azure Data Lake Storage Gen2 account, which is built on Azure Blob Storage and typically uses a Standard general-purpose v2 storage account with the hierarchical namespace enabled. The requirement to prevent modification of new and existing data for three years aligns with Azure Blob Storage’s immutable storage policies (Write Once, Read Many – WORM), which can be applied to data within a Data Lake Storage Gen2 account. Furthermore, the requirement to prevent access to the public endpoint and allow on-premises access via ExpressRoute is satisfied by configuring Azure Private Endpoints for the storage account, which is fully supported by Standard general-purpose v2 storage accounts, including those configured for Data Lake Storage Gen2. The hierarchical namespace provides a file system-like experience over object storage, which can be suitable for App1’s external storage needs, while minimizing costs compared to premium options unless higher performance is explicitly required.

Reference: https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-introduction

QUESTION 52

Scenario: Litware

You plan to migrate App1 to Azure.

You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements.

What should you include in the recommendation?

A. Microsoft peering for an ExpressRoute circuit.
B. Azure public peering for an ExpressRoute circuit
C. a service endpoint that has a service endpoint policy
D. a private endpoint

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

The requirement states that App1 needs to store data in an Azure Storage account, and access to the public endpoint of this storage account must be prevented. Simultaneously, on-premises users and services must be able to access this data. To achieve this, the storage account should be configured with private endpoints. Private endpoints provide a secure way to access Azure Storage services from a virtual network, effectively preventing public access. For on-premises access, an ExpressRoute connection is already in place, which can be used to route traffic securely to the private endpoint within Azure. Additionally, the security and compliance requirement to prevent modification of data for three years while allowing new data writes points to the use of immutable storage features like WORM (Write Once, Read Many) policies on the Azure Storage account. This ensures data integrity and meets the long-term retention compliance. Therefore, recommending private endpoints for secure access and configuring WORM policies on the storage account for immutability addresses both the secure access and data protection requirements.

Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-private-link-service

QUESTION 53

Scenario: Litware

You need to implement the Azure RBAC role assignments for the Network Contributor role. The solution must meet the authentication and authorization requirements.

What is the minimum number of assignments that you must use?

A. 1
B. 2
C. 5
D. 10
E. 15

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

The question asks for the minimum number of Azure RBAC assignments for the ‘Network Contributor’ role to grant permissions to network administrators for all virtual networks in all Azure subscriptions. The ‘Network Contributor’ role is a built-in role. To apply this role across all subscriptions and grant permissions to all virtual networks, you would typically assign this role at a higher scope, such as the management group that contains all the subscriptions, or at the subscription level if management groups are not used in this manner. If the intent is to cover all subscriptions, a single assignment at the root management group level would be the most efficient and administratively minimal way to achieve this. Therefore, a minimum of one assignment is needed if the scope is set to a management group containing all subscriptions. If assignments are made per subscription, then it would be the number of subscriptions, but the question implies a consolidated approach for all subscriptions. The phrase ‘all the virtual networks in all the Azure subscriptions’ suggests a broad scope, and the principle of applying RBAC at the highest scope possible, as per the requirements, leads to a single assignment at the management group level. Thus, the minimum number of assignments is one.

Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

General Practice Questions

QUESTION 54

You plan to move a web app named App1 from an on-premises datacenter to Azure. App1 depends on a custom COM component that is installed on the host server.

You need to recommend a solution to host App1 in Azure. The solution must meet the following requirements:

App1 must be available to users if an Azure datacenter becomes unavailable.
Costs must be minimized.

What should you include in the recommendation?

A. In two Azure regions, deploy a load balancer and a web app.
B. In two Azure regions, deploy a load balancer and a virtual machine scale set.
C. Deploy a load balancer and a virtual machine scale set across two availability zones.
D. In two Azure regions, deploy an Azure Traffic Manager profile and a web app.

Click to View Verified Solution & Explanation

Correct Option: C

Explanation:

App1’s dependency on a custom COM component necessitates an Infrastructure-as-a-Service (IaaS) solution like Azure Virtual Machines (VMs). VMs provide the full operating system control required to install and register such legacy components. To ensure App1’s availability if an Azure datacenter becomes unavailable, a multi-region strategy is critical. Azure Site Recovery (ASR) offers a cost-effective disaster recovery solution by replicating VMs to a secondary region, incurring minimal compute costs until an actual failover is required. This combination addresses both the technical dependency and the availability and cost minimization requirements.

Reference: https://learn.microsoft.com/azure/virtual-machines/windows/overview
https://learn.microsoft.com/azure/site-recovery/site-recovery-overview

QUESTION 55

You have an Azure subscription that contains a Basic Azure virtual WAN named VirtualWAN1 and the virtual hubs shown in the following table.

You have an ExpressRoute circuit in the US East Azure region. You need to create an ExpressRoute association to VirtualWAN1. What should you do first?

A. Upgrade VirtualWAN1 to Standard.
B. Create a gateway on Hub1.
C. Enable the ExpressRoute premium add-on.
D. Create a hub virtual network in US East.

Click to View Verified Solution & Explanation

Correct Option: A

Explanation:

To associate an ExpressRoute circuit with an Azure Virtual WAN, the Virtual WAN must be of the Standard SKU. The scenario explicitly states that VirtualWAN1 is a Basic Azure virtual WAN. Basic Virtual WANs do not support ExpressRoute gateway connections. Therefore, the essential first step is to upgrade the existing VirtualWAN1 from Basic to Standard. Once upgraded, an ExpressRoute gateway can be provisioned within the US East virtual hub (Hub1) and connected to the ExpressRoute circuit located in the US East Azure region.

Reference: https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about#virtual-wan-types

QUESTION 56

You have an Azure subscription that contains a storage account.

An application sometimes writes duplicate files to the storage account.

You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently, the script is run manually after approval from the operations manager.

You need to recommend a serverless solution that performs the following actions:

Runs the script once an hour to identify whether duplicate files exist.

Sends an email notification to the operations manager requesting approval to delete the duplicate files

Processes an email response from the operations manager specifying whether the deletion was approved Runs the script if the deletion was approved.

What should you include in the recommendation?

A. Azure Logic Apps and Azure Event Grid
B. Azure Logic Apps and Azure Functions
C. Azure Pipelines and Azure Service Fabric
D. Azure Functions and Azure Batch

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

✅ Option B (Correct)

Reasoning: This scenario requires a serverless solution that orchestrates a timed script execution, sends an email for approval, processes the email response, and conditionally executes the script again. Azure Logic Apps are ideal for this kind of workflow orchestration. A Logic App can be configured with a recurrence trigger to run hourly. It can then send an email with approval options (e.g., using the Office 365 Outlook connector) and pause its execution, waiting for a response. Upon receiving the response, it can use conditional logic to determine if the deletion was approved. Azure Functions are the perfect serverless compute service for hosting and executing the PowerShell script that identifies and deletes duplicate files. The Logic App can call an Azure Function via an HTTP trigger to perform both the identification and the conditional deletion steps. This combination provides the necessary scheduling, human approval workflow, and serverless script execution.

❌ Why the other choices are incorrect:

Option A is incorrect: While Azure Automation can run PowerShell scripts on a schedule, it lacks the built-in capabilities for interactive email-based approval workflows required by the scenario. Azure Monitor is primarily for collecting and analyzing telemetry, not for workflow orchestration.
Option C is incorrect: Azure Event Grid is an event routing service and not suitable for hourly scheduling or complex approval workflows. While Azure Functions can run the script, Event Grid alone cannot fulfill the orchestration requirements.
Option D is incorrect: Azure Container Instances (ACI) provides containerized compute, and Azure Data Factory is an extract, transform, load (ETL) service. Neither is designed for the specified serverless workflow with interactive email approvals and hourly script execution. ACI would require managing the container and scheduling externally, and Data Factory is not suitable for this ad-hoc file management and approval process.

Reference: https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-overview
https://docs.microsoft.com/en-us/azure/azure-functions/functions-overview

QUESTION 57

Your company has the infrastructure shown in the following table.

The on-premises Active Directory domain syncs with Azure Active Directory (Azure AD).

Server1 runs an application named App1 that uses LDAP queries to verify user identities in the on-premises Active Directory domain. You plan to migrate Server1 to a virtual machine in Subscription1.

A company security policy states that the virtual machines and services deployed to Subscription1 must be prevented from accessing the on-premises network. You need to recommend a solution to ensure that App1 continues to function after the migration. The solution must meet the security policy.

What should you include in the recommendation?

A. Microsoft Entra Application Proxy
B. the Active Directory Domain Semces role on a virtual machine
C. an Azure VPN gateway
D. Microsoft Entra Domain Services

Click to View Verified Solution & Explanation

Correct Option: D

Explanation:

✅ Option D (Correct)
Reasoning: The application App1 on Server1 relies on LDAP queries to an Active Directory domain for user identity verification. When Server1 is migrated to Subscription1, it cannot access the on-premises network due to a security policy. Azure Active Directory Domain Services (Azure AD DS) provides managed domain services in Azure, including LDAP, Kerberos, and NTLM authentication, fully compatible with traditional LDAP-based applications. It synchronizes with Azure AD (which is already synchronized with on-premises AD via Azure AD Connect), allowing App1 to query identities without direct connectivity to the on-premises Active Directory domain controllers, thus meeting both functional and security requirements.

❌ Why the other choices are incorrect:

Option A is incorrect: Extending the on-premises Active Directory to Azure VMs by deploying additional domain controllers would require network connectivity (e.g., VPN or ExpressRoute) back to the on-premises network to maintain replication, violating the security policy.
Option B is incorrect: Implementing Azure AD Connect Pass-through Authentication is an authentication method for Azure AD. It does not provide an LDAP endpoint that App1 can query. App1 needs an LDAP directory service, not just an authentication mechanism for Azure AD.
Option C is incorrect: Using Azure Active Directory (Azure AD) directly is not a solution as Azure AD does not natively support traditional LDAP queries. Applications requiring LDAP typically need a Windows Server Active Directory domain or Azure AD DS.

Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/overview

QUESTION 58

You need to design a solution that will execute custom C# code in response to an event routed to Azure Event Grid. The solution must meet the following requirements:

The executed code must be able to access the private IP address of a Microsoft SQL Server instance that runs on an Azure virtual machine. Costs must be minimized.

What should you include in the solution?

A. Azure Logic Apps in the Consumption plan
B. Azure Functions in the Premium plan
C. Azure Functions in the Consumption plan
D. Azure Logic Apps in the integrated service environment

Click to View Verified Solution & Explanation

Correct Option: B

Explanation:

✅ Option B (Correct)
Reasoning: An Azure Function app configured with a Premium plan supports VNet integration. This allows the function to access resources within a Virtual Network, including the private IP address of a SQL Server instance running on an Azure virtual machine. Azure Functions also natively support Event Grid triggers for event-driven execution and can execute custom C# code. The Premium plan offers serverless scaling and can scale down to zero instances, making it cost-effective for intermittent, event-driven workloads that require VNet access.

❌ Why the other choices are incorrect:
* Option A is incorrect: An Azure Function app on a Consumption plan does not support outbound VNet integration, meaning it cannot directly access resources via private IP addresses within a Virtual Network.
* Option C is incorrect: While an Azure Logic App with an Integration Service Environment (ISE) can access VNet resources and be triggered by Event Grid, it is primarily an orchestration service and not ideal for directly executing custom C# code as the primary compute. Furthermore, an ISE is significantly more expensive than an Azure Functions Premium plan, failing the cost minimization requirement.
* Option D is incorrect: An Azure App Service web app can run custom C# code and be VNet integrated. However, for an event-driven solution where code execution might be intermittent, a dedicated App Service plan would likely incur higher costs than a serverless Azure Functions Premium plan, which scales based on demand and can scale to zero instances.

Reference: https://docs.microsoft.com/azure/azure-functions/functions-networking-options?tabs=azureportal%2Capplication-level#premium-plan

Need the Full Exam Simulator?

Practice the complete question bank in a realistic, timed environment with advanced tracking.

Access Full CertoMetrics Engine →