AZ-304.

exam questions

AZ-304

Microsoft Azure Architect Design

Version 20.0
Determine Workload Requirements

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Contoso, Ltd. is a US-based financial services company that has a main office in New York and a branch
office in San Francisco.

Existing Environment

Payment Processing System

Contoso hosts a business-critical payment processing system in its New York data center. The system has
three tiers: a front-end web app, a middle-tier web API, and a back-end data store implemented as a
Microsoft SQL Server 2014 database. All servers run Windows Server 2012 R2.

The front-end and middle-tier components are hosted by using Microsoft Internet Information Services (IIS).
The application code is written in C# and ASP.NET. The middle-tier API uses the Entity Framework to
communicate to the SQL Server database. Maintenance of the database is performed by using SQL Server
Agent jobs.

The database is currently 2 TB and is not expected to grow beyond 3 TB.

The payment processing system has the following compliance-related requirements:

Encrypt data in transit and at rest. Only the front-end and middle-tier components must be able to
access the encryption keys that protect the data store.
Keep backups of the data in two separate physical locations that are at least 200 miles apart and can be
restored for up to seven years.
Support blocking inbound and outbound traffic based on the source IP address, the destination IP
address, and the port number.
Collect Windows security logs from all the middle-tier servers and retain the logs for a period of seven
years.
Inspect inbound and outbound traffic from the front-end tier by using highly available network
appliances.
Only allow all access to all the tiers from the internal network of Contoso.

Tape backups are configured by using an on-premises deployment of Microsoft System Center Data
Protection Manager (DPM), and then shipped offsite for long term storage.
Historical Transaction Query System

Contoso recently migrated a business-critical workload to Azure. The workload contains a .NET web
service for querying the historical transaction data residing in Azure Table Storage. The .NET web service
is accessible from a client app that was developed in-house and runs on the client computers in the New
York office. The data in the table storage is 50 GB and is not expected to increase.

Current Issues

The Contoso IT team discovers poor performance of the historical transaction query system, at the queries
frequently cause table scans.

Requirements

Planned Changes

Contoso plans to implement the following changes:

Migrate the payment processing system to Azure.

Migrate the historical transaction data to Azure Cosmos DB to address the performance issues.

Migration Requirements

Contoso identifies the following general migration requirements:

Infrastructure services must remain available if a region or a data center fails. Failover must occur
without any administrative intervention.
Whenever possible, Azure managed services must be used to minimize management overhead.
Whenever possible, costs must be minimized.

Contoso identifies the following requirements for the payment processing system:

If a data center fails, ensure that the payment processing system remains available without any
administrative intervention. The middle-tier and the web front end must continue to operate without any
additional configurations.
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.
Minimize the effort required to modify the middle-tier API and the back-end tier of the payment
processing system.
Payment processing system must be able to use grouping and joining tables on encrypted columns.
Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
Ensure that the payment processing system preserves its current compliance status.
Host the middle tier of the payment processing system on a virtual machine.

Contoso identifies the following requirements for the historical transaction query system:

Minimize the use of on-premises infrastructure services.

Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
Minimize the frequency of table scans.
If a region fails, ensure that the historical transaction query system remains available without any
administrative intervention.

Information Security Requirements

The IT security team wants to ensure that identity management is performed by using Active Directory.
Password hashes must be stored on-premises only.

Access to all business-critical systems must rely on Active Directory credentials. Any suspicious
authentication attempts must trigger a multi-factor authentication prompt automatically. Legitimate users
must be able to authenticate successfully by using multi-factor authentication.

QUESTION 1
You need to recommend a solution for the collection of security logs for the middle tier of the payment
processing system.

What should you include in the recommendation?

A. Azure Event Hubs
B. Azure Notification Hubs
C. the Azure Diagnostics agent
D. the Microsoft Monitoring agent

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Scenario: Collect Windows security logs from all the middle-tier servers and retain the logs for a period of
seven years.

The Azure Diagnostics agent should be used when you want to archive logs and metrics to Azure storage.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview
Determine Workload Requirements

Question Set 2

QUESTION 1
HOTSPOT

You deploy several Azure SQL Database instances.

You plan to configure the Diagnostics settings on the databases as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
90 days
730 days

Section: (none)
Explanation

Explanation/Reference:
Explanation:
In the exhibit, the SQLInsights data is configured to be stored in Azure Log Analytics for 90 days. However,
the question is asking for the “maximum” amount of time that the data can be stored which is 730 days.

QUESTION 3
Your company uses Microsoft System Center Service Manager on its on-premises network.

You plan to deploy several services to Azure.

You need to recommend a solution to push Azure service health alerts to Service Manager.
What should you include in the recommendation?

A. Azure Notification Hubs

B. Azure Event Hubs
C. IT Service Management Connector (ITSM)
D. Application Insights Connector

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/itsmc-overview

QUESTION 4
You have an on-premises Hyper-V cluster. The cluster contains Hyper-V hosts that run Windows Server
2016 Datacenter. The hosts are licensed under a Microsoft Enterprise Agreement that has Software
Assurance.

The Hyper-V cluster contains 30 virtual machines that run Windows Server 2012 R2. Each virtual machine
runs a different workload. The workloads have predictable consumption patterns.

You plan to replace the virtual machines with Azure virtual machines that run Windows Server 2016. The
virtual machines will be sized according to the consumption pattern of each workload.

You need to recommend a solution to minimize the compute costs of the Azure virtual machines.
Which two recommendations should you include in the solution? Each correct answer presents part of the
solution.

NOTE: Each correct selection is worth one point.

A. Purchase Azure Reserved Virtual Machine Instances for the Azure virtual machines
B. Create a virtual machine scale set that uses autoscaling
C. Configure a spending limit in the Azure account center
D. Create a lab in Azure DevTest Labs and place the Azure virtual machines in the lab
E. Activate Azure Hybrid Benefit for the Azure virtual machines

Correct Answer: AE
Section: (none)
Explanation

Explanation/Reference:
Explanation:
A: With Azure Reserved VM Instances (RIs) you reserve virtual machines in advance and save up to 80
percent.

E: For customers with Software Assurance, Azure Hybrid Benefit for Windows Suresh.Palani
Server allows you to use
2020-08-03 16:38:16
your on-premises Windows Server licenses and run Windows virtual machines on Azure at a reduced cost.
You can use Azure Hybrid Benefit for Windows Server to deploy new virtual--------------------------------------------
machines with Windows OS.
What is Application Insights?
Reference: Application Insights, a feature of Azure Monitor,
https://azure.microsoft.com/en-us/pricing/reserved-vm-instances/ isan extensible Application Performance
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/hybrid-use-benefit-licensing
Management (APM) service for developers
and DevOps professionals. Use it to monitor
QUESTION 5 your live applications. It will automatically
You have an on-premises Active Directory forest and an Azure Active Directory
detect(Azure AD) tenant.
performance All
anomalies, and includes
Azure AD users are assigned an Azure AD Premium P1 license. powerful analytics tools to help you diagnose
issues and to understand what users
You deploy Azure AD Connect.
actually do with your app. It's designed to
Which two features are available in this environment that can reduce operational overhead
help you for yourimprove performance
continuously
company’s help desk? Each correct answer presents part of the solution. and usability. It works for apps on a wide
variety of platforms including .NET, Node.js,
NOTE: Each correct selection is worth one point.
Java, and Python hosted on-premises,
hybrid, or any public cloud. It integrates with
A. Azure AD Privileged Identity Management policies
your DevOps process, and has connection
B. access reviews points to a variety of development tools. It
C. self-service password reset can monitor and analyze telemetry from
D. Microsoft Cloud App Security Conditional Access App Control mobile apps by integrating with Visual Studio
E. password writeback App Center. https://docs.microsoft.com/en-
us/azure/azure-monitor/app/app-insights-
Correct Answer: CE overview
Section: (none)
Explanation

Explanation/Reference:

QUESTION 6
You are planning the implementation of an order processing web service that will contain microservices
hosted in an Azure Service Fabric cluster.

You need to recommend a solution to provide developers with the ability to proactively identify and fix
performance issues. The developers must be able to simulate user connections to the order processing
web service from the Internet, as well as simulate user transactions. The developers must be notified if the
goals for the transaction response times are not met.

What should you include in the recommendation?

A. container health
B. Azure Network Watcher
C. Application Insights
D. Service Fabric Analytics

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 7
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager
resource deployments in your subscription.

What should you include in the recommendation?

A. Azure Analysis Services

B. Azure Activity Log
C. the Change Tracking management solution
D. Azure Monitor metrics

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't
more than 90 days in the past.

Through activity logs, you can determine:

what operations were taken on the resources in your subscription

who started the operation
when the operation occurred
the status of the operation
the values of other properties that might help you research the operation
The Azure Activity Log provides insight into subscription-level events that have occurred in Azure. This
includes a range of data, from Azure Resource Manager operational data to updates on Service Health
events.

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't
more than 90 days in the past.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit

QUESTION 8
HOTSPOT

You have an Azure App Service Web App that includes Azure Blob storage and an Azure SQL Database
instance. The application is instrumented by using the Application Insights SDK.

You need to design a monitoring solution for the web app.

Which Azure monitoring services should you use? To answer, select the appropriate Azure monitoring
services in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:
Azure Monitor Logs
Azure Service Map
Azure Application Insights
Azure Application Insights

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Note: You can select Logs from either the Azure Monitor menu or the Log Analytics workspaces menu.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/log-query-overview

QUESTION 9
DRAG DROP

You have an Azure Active Directory (Azure AD) tenant. All user accounts are synchronized from an on-
premises Active Directory domain and are configured for federated authentication. Active Directory
Federation Services (AD FS) servers are published for external connections by using a farm of Web
Application Proxy servers.

You need to recommend a solution to monitor the servers that integrate with Azure AD. The solution must
meet the following requirements:

Identify any AD FS issues and their potential resolutions.

Identify any directory synchronization configuration issues and their potential resolutions
Notify administrators when there are any issues affecting directory synchronization or AD FS operations.

Which monitoring solution should you recommend for each server type? To answer, drag the appropriate
monitoring solutions to the correct server types. Each monitoring solution may be used once, more than
once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 10
You plan to deploy 200 Microsoft SQL Server databases to Azure by using Azure SQL Database and Azure
SQL Database Managed Instance.

You need to recommend a monitoring solution that provides a consistent monitoring approach for all
deployments. The solution must meet the following requirements:

Support current-state analysis based on metrics collected near real-time, multiple times per minute, and
maintained for up to one hour
Support longer term analysis based on metrics collected multiple times per hour and maintained for up
 to two weeks.
Support monitoring of the number of concurrent logins and concurrent sessions.

What should you include in the recommendation?

A. dynamic management views

B. trace flags
C. Azure Monitor
D. SQL Server Profiler

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 11
DRAG DROP

You plan to move several apps that handle critical line-of-business (LOB) services to Azure.

Appropriate personnel must be notified if any critical resources become degraded or unavailable.

You need to design a monitoring and notification strategy that can handle up to 100 notifications per hour.

Which three actions should you recommend be performed in sequence? To answer, move the appropriate
actions from the list of actions to the answer area and arrange them in the correct order.

NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct
orders you select.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Step 1: Create a resource group containing the critical resources.

In step 2 the action group should be created within this Resource Group.

Step 2: Create an action group for alerts to email addresses.

You configure an action to notify a person by email or SMS, they receive a confirmation indicating they have
been added to the action group.

The rate limit thresholds are:

SMS: No more than 1 SMS every 5 minutes.
Voice: No more than 1 Voice call every 5 minutes.
Email: No more than 100 emails in an hour.

Step 3: Monitor service health for incidents and action required notifications
An action group is a collection of notification preferences defined by the owner of an Azure subscription.
Azure Monitor and Service Health alerts use action groups to notify users that an alert has been triggered.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting

QUESTION 12
DRAG DROP

You manage a solution in Azure.

The solution is performing poorly.

You need to recommend tools to determine causes for the performance issues.
What should you recommend? To answer, drag the appropriate monitoring solutions to the correct
scenarios. Each monitoring solution may be used once, more than once, or not at all. You may need to drag
the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Azure Monitor

Metrics in Azure Monitor are stored in a time-series database which is optimized for analyzing time-
stamped data. This makes metrics particularly suited for alerting and fast detection of issues.

Box 2: Azure Log Analytics

Log data collected by Azure Monitor is stored in a Log Analytics workspace, which is based on Azure Data
Explorer. Logs in Azure Monitor are especially useful for performing complex analysis across data from a
variety of sources.

Box 3: Azure Log Analytics

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform-logs

QUESTION 13
DRAG DROP

You have standard Load balancer configured to support three virtual machines on the same subnet.

You need to recommend a solution to notify administrators when the load balancer fails.

Which metrics should you recommend using to test the load balancer? To answer, drag the appropriate
metrics to the correct conditions. Each metric may be used once, more than once, or not at all. You may
need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Backend instance health: Health Probe Status

Health Probe Status (DIP Availability): Standard Load Balancer uses a distributed health-probing service
that monitors your application endpoint's health according to your configuration settings. This metric
provides an aggregate or per-endpoint filtered view of each instance endpoint in the load balancer pool.
You can see how Load Balancer views the health of your application, as indicated by your health probe
configuration.

Outbound port exhaustion: SNAT connection Count

SNAT connections: Standard Load Balancer reports the number of outbound flows that are masqueraded
to the Public IP address front end. Source network address translation (SNAT) ports are an exhaustible
resource. This metric can give an indication of how heavily your application is relying on SNAT for outbound
originated flows. Counters for successful and failed outbound SNAT flows are reported and can be used to
troubleshoot and understand the health of your outbound flows.

Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics

QUESTION 14
You are designing an Azure web app.

You need to ensure that users who have impaired vision can use the app.

Which reference material should you use when designing the app?
A. Accessibility in Windows Dev Center
B. Azure Application Architecture Guide
C. Web Content Accessibility Guidelines
D. Cloud Application Architecture Guide

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
How Microsoft integrates accessibility
Microsoft's obligation to accessibility is guided by three main principles: transparency, inclusivity and
accountability. In developing our products and services, we take into account leading global accessibility
standards, including:

EN 301 549
U.S. Section 508
Web Content Accessibility Guidelines (WCAG)

References:
https://www.microsoft.com/en-us/trust-center/compliance/accessibility

QUESTION 15
HOTSPOT

You have an Azure subscription that contains the Microsoft SQL servers shown in the following table.

The subscription contains the storage accounts shown in the following table.

You create the Azure SQL databases shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Yes
Be sure that the destination is in the same region as your database and server.

Box 2: No

Box 3: No

References:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing

QUESTION 16
HOTSPOT

You have an Azure subscription that contains the resources shown in the following table.

You create an Azure SQL database named DB1 that is hosted in the East US region.
To DB1, you add a diagnostic setting named Settings1. Settings1 archives SQLInsights to storage1 and
sends SQLInsights to Workspace1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selections is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: No
You archive logs only to Azure Storage accounts.

Box 2: Yes

Box 3: Yes
Sending logs to Event Hubs allows you to stream data to external systems such as third-party SIEMs and
other log analytics solutions.

Note: A single diagnostic setting can define no more than one of each of the destinations. If you want to
send data to more than one of a particular destination type (for example, two different Log Analytics
workspaces), then create multiple settings. Each resource can have up to 5 diagnostic settings.

References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

QUESTION 17
You have an Azure SQL database named DB1 that contains multiple tables.

You need to improve the performance of DB1. The solution must minimize administrative effort.

What should you use?

A. Azure Monitor
B. Azure Advisor
C. Query Performance Insight
D. automatic tuning
Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure SQL Database and Azure SQL Managed Instance automatic tuning provides peak performance and
stable workloads through continuous performance tuning based on AI and machine learning.

Automatic tuning is a fully managed intelligent performance service that uses built-in intelligence to
continuously monitor queries executed on a database, and it automatically improves their performance.

Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/automatic-tuning-overview

QUESTION 18
A company has a hybrid ASP.NET Web API application that is based on a software as a service (SaaS)
offering.

Users report general issues with the data. You advise the company to implement live monitoring and use ad
hoc queries on stored JSON data. You also advise the company to set up smart alerting to detect
anomalies in the data.

You need to recommend a solution to set up smart alerting.

What should you recommend?

A. Azure Security Center and Azure Data Lake Store

B. Azure Data Lake Analytics and Azure Monitor Logs
C. Azure Application Insights and Azure Monitor Logs
D. Azure Site Recovery and Azure Monitor Logs

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Application Insights, a feature of Azure Monitor, is an extensible Application Performance Management
(APM) service for developers and DevOps professionals. Use it to monitor your live applications. It will
automatically detect performance anomalies, and includes powerful analytics tools to help you diagnose
issues and to understand what users actually do with your app.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview
Design for Identity and Security

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Contoso, Ltd. is a US-based financial services company that has a main office in New York and a branch
office in San Francisco.

Existing Environment

Payment Processing System

Contoso hosts a business-critical payment processing system in its New York data center. The system has
three tiers: a front-end web app, a middle-tier web API, and a back-end data store implemented as a
Microsoft SQL Server 2014 database. All servers run Windows Server 2012 R2.

The front-end and middle-tier components are hosted by using Microsoft Internet Information Services (IIS).
The application code is written in C# and ASP.NET. The middle-tier API uses the Entity Framework to
communicate to the SQL Server database. Maintenance of the database is performed by using SQL Server
Agent jobs.

The database is currently 2 TB and is not expected to grow beyond 3 TB.

The payment processing system has the following compliance-related requirements:

Encrypt data in transit and at rest. Only the front-end and middle-tier components must be able to
access the encryption keys that protect the data store.
Keep backups of the data in two separate physical locations that are at least 200 miles apart and can be
restored for up to seven years.
Support blocking inbound and outbound traffic based on the source IP address, the destination IP
address, and the port number.
Collect Windows security logs from all the middle-tier servers and retain the logs for a period of seven
years.
Inspect inbound and outbound traffic from the front-end tier by using highly available network
appliances.
Only allow all access to all the tiers from the internal network of Contoso.

Tape backups are configured by using an on-premises deployment of Microsoft System Center Data
Protection Manager (DPM), and then shipped offsite for long term storage.
Historical Transaction Query System

Contoso recently migrated a business-critical workload to Azure. The workload contains a .NET web
service for querying the historical transaction data residing in Azure Table Storage. The .NET web service
is accessible from a client app that was developed in-house and runs on the client computers in the New
York office. The data in the table storage is 50 GB and is not expected to increase.

Current Issues

The Contoso IT team discovers poor performance of the historical transaction query system, at the queries
frequently cause table scans.

Requirements

Planned Changes

Contoso plans to implement the following changes:

Migrate the payment processing system to Azure.

Migrate the historical transaction data to Azure Cosmos DB to address the performance issues.

Migration Requirements

Contoso identifies the following general migration requirements:

Infrastructure services must remain available if a region or a data center fails. Failover must occur
without any administrative intervention.
Whenever possible, Azure managed services must be used to minimize management overhead.
Whenever possible, costs must be minimized.

Contoso identifies the following requirements for the payment processing system:

If a data center fails, ensure that the payment processing system remains available without any
administrative intervention. The middle-tier and the web front end must continue to operate without any
additional configurations.
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.
Minimize the effort required to modify the middle-tier API and the back-end tier of the payment
processing system.
Payment processing system must be able to use grouping and joining tables on encrypted columns.
Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
Ensure that the payment processing system preserves its current compliance status.
Host the middle tier of the payment processing system on a virtual machine.

Contoso identifies the following requirements for the historical transaction query system:

Minimize the use of on-premises infrastructure services.

Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
Minimize the frequency of table scans.
If a region fails, ensure that the historical transaction query system remains available without any
administrative intervention.

Information Security Requirements

The IT security team wants to ensure that identity management is performed by using Active Directory.
Password hashes must be stored on-premises only.

Access to all business-critical systems must rely on Active Directory credentials. Any suspicious
authentication attempts must trigger a multi-factor authentication prompt automatically. Legitimate users
must be able to authenticate successfully by using multi-factor authentication.

QUESTION 1
HOTSPOT
You need to recommend a solution for configuring the Azure Multi-Factor Authentication (MFA) settings.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Premium 1
Azure AD Premium P1 - is an enterprise level edition which provides identity management for on-premise
users, remote users and hybrid users accessing applications both locally and over the cloud.

Incorrect:
Not Premium 2: PIM not required. Azure AD Premium P2 - is an edition includes all of the features of Azure
AD Premium P1 with the addition of Identity Protection and Privileged Identity Management (PIM).
Box 2: Allow access and require multi-factor authentication
Azure Multi-Factor Authentication provides a means to verify who you are using more than just a username
and password. It provides a second layer of security to user sign-ins.

Box 3: Allow access and require authentication registration

In order for users to be able to respond to MFA prompts, they must first register for Azure Multi-Factor
Authentication.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-mfa-policy

QUESTION 2
HOTSPOT

You need to design a solution for securing access to the historical transaction data.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 3
HOTSPOT

You need to recommend a solution for the users at Contoso to authenticate to the cloud-based services
and the Azure AD-integrated applications.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

Design for Identity and Security

Testlet 2

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main
office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment

Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There
are no trust relationships between the forests.

Corp.fabrikam.com is a production forest that contains identities used for internal user and computer
authentication.
Rd.fabrikam.com is used by the research and development (R&D) department only.

Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office
contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the Internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is
used by customers to place and track orders.

WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that
runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that
run on Hyper-V.

The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software
Assurance.

Problem Statements
The use of Web App1 is unpredictable. At peak times, users often report delays. At other times, many
resources for WebApp1 are underutilized.

Requirements

Planned Changes

Fabrikam plans to move most of its production workloads to Azure during the next few years.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming
Microsoft Office 365 deployment.

All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements

Fabrikam identifies the following technical requirements:

Web site content must be easily updated from a single point.

User input must be minimized when provisioning new app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the directory
synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not
be affected by a link failure between Azure and the on-premises network.

Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the
 company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 1
What should you include in the identity management strategy to support the planned changes?

A. Move all the domain controllers from corp.fabrikam.com to virtual networks in Azure.
B. Deploy domain controllers for corp.fabrikam.com to virtual networks in Azure.
C. Deploy a new Azure AD tenant for the authentication of new R&D projects.
D. Deploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.
Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be
affected by a link failure between Azure and the on-premises network. (This requires domain controllers in
Azure)
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails. (This requires domain controllers on-premises)

QUESTION 2
HOTSPOT

To meet the authentication requirements of Fabrikam, what should you include in the solution? To answer,
select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:
Answer is 1,1,0

Section: (none)
Explanation

Explanation/Reference:
Design for Identity and Security

Question Set 3

QUESTION 1
You have an Azure subscription.

You need to recommend a solution to provide developers with the ability to provision Azure virtual
machines. The solution must meet the following requirements:

Only allow the creation of the virtual machines in specific regions.

Only allow the creation of specific sizes of virtual machines.

What should include in the recommendation?

A. conditional access policies

B. Azure Policy
C. Azure Resource Manager templates
D. role-based access control (RBAC)

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
HOTSPOT

Your company has 20 web APIs that were developed in-house.

The company is developing 10 web apps that will use the web APIs. The web apps and the APIs are
registered in the company’s Azure Active Directory (Azure AD) tenant. The web APIs are published by using
Azure API Management.

You need to recommend a solution to block unauthorized requests originating from the web apps from
reaching the web APIs. The solution must meet the following requirements:

Use Azure AD-generated claims.

Minimize configuration and management effort.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Suresh.Palani
2020-08-03 19:59:51
Ans : Azure AD & Azure API Management --------------------------------------------
Q2: Answer
Box1: see p.3 below. It refers to Azure AD, so
theanswer is Azure AD
Box2: See p.5 and it talks about configuring
policyin API Management, so the answer is API
Management. Here is how you protect API
with Azure AD
Section: (none) 1) Register an application (backend-app) in
Explanation AzureADto represent the API.
2) Register another application (client-app)
Explanation/Reference:
in A u
z
reAD to represent a client application that
needs to call the API. 3) In Azure AD, grant
QUESTION 3 permissions to allow the client-app to call the
HOTSPOT backend-app.
4) Configure the Developer Console to call the
APIusing OAuth 2.0 user authorization. 5) Add
You are designing an access policy for the sales department at your company.
the validate-jwt policy to validate the OAuth
Occasionally, the developers at the company must stop, start, and restart
tokenAzure virtual
for every machines.
incoming The
request.
development team changes often.
ref: htps:/docs.microsoft.com/en-us/azure/ap-imanagement/api-management-howto-protect-backend-with-
You need to recommend a solution to provide the developers with the required access to the virtual
machines. The solution must meet the following requirements:
aad
Provide permissions only when needed.
Use the principle of least privilege.
Minimize costs.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 4
Your network contains an on-premises Active Directory forest.

You discover that when users change jobs within your company, the membership of the user groups are not
being updated. As a result, the users can access resources that are no longer relevant to their job.

You plan to integrate Active Directory and Azure Active Directory (Azure AD) by using Azure AD Connect.

You need to recommend a solution to ensure that group owners are emailed monthly about the group
memberships they manage.

What should you include in the recommendation?

A. Azure AD access reviews

B. Tenant Restrictions
C. Azure AD Identity Protection
D. conditional access policies

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

QUESTION 5
HOTSPOT

You are designing a software as a service (SaaS) application that will enable Azure Active Directory (Azure
AD) users to create and publish surveys. The SaaS application will have a front-end web app and a back-
end web API. The web app will rely on the web API to handle updates to customer surveys.

You need to design an authorization flow for the SaaS application. The solution must meet the following
requirements:

To access the back-end web API, the web app must authenticate by using OAuth 2 bearer tokens.
The web app must authenticate by using the identities of individual users.

What should you include in the solution? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/lb-lu/azure/architecture/multitenant-identity/web-api

https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-v1-dotnet-webapi

QUESTION 6
HOTSPOT

You have five .NET Core applications that run on 10 Azure virtual machines in the same subscription.

You need to recommend a solution to ensure that the applications can authenticate by using the same
Azure Active Directory (Azure AD) identity. The solution must meet the following requirements:

Ensure that the applications can authenticate only when running on the 10 virtual machines.
Minimize administrative effort.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Answer-

1) User-assigned Managed Identity

2) An Azure Instance Metadata Service Identity

QUESTION 7
A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with
Microsoft Office 365 and an Azure subscription.

Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active
Directory Domain Services (AD DS), Active Directory Federation Services (AD FS), Azure AD Connect, and
Microsoft Identity Manager (MIM).

Contoso has a partnership with a company named Fabrikam, Inc. Fabrikam has an Active Directory forest
and an Office 365 tenant. Fabrikam has the same on-premises identity infrastructure as Contoso.
A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure
subscription of Contoso. The developers must be added to the Contributor role for a resource group in the
Contoso subscription.

You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam
developers. The solution must ensure that the Fabrikam developers use their existing credentials to access
resources.

What should you recommend?

A. Configure an AD FS claims provider trust between the AD FS infrastructures of Fabrikam and Contoso.
B. In the Azure AD tenant of Contoso, enable Azure Active Directory Domain Services (Azure AD DS).
Create a one-way forest trust that uses selective authentication between the Active Directory forests of
Contoso and Fabrikam.
C. In the Azure AD tenant of Contoso, create guest accounts for the Fabrikam developers.
D. In the Azure AD tenant of Contoso, create cloud-only user accounts for the Fabrikam developers.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Trust configurations - Configure trust from managed forests(s) or domain(s) to the administrative forest
A one-way trust is required from production environment to the admin forest.
Selective authentication should be used to restrict accounts in the admin forest to only logging on to the
appropriate production hosts.

Reference:
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-
access-reference-material

QUESTION 8
You have a hybrid deployment of Azure Active Directory (Azure AD).

You need to recommend a solution to ensure that the Azure AD tenant can be managed only from the
computers on your on-premises network.

What should you include in the recommendation?

A. Azure AD roles and administrators

B. a conditional access policy
C. Azure AD Application Proxy
D. Azure AD Privileged Identity Management

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 9
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains two administrative
user accounts named Admin1 and Admin2.

You create two Azure virtual machines named VM1 and VM2.

You need to ensure that Admin1 and Admin2 are notified when more than five events are added to the
security log of VM1 or VM2 during a period of 120 seconds. The solution must minimize administrative
tasks.
What should you create?

A. two action groups and one alert rule

B. one action group and one alert rule
C. five action groups and one alert rule
D. two action groups and two alert rules

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 10
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains several
administrative user accounts.

You need to recommend a solution to identify which administrative user accounts have NOT signed in
during the previous 30 days.

Which service should you include in the recommendation?

A. Azure AD Identity Protection

B. Azure Activity Log
C. Azure Advisor
D. Azure AD Privileged Identity Management (PIM)

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 11
HOTSPOT

Your organization has developed and deployed several Azure App Service Web and API applications. The
applications use Azure Key Vault to store several authentication, storage account, and data encryption
keys. Several departments have the following requests to support the applications:
You need to recommend the appropriate Azure service for each department request.

What should you recommend? To answer, configure the appropriate options in the dialog box in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 12
You manage a single-domain, on-premises Active Directory forest named contoso.com. The forest
functional level is Windows Server 2016.

You have several on-premises applications that depend on Active Directory.

You plan to migrate the applications to Azure.

You need to recommend an identity solution for the applications. The solution must meet the following
requirements:

Eliminate the need for hybrid network connectivity.

Minimize management overhead for Active Directory.

What should you recommend?

A. In Azure, deploy an additional child domain to the contoso.com forest.

B. In Azure, deploy additional domain controllers for the contoso.com domain.
C. Implement a new Active Directory forest in Azure.
D. Implement Azure Active Directory Domain Services (Azure AD DS).

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 13
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in
the Project1 subscription. The Project1 subscription contains all the resources for an application named
Application1.

Your company is developing a new application named Application2. The members of the Application2
development team belong to an Azure Active Directory (Azure AD) group named App2Dev.

You identify the following requirements for Application2:

The members of App2Dev must be prevented from changing the role assignments in Azure.
The members of App2Dev must be able to create new Azure resources required by Application2.
All the required role assignments for Application2 will be performed by the members of Project1admins.

You need to recommend a solution for the role assignments of Application2.

Solution: In Project1, create a network security group (NSG) named NSG1. Assign Project1admins the
Owner role for NSG1. Assign App2Dev the Contributor role for NSG1.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You should use a separate subscription for Project2.

QUESTION 14
HOTSPOT

You manage a network that includes an on-premises Active Directory Domain Services domain and an
Azure Active Directory (Azure AD).

Employees are required to use different accounts when using on-premises or cloud resources. You must
recommend a solution that lets employees sign in to all company resources by using a single account. The
solution must implement an identity provider.

You need to provide guidance on the different identity providers.

How should you describe each identity provider? To answer, select the appropriate description from each
list in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box1: User management occurs on-premises. Azure AD authenticates employees by using on-premises
passwords.

Azure AD Domain Services for hybrid organizations

Organizations with a hybrid IT infrastructure consume a mix of cloud resources and on-premises resources.
Such organizations synchronize identity information from their on-premises directory to their Azure AD
tenant. As hybrid organizations look to migrate more of their on-premises applications to the cloud,
especially legacy directory-aware applications, Azure AD Domain Services can be useful to them.

Example: Litware Corporation has deployed Azure AD Connect, to synchronize identity information from
their on-premises directory to their Azure AD tenant. The identity information that is synchronized includes
user accounts, their credential hashes for authentication (password hash sync) and group memberships.
User accounts, group memberships, and credentials from Litware's on-premises directory are synchronized
to Azure AD via Azure AD Connect. These user accounts, group memberships, and credentials are
automatically available within the managed domain.

Box 2: User management occurs on-premises. The on-promises domain controller authenticates employee
credentials.
You can federate your on-premises environment with Azure AD and use this federation for authentication
and authorization. This sign-in method ensures that all user authentication occurs on-premises.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-overview

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed
QUESTION 15
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription that contains a resource group named RG1.

You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user
accounts of all researchers.

You need to recommend a solution that meets the following requirements:

The researchers must be allowed to create Azure virtual machines.

The researchers must only be able to create Azure virtual machines by using specific Azure Resource
Manager templates.

Solution: On RG1, assign a custom role-based access control (RBAC) role to the ResearchUsers group.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy
definition and assign the policy to RG1.

QUESTION 16
A company deploys Azure Active Directory (Azure AD) Connect to synchronize identity information from
their on-premises Active Directory Domain Services (AD DS) directory to their Azure AD tenant. The identity
information that is synchronized includes user accounts, credential hashes for authentication (password
sync), and group memberships. The company plans to deploy several Windows and Linux virtual machines
(VMs) to support their applications.

The VMs have the following requirements:

Support domain join, LDAP read, LDAP bind, NTLM and Kerberos authentication, and Group Policy.
Allow users to sign in to the domain using their corporate credentials and connect remotely to the VM by
using Remote Desktop.

You need to support the VM deployment.

Which service should you use?

A. Azure AD Domain Services

B. Azure AD Privileged Identity Management
C. Azure Managed Identity
D. Active Directory Federation Services (AD FS)

Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
Explanation:
Azure AD Domain Services provides managed domain services such as domain join, group policy, LDAP,
Kerberos/NTLM authentication that are fully compatible with Windows Server Active Directory.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-overview

QUESTION 17
DRAG DROP

A company has an existing web application that runs on virtual machines (VMs) in Azure.

You need to ensure that the application is protected from SQL injection attempts and uses a layer-7 load
balancer. The solution must minimize disruption to the code for the existing web application.

What should you recommend? To answer, drag the appropriate values to the correct items. Each value
may be used once, more than once, or not at all. You may need to drag the split bar between panes or
scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Azure Application Gateway

Azure Application Gateway provides an application delivery controller (ADC) as a service. It offers various
layer 7 load-balancing capabilities for your applications.

Box 2: Web Application Firwewall (WAF)

Application Gateway web application firewall (WAF) protects web applications from common vulnerabilities
and exploits.
This is done through rules that are defined based on the OWASP core rule sets 3.0 or 2.2.9.
There are rules that detects SQL injection attacks.

Reference:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

https://docs.microsoft.com/en-us/azure/application-gateway/waf-overview

QUESTION 18
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure
ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

Several VMs are exhibiting network connectivity issues.

You need to analyze the network traffic to determine whether packets are being allowed or denied to the
VMs.

Solution: Use the Azure traffic analytics solution in Azure Log Analytics to analyze the network traffic.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

QUESTION 20
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure
ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

Several VMs are exhibiting network connectivity issues.

You need to analyze the network traffic to determine whether packets are being allowed or denied to the
VMs.

Solution: Install and configure the Log Analytics and Dependency Agents on all VMs. Use the Wire Data
solution in Azure Log Analytics to analyze the network traffic.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

QUESTION 21
HOTSPOT

A company plans to implement an HTTP-based API to support a web app. The web app allows customers
to check the status of their orders.

The API must meet the following requirements:

Implement Azure Functions

Provide public read-only operations
Do not allow write operations

You need to recommend configuration options.

What should you recommend? To answer, configure the appropriate options in the dialog box in the answer
area.
NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Allowed authentication methods: GET only

Authorization level: Anonymous

The option is Allow Anonymous requests. This option turns on authentication and authorization in App
Service, but defers authorization decisions to your application code. For authenticated requests, App
Service also passes along authentication information in the HTTP headers.

This option provides more flexibility in handling anonymous requests.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization

QUESTION 22
Your network contains an on-premises Active Directory forest named contoso.com. The forest is synced to
an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure AD Domain Services
(Azure AD DS) domain named contoso-aad.com.

You have an Azure Storage account named Storage1 that contains a file share named Share1.

You configure NTFS permissions on Share1. You plan to deploy a virtual machine that will be used by
several users to access Share1.

You need to ensure that the users can access Share1.

Which type virtual machine should you deploy?

A. a virtual machine that runs Windows Server 2016 and is joined to the contoso.com domain
B. a virtual machine that runs Windows 10 and is joined to the contoso-add.com domain
C. a virtual machine that runs Windows 10 and is hybrid Azure AD joined to the contoso.com domain
D. an Azure virtual machine that runs Windows Server 2016 and is joined to the contoso-add.com domain

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You join the Windows Server virtual machine to the Azure AD DS-managed domain, here named contoso-
aad.com.

Note: Azure Files supports identity-based authentication over SMB (Server Message Block) (preview)
through Azure Active Directory (Azure AD) Domain Services. Your domain-joined Windows virtual
machines (VMs) can access Azure file shares using Azure AD credentials.

Incorrect Answers:
B, C: Azure AD authentication over SMB is not supported for Linux VMs for the preview release. Only
Windows Server VMs are supported.

Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-enable#mount-a-file-
share-from-a-domain-joined-vm

QUESTION 23
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises data center and an Azure subscription. The on-premises data center
contains a Hardware Security Module (HSM).

Your network contains an Active Directory domain that is synchronized to an Azure Active Directory (Azure
AD) tenant.

The company is developing an application named Application1. Application1 will be hosted in Azure by
using 10 virtual machines that run Windows Server 2016. Five virtual machines will be in the West Europe
Azure region and five virtual machines will be in the East US Azure region. The virtual machines will store
sensitive company information. All the virtual machines will use managed disks.

You need to recommend a solution to encrypt the virtual machine disks by using BitLocker Drive Encryption
(BitLocker).

Solution: Deploy one Azure Key Vault to each region. Create two Azure AD service principals. Configure the
virtual machines to use Azure Disk Encryption and specify a different service principal for the virtual
machines in each region.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You would also have to import Import the security keys from the HSM into each Azure key vault.

Reference:
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites-aad

QUESTION 24
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises data center and an Azure subscription. The on-premises data center
contains a Hardware Security Module (HSM).

Your network contains an Active Directory domain that is synchronized to an Azure Active Directory (Azure
AD) tenant.

The company is developing an application named Application1. Application1 will be hosted in Azure by
using 10 virtual machines that run Windows Server 2016. Five virtual machines will be in the West Europe
Azure region and five virtual machines will be in the East US Azure region. The virtual machines will store
sensitive company information. All the virtual machines will use managed disks.

You need to recommend a solution to encrypt the virtual machine disks by using BitLocker Drive Encryption
(BitLocker).

Solution: Export a security key from the on-premises HSM. Create one Azure AD service principal.
Configure the virtual machines to use Azure Storage Service Encryption.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
We use the Azure Premium Key Vault with Hardware Security Modules (HSM) backed keys.
The Key Vault has to be in the same region as the VM that will be encrypted.

Reference:
https://www.ciraltos.com/azure-disk-encryption-v2/

QUESTION 25
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
 have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises data center and an Azure subscription. The on-premises data center
contains a Hardware Security Module (HSM).

Your network contains an Active Directory domain that is synchronized to an Azure Active Directory (Azure
AD) tenant.

The company is developing an application named Application1. Application1 will be hosted in Azure by
using 10 virtual machines that run Windows Server 2016. Five virtual machines will be in the West Europe
Azure region and five virtual machines will be in the East US Azure region. The virtual machines will store
sensitive company information. All the virtual machines will use managed disks.

You need to recommend a solution to encrypt the virtual machine disks by using BitLocker Drive Encryption
(BitLocker).

Solution:
Deploy one Azure Key Vault to each region
Export two security keys from the on-premises HSM
Import the security keys from the HSM into each Azure Key Vault
Create two Azure AD service principals
Configure the virtual machines to use Azure Disk Encryption
Specify a different service principal for the virtual machines in each region

Does this meet the goal?

A. Yes
B. No

Correct Answer: A --
Section: (none)
Explanation
Checked this in exam topic
Explanation/Reference:
Explanation:
Instead of specifying a different service principal for the virtual machines in each region, use a different Key
Vault for encrypting virtual machine disks in each region.

Note:
We use the Azure Premium Key Vault with Hardware Security Modules (HSM) backed keys.
The Key Vault has to be in the same region as the VM that will be encrypted.

Note: If you want to use a key encryption key (KEK) for an additional layer of security for encryption keys,
add a KEK to your key vault. Use the Add-AzKeyVaultKey cmdlet to create a key encryption key in the key
vault. You can also import a KEK from your on-premises key management HSM.

Reference:
https://www.ciraltos.com/azure-disk-encryption-v2/

https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites-aad

QUESTION 26
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure
ExpressRoute has been deployed and configured for on-premises to Azure connectivity.
Several VMs are exhibiting network connectivity issues.

You need to analyze the network traffic to determine whether packets are being allowed or denied to the
VMs.

Solution: Use the Azure Advisor to analyze the network traffic.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Note: Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure
deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions
that can help you improve the cost effectiveness, performance, high availability, and security of your Azure
resources.

With Advisor, you can:

Get proactive, actionable, and personalized best practices recommendations.

Improve the performance, security, and high availability of your resources, as you identify opportunities to
reduce your overall Azure spend.
Get recommendations with proposed actions inline.

Reference:
https://docs.microsoft.com/en-us/azure/advisor/advisor-overview

QUESTION 27
Your network contains an Active Directory domain named contoso.com that is federated to an Azure Active
Directory (Azure AD) tenant. The on-premises domain contains a VPN server named Server1 that runs
Windows Server 2016.

You have a single on-premises location that uses an address space of 172.16.0.0/16.

You need to implement two-factor authentication for users who establish VPN connections to Server1.

What should you include in the implementation?

A. In Azure AD, create a conditional access policy and a trusted named location
B. Install and configure Azure MFA Server on-premises
C. Configure an Active Directory Federation Services (AD FS) server on-premises
D. In Azure AD, configure the authentication methods. From the multi-factor authentication (MFA) service
settings, create a trusted IP range

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Answer is A as per the exam topic
Reference:
https://www.examtopics.com/discussions/microsoft/view/9832-exam-az-301-topic-2-question-35-discussion/
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfaserver-deploy
QUESTION 28
HOTSPOT

You configure the Diagnostics settings for an Azure SQL database as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 29
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises Active Directory Domain Services (AD DS) domain and an established
Azure Active Directory (Azure AD) environment.

Your company would like users to be automatically signed in to cloud apps when they are on their corporate
desktops that are connected to the corporate network.

You need to enable single sign-on (SSO) for company users.

Solution: Install and configure an Azure AD Connect server to use password hash synchronization and
select the Enable single sign-on option.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 30
You have an Azure subscription that contains a custom application named Application1. Application1 was
developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-
based access control (RBAC) permissions to the Application1 components. All users are licensed for the
Microsoft 365 E5 plan.

You need to recommend a solution to verify whether the Fabrikam developers still require permissions to
Application1. The solution must meet the following requirements:

To the manager of the developers, send a monthly email message that lists the access permissions to
Application1.
If the manager does not verify an access permission, automatically revoke that permission.
Minimize development effort.

What should you recommend?

A. In Azure Active Directory (AD) Privileged Identity Management, create a custom role assignment for the
Application1 resources
B. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet
C. Create an Azure Automation runbook that runs the Get-AzureRmRoleAssignment cmdlet
D. In Azure Active Directory (Azure AD), create an access review of Application1

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 31
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises Active Directory Domain Services (AD DS) domain and an established
Azure Active Directory (Azure AD) environment.

Your company would like users to be automatically signed in to cloud apps when they are on their corporate
desktops that are connected to the corporate network.

You need to enable single sign-on (SSO) for company users.

Solution: Install and configure an Azure AD Connect server to use pass-through authentication and select
the Enable single sign-on option.
Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 32
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises Active Directory Domain Services (AD DS) domain and an established
Azure Active Directory (Azure AD) environment.

Your company would like users to be automatically signed in to cloud apps when they are on their corporate
desktops that are connected to the corporate network.

You need to enable single sign-on (SSO) for company users.

Solution: Configure an AD DS server in an Azure virtual machine (VM). Configure bidirectional replication.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 33
HOTSPOT

You are building an application that will run in a virtual machine (VM). The application will use Azure
Managed Identity.

The application uses Azure Key Vault, Azure SQL Database, and Azure Cosmos DB.

You need to ensure the application can use secure credentials to access these services.

Which authorization methods should you recommend? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
 Correct Answer:
RBAC, RBAC and HMAC is the answer

Section: (none)
Explanation

Explanation/Reference:
Explanation: checked in exam topic as well

Note: Managed identities for Azure resources is the new name for the service formerly known as Managed
Service Identity (MSI).

Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/
overview

QUESTION 34
You are designing a security solution for a company’s Azure Active Directory (Azure AD). The company
currently uses Azure AD Premium for all employees. Contractors will periodically access the corporate
network based on demand.

You must ensure that all employees and contractors are required to log on by using two-factor
authentication. The solution must minimize costs.
You need to recommend a solution.

What should you recommend?

A. Purchase Azure Multi-Factor Authentication licenses for the employees and the contractors
B. Use the Multi-Factor Authentication provider in Azure and configure the usage model for each
authentication type
C. Use the Multi-Factor Authentication provider in Azure and configure the usage model for each enabled
user
D. Purchase Azure Multi-Factor Authentication licenses for the contractors only

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 35
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains a group
named Group1. Group1 contains all the administrative user accounts.

You discover several login attempts to the Azure portal from countries where administrative users do NOT
work.

You need to ensure that all login attempts to the Azure portal from those countries require Azure Multi-
Factor Authentication (MFA).

Solution: Create an Access Review for Group1.

Does this solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 36
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains a group
named Group1. Group1 contains all the administrative user accounts.

You discover several login attempts to the Azure portal from countries where administrative users do NOT
work.
You need to ensure that all login attempts to the Azure portal from those countries require Azure Multi-
Factor Authentication (MFA).

Solution: You implement an access package.

Does this solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 37
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains a group
named Group1. Group1 contains all the administrative user accounts.

You discover several login attempts to the Azure portal from countries where administrative users do NOT
work.

You need to ensure that all login attempts to the Azure portal from those countries require Azure Multi-
Factor Authentication (MFA).

Solution: Implement Azure AD Privileged Identity Management.

Does this solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation answer
is No as per the exam
topic

Explanation/Reference:

QUESTION 38
Your company has several Azure subscriptions that are part of a Microsoft Enterprise Agreement.

The company’s compliance team creates automatic alerts by using Azure Monitor.

You need to recommend a solution to apply automatically recreate the alerts in the new Azure subscriptions
that are added to the Enterprise Agreement.

What should you include in the recommendation?

A. Azure Automation runbooks

B. Azure Log Analytics alerts
C. Azure Monitor action groups
D. Azure Resource Manager templates
E. Azure Policy

Correct Answer: E
Section: (none)
Explanation

Explanation/Reference:

QUESTION 39
You store web access logs data in Azure Blob storage.

You plan to generate monthly reports from the access logs.

You need to recommend an automated process to upload the data to Azure SQL Database every month.

What should you include in the recommendation?

A. Microsoft SQL Server Migration Assistant (SSMA)

B. Azure Data Factory
C. Data Migration Assistant
D. AzCopy

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 40
Your company has the offices shown in the following table.

The network contains an Active Directory domain named contoso.com that is synced to Azure Active
Directory (Azure AD).

All users connect to an application hosted in Microsoft 365.

You need to recommend a solution to ensure that all the users use Azure Multi-Factor Authentication (MFA)
to connect to the application from one of the offices.

What should you include in the recommendation?

A. a named location and two Microsoft Cloud App Security policies

B. a conditional access policy and two virtual networks
C. a virtual network and two Microsoft Cloud App Security policies
D. a conditional access policy and two named locations

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Conditional Access policies are at their most basic an if-then statement combining signals, to make
decisions, and enforce organization policies. One of those signals that can be incorporated into the
decision-making process is network location.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-
condition#named-locations

QUESTION 41
HOTSPOT

You have an Azure subscription that contains 300 Azure virtual machines that run Windows Server 2016.

You need to centrally monitor all warning events in the System logs of the virtual machines.

What should you include in the solutions? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agent-windows

QUESTION 42
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises Active Directory Domain Services (AD DS) domain and an established
Azure Active Directory (Azure AD) environment.

Your company would like users to be automatically signed in to cloud apps when they are on their corporate
desktops that are connected to the corporate network.

You need to enable single sign-on (SSO) for company users.

Solution: Install and configure an on-premises Active Directory Federation Services (AD FS) server with a
trust established between the AD FS server and Azure AD.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Seamless SSO is not applicable to Active Directory Federation Services (ADFS).
Instead install and configure an Azure AD Connect server.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso

QUESTION 43
You have an Azure subscription that contains several resource groups, including a resource group named
RG1. RG1 contains several business-critical resources.

A user named admin1 is assigned the Owner role to the subscription.

You need to prevent admin1 from modifying the resources in RG1. The solution must ensure that admin1
can manage the resources in the other resource groups.

What should you use?

A. a management group
B. an Azure policy
C. a custom role
D. an Azure blueprint

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Correct as per the exam topic

QUESTION 44
HOTSPOT

You deploy Azure service by using Azure Resources Manager templates. The template reference secrets
are stored in Azure key Vault.

You need to recommend a solution for accessing the secrets during deployments.

The solution must prevent the users who are performing the deployments from accessing the secrets in the
key vault directly.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: An advanced access policy for the key vaults

Enable template deployment
1. In the portal, select your Key Vault.
2. Select Access policies.
3. Select access policies
4. Select Click to show advanced access policies.
5. Show advanced access policies
6. Select Enable access to Azure Resource Manager for template deployment. Then, select Save.

Box 2: Role-based access control (RBAC)

In large teams you may have multiple people deploying resources but don’t want to give them access to the
actual secrets inside the vault. You can achieve this by creating a custom role that only gives access to the
KeyVault for deployment purposes. The deployment user cannot read the secrets within.

Reference:
https://docs.microsoft.com/bs-latn-ba/azure/managed-applications/key-vault-access

https://azurecto.com/azure-key-vault-custom-role-for-deployment/

QUESTION 45
DRAG DROP

A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that uses the Basic
license.

You plan to deploy two applications to Azure. The applications have the requirements shown in the
following table.

Which authentication strategy should you recommend for each application? To answer, drag the
appropriate authentication strategies to the correct applications. Each authentication strategy may be used
once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view
content.
NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Azure AD V2.0 endpoint

Microsoft identity platform is an evolution of the Azure Active Directory (Azure AD) developer platform. It
allows developers to build applications that sign in all Microsoft identities and get tokens to call Microsoft
APIs, such as Microsoft Graph, or APIs that developers have built. The Microsoft identity platform consists
of:

OAuth 2.0 and OpenID Connect standard-compliant authentication service that enables developers to
authenticate any Microsoft identity, including:
Work or school accounts (provisioned through Azure AD)
Personal Microsoft accounts (such as Skype, Xbox, and Outlook.com)
Social or local accounts (via Azure AD B2C)

Box 2: Azure AD B2C tenant

Azure Active Directory B2C provides business-to-customer identity as a service. Your customers use their
preferred social, enterprise, or local account identities to get single sign-on access to your applications and
APIs.
Azure Active Directory B2C (Azure AD B2C) integrates directly with Azure Multi-Factor Authentication so
that you can add a second layer of security to sign-up and sign-in experiences in your applications.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-mfa

https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview

QUESTION 46
HOTSPOT

You configure OAuth2 authorization in API Management as shown in the exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.
NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Web applications

The Authorization Code Grant Type is used by both web apps and native apps to get an access token after
a user authorizes an app.

Note: The Authorization Code grant type is used by confidential and public clients to exchange an
authorization code for an access token.

After the user returns to the client via the redirect URL, the application will get the authorization code from
the URL and use it to request an access token.

Answers:
Not Headless device authentication:
A headless system is a computer that operates without a monitor, graphical user interface (GUI) or
peripheral devices, such as keyboard and mouse.

Headless computers are usually embedded systems in various devices or servers in multi-server data
center environments. Industrial machines, automobiles, medical equipment, cameras, household
appliances, airplanes, vending machines and toys are among the myriad possible hosts of embedded
systems.

Box 2: Client Credentials

How to include additional client data
In case you need to store additional details about a client that don't fit into the standard parameter set the
custom data parameter comes to help:

POST /c2id/clients HTTP/1.1

Host: demo.c2id.com
Content-Type: application/json
Authorization: Bearer ztucZS1ZyFKgh0tUEruUtiSTXhnexmd6

{
"redirect_uris" : [ "https://myapp.example.com/callback" ],
"data" : { "reg_type" : "3rd-party",
"approved" : true,
"author_id" : 792440 }
}
The data parameter permits arbitrary content packaged in a JSON object. To set it you will need the master
registration token or a one-time access token with a client-reg:data scope.

Incorrect Answers:
Authorization protocols provide a state parameter that allows you to restore the previous state of your
application. The state parameter preserves some state object set by the client in the Authorization request
and makes it available to the client in the response.

Reference:
https://developer.okta.com/blog/2018/04/10/oauth-authorization-code-grant-type

https://connect2id.com/products/server/docs/guides/client-registration

QUESTION 47
A company has deployed several applications across Windows and Linux Virtual machines in Azure. Log
Analytics are being used to send the required data for alerting purposes for the Virtual Machines.

You need to recommend which tables need to be queried for security related queries.

Which of the following would you query for events from Windows Event Logs?

A. Azure Activity
B. Azure Diagnostics
C. Event
D. Syslog

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
This is also given in the Microsoft documentation, wherein you would use the Event Table for the queries on
events from Windows Virtual machines
Since this is clearly mentioned, all other options are incorrect
For more information on collecting event data from windows virtual machines, please go ahead and visit the
below URL.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-windows-events

QUESTION 48
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant contains a group
named Group1. Group1 contains all the administrative user accounts.

You discover several login attempts to the Azure portal from countries where administrative users do NOT
work.

You need to ensure that all login attempts to the Azure portal from those countries require Azure Multi-
Factor Authentication (MFA).

Solution: Implement Azure AD Identity Protection for Group1.

Does this solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead implement Azure AD Privileged Identity Management.

Note: Azure Active Directory (Azure AD) Privileged Identity Management (PIM) is a service that enables you
to manage, control, and monitor access to important resources in your organization.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure

QUESTION 49
You are designing a solution that will host 20 different web applications.
You need to recommend a solution to secure the web applications with a firewall that protects against
common web-based attacks including SQL injection, cross-site scripting attacks, and session hijacks. The
solution must minimize costs.

Which three Azure features should you recommend? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A. VPN Gateway
B. URL-based content routing
C. Multi-site routing
D. Web Application Firewall (WAF)
E. Azure ExpressRoute
F. Azure Application Gateway

Correct Answer:

Answer is C, D, F
B. Multi-site routing
C. Web Application Firewall (WAF)
F. Azure Application Gateway

QUESTION 50
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure
ExpressRoute has been deployed and configured for on-premises to Azure connectivity.

Several VMs are exhibiting network connectivity issues.

You need to analyze the network traffic to determine whether packets are being allowed or denied to the
VMs.

Solution: Install and configure the Microsoft Monitoring Agent and the Dependency Agent on all VMs. Use
the Wire Data solution in Azure Monitor to analyze the network traffic.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
Explanation:
Instead use Azure Network Watcher to run IP flow verify to analyze the network traffic.

Note: Wire Data looks at network data at the application level, not down at the TCP transport layer. The
solution doesn't look at individual ACKs and SYNs.

Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

QUESTION 51
A company has deployed several applications across Windows and Linux Virtual machines in Azure. Log
Analytics are being used to send the required data for alerting purposes for the Virtual Machines.

You need to recommend which tables need to be queried for security related queries.

Which of the following would you query for events from Linux system logging?

A. Azure Activity
B. Azure Diagnostics
C. Event
D. Syslog

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
This is also given in the Microsoft documentation, wherein you would use the Syslog Table for the queries
on events from Linux Virtual machines

Note: Syslog is an event logging protocol that is common to Linux. Applications will send messages that
may be stored on the local machine or delivered to a Syslog collector. When the Log Analytics agent for
Linux is installed, it configures the local Syslog daemon to forward messages to the agent. The agent then
sends the message to Azure Monitor where a corresponding record is created.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-sources-syslog

QUESTION 53
You have an Azure Active Directory (Azure AD) tenant named contoso.com that has a security group
named Group1. Group1 is configured for assigned membership. Group1 has 50 members, including 20
guest users.

You need to recommend a solution for evaluating the membership of Group1. The solution must meet the
following requirements:

The evaluation must be repeated automatically every three months.

Every member must be able to report whether they need to be in Group1.
Users who report that they do not need to be in Group1 must be removed from Group1 automatically
Users who do not report whether they need to be in Group1 must be removed from Group1
automatically.

What should you include in the recommendation?

A. Implement Azure AD Identity Protection.

B. Change the Membership type of Group1 to Dynamic User.
C. Create an access review.
D. Implement Azure AD Privileged Identity Management.

Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
Explanation:
In Azure Active Directory (Azure AD), you can create complex attribute-based rules to enable dynamic
memberships for groups. Dynamic group membership reduces the administrative overhead of adding and
removing users.

When any attributes of a user or device change, the system evaluates all dynamic group rules in a directory
to see if the change would trigger any group adds or removes. If a user or device satisfies a rule on a
group, they are added as a member of that group. If they no longer satisfy the rule, they are removed.

References:
https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership

QUESTION 54
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in
the Project1 subscription. The Project1 subscription contains all the resources for an application named
Application1.

Your company is developing a new application named Application2. The members of the Application2
development team belong to an Azure Active Directory (Azure AD) group named App2Dev.

You identify the following requirements for Application2:

The members of App2Dev must be prevented from changing the role assignments in Azure.
The members of App2Dev must be able to create new Azure resources required by Application2.
All the required role assignments for Application2 will be performed by the members of Project1admins.

You need to recommend a solution for the role assignments of Application2.

Solution: Create a new Azure subscription named Project2. Assign Project1admins the Owner role for the
Project2 subscription. Assign App2Dev the Contributor role for the Project2 subscription.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 55
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in
the Project1 subscription. The Project1 subscription contains all the resources for an application named
Application1.

Your company is developing a new application named Application2. The members of the Application2
development team belong to an Azure Active Directory (Azure AD) group named App2Dev.

You identify the following requirements for Application2:

 The members of App2Dev must be prevented from changing the role assignments in Azure.
The members of App2Dev must be able to create new Azure resources required by Application2.
All the required role assignments for Application2 will be performed by the members of Project1admins.

You need to recommend a solution for the role assignments of Application2.

Solution: Create a new Azure subscription named Project2. Assign Project1admins the User Access
Administrator role for the Project2 subscription. Assign App2Dev the Owner role for the Project2
subscription.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, assign Project1admins the Owner role for the Project2 subscription. Assign App2Dev the
Contributor role for the Project2 subscription.

QUESTION 56
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription named Project1. Only a group named Project1admins is assigned roles in
the Project1 subscription. The Project1 subscription contains all the resources for an application named
Application1.

Your company is developing a new application named Application2. The members of the Application2
development team belong to an Azure Active Directory (Azure AD) group named App2Dev.

You identify the following requirements for Application2:

The members of App2Dev must be prevented from changing the role assignments in Azure.
The members of App2Dev must be able to create new Azure resources required by Application2.
All the required role assignments for Application2 will be performed by the members of Project1admins.

You need to recommend a solution for the role assignments of Application2.

Solution: In Project1, create a resource group named Application2RG. Assign Project1admins the Owner
role for Application2RG. Assign App2Dev the Contributor role for Application2RG.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Yes seems correct as per the exam topic

QUESTION 57
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription that contains a resource group named RG1.

You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user
accounts of all researchers.
You need to recommend a solution that meets the following requirements:

The researchers must be allowed to create Azure virtual machines.

The researchers must only be able to create Azure virtual machines by using specific Azure Resource
Manager templates.

Solution: Create a lab in Azure DevTest Lab. Configure the DevTest Labs settings. Assign the DevTest
Labs User role to the ResearchUsers group.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy
definition and assign the policy to RG1.

QUESTION 58
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription that contains a resource group named RG1.

You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user
accounts of all researchers.

You need to recommend a solution that meets the following requirements:

The researchers must be allowed to create Azure virtual machines.

The researchers must only be able to create Azure virtual machines by using specific Azure Resource
Manager templates.

Solution: Create an Azure DevOps Project. Configure the DevOps Project settings.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy
definition and assign the policy to RG1.

QUESTION 60
You manage an Azure environment for a company. The environment has over 25,000 licensed users and
100 mission-critical applications.

You need to recommend a solution that provides advanced endpoint threat detection and remediation
strategies.

What should you recommend?

A. Azure Active Directory (Azure AD) authentication

B. Microsoft Identity Manager
C. Azure Active Directory Federation Services (AD FS)
D. Azure Active Directory (AZ AD) Connect
E. Azure Active Directory (Azure AD) Identity Protection

Correct Answer: E
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk
detections that might indicate that an identity has been compromised. Using this data, Identity Protection
generates reports and alerts so that you can investigate these risk detections and take appropriate
remediation or mitigation action.

References:
https://docs.microsoft.com/en-us/azure/security/fundamentals/threat-detection

QUESTION 61
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure subscription that contains a resource group named RG1.

You create an Azure Active Directory (Azure AD) group named ResearchUsers that contains the user
accounts of all researchers.

You need to recommend a solution that meets the following requirements:

The researchers must be allowed to create Azure virtual machines.

The researchers must only be able to create Azure virtual machines by using specific Azure Resource
Manager templates.

Solution: On RG1, assign the Contributor role to the ResearchUsers group. Create a custom Azure Policy
definition and assign the policy to RG1.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 62
A company named Contoso Ltd., has a single-domain Active Directory forest named contoso.com.
Contoso is preparing to migrate all workloads to Azure. Contoso wants users to use single sign-on (SSO)
when they access cloud-based services that integrate with Azure Active Directory (Azure AD).

You need to identify any objects in Active Directory that will fail to synchronize to Azure AD due to
formatting issues. The solution must minimize costs.

What should you include in the solution?

A. Azure Advisor
B. Microsoft Office 365 IdFix
C. Azure AD Connect Health
D. Password Export Server version 3.1 (PES v3.1) in Active Directory Migration Tool (ADMT)

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
QUESTION 63
HOTSPOT

Your company has an API that returns XML data to internal applications.

You plan to migrate the applications to Azure. You also plan to allow the company’s partners to access the
API.

You need to recommend an API management solution that meets the following requirements:

Internal applications must receive data in the JSON format once the applications migrate to Azure.
Partner applications must have their header information stripped before the applications receive the
data.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:
 Correct Answer:
Answer Box1 - 1 Box2 - 2 Box3 – 2

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-add-products

https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-policies

https://docs.microsoft.com/en-us/azure/api-management/transform-api

QUESTION 64
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises data center and an Azure subscription. The on-premises data center
contains a Hardware Security Module (HSM).

Your network contains an Active Directory domain that is synchronized to an Azure Active Directory (Azure
AD) tenant.

The company is developing an application named Application1. Application1 will be hosted in Azure by
using 10 virtual machines that run Windows Server 2016. Five virtual machines will be in the West Europe
Azure region and five virtual machines will be in the East US Azure region. The virtual machines will store
sensitive company information. All the virtual machines will use managed disks.

You need to recommend a solution to encrypt the virtual machine disks by using BitLocker Drive Encryption
(BitLocker).
Solution: Deploy one Azure Key Vault to each region. Configure virtual machines to use Azure Disk
Encryption. Use a different Key Vault for encrypting virtual machine disks in each region.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The security key from the on-premises HSM need to be exported.

Reference:
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites-aad

QUESTION 66
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises data center and an Azure subscription. The on-premises data center
contains a Hardware Security Module (HSM).

Your network contains an Active Directory domain that is synchronized to an Azure Active Directory (Azure
AD) tenant.

The company is developing an application named Application1. Application1 will be hosted in Azure by
using 10 virtual machines that run Windows Server 2016. Five virtual machines will be in the West Europe
Azure region and five virtual machines will be in the East US Azure region. The virtual machines will store
sensitive company information. All the virtual machines will use managed disks.

You need to recommend a solution to encrypt the virtual machine disks by using BitLocker Drive Encryption
(BitLocker).

Solution:
Deploy one Azure Key Vault to each region
Export two security keys from the on-premises HSM
Import the security keys from the HSM into each Azure Key Vault
Configure the virtual machines to use Azure Disk Encryption
Use a different Key Vault for encrypting virtual machine disks in each region

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
We use the Azure Premium Key Vault with Hardware Security Modules (HSM) backed keys.
The Key Vault has to be in the same region as the VM that will be encrypted.

Note: If you want to use a key encryption key (KEK) for an additional layer of security for encryption keys,
add a KEK to your key vault. Use the Add-AzKeyVaultKey cmdlet to create a key encryption key in the key
vault. You can also import a KEK from your on-premises key management HSM.
Reference:
https://www.ciraltos.com/azure-disk-encryption-v2/

https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-prerequisites-aad

QUESTION 68
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Your company has an on-premises Active Directory Domain Services (AD DS) domain and an established
Azure Active Directory (Azure AD) environment.

Your company would like users to be automatically signed in to cloud apps when they are on their corporate
desktops that are connected to the corporate network.

You need to enable single sign-on (SSO) for company users.

Solution: Install and configure an on-premises Active Directory Federation Services (AD FS) server and
establish federation with Azure AD.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Seamless SSO is not applicable to Active Directory Federation Services (ADFS).
Instead install and configure an Azure AD Connect server.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso
QUESTION 70
You have an Azure Active Directory (Azure AD) tenant.

You plan to deploy Azure Cosmos DB databases that will use the SQL API.

You need to recommend a solution to provide specific Azure AD user accounts with read access to the
Cosmos DB databases.

What should you include in the recommendation?

A. a resource token and an Access control (IAM) role assignment

B. shared access signatures (SAS) and conditional access policies
C. master keys and Azure Information Protection policies
D. certificates and Azure Key Vault

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The Access control (IAM) pane in the Azure portal is used to configure role-based access control on Azure
Cosmos resources. The roles are applied to users, groups, service principals, and managed identities in
Active Directory. You can use built-in roles or custom roles for individuals and groups. The following
screenshot shows Active Directory integration (RBAC) using access control (IAM) in the Azure portal:

Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/role-based-access-control
Design a Data Platform Solution

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Contoso, Ltd. is a US-based financial services company that has a main office in New York and a branch
office in San Francisco.

Existing Environment

Payment Processing System

Contoso hosts a business-critical payment processing system in its New York data center. The system has
three tiers: a front-end web app, a middle-tier web API, and a back-end data store implemented as a
Microsoft SQL Server 2014 database. All servers run Windows Server 2012 R2.

The front-end and middle-tier components are hosted by using Microsoft Internet Information Services (IIS).
The application code is written in C# and ASP.NET. The middle-tier API uses the Entity Framework to
communicate to the SQL Server database. Maintenance of the database is performed by using SQL Server
Agent jobs.

The database is currently 2 TB and is not expected to grow beyond 3 TB.

The payment processing system has the following compliance-related requirements:

Encrypt data in transit and at rest. Only the front-end and middle-tier components must be able to
access the encryption keys that protect the data store.
Keep backups of the data in two separate physical locations that are at least 200 miles apart and can be
restored for up to seven years.
Support blocking inbound and outbound traffic based on the source IP address, the destination IP
address, and the port number.
Collect Windows security logs from all the middle-tier servers and retain the logs for a period of seven
years.
Inspect inbound and outbound traffic from the front-end tier by using highly available network
appliances.
Only allow all access to all the tiers from the internal network of Contoso.

Tape backups are configured by using an on-premises deployment of Microsoft System Center Data
Protection Manager (DPM), and then shipped offsite for long term storage.
Historical Transaction Query System

Contoso recently migrated a business-critical workload to Azure. The workload contains a .NET web
service for querying the historical transaction data residing in Azure Table Storage. The .NET web service
is accessible from a client app that was developed in-house and runs on the client computers in the New
York office. The data in the table storage is 50 GB and is not expected to increase.

Current Issues

The Contoso IT team discovers poor performance of the historical transaction query system, at the queries
frequently cause table scans.

Requirements

Planned Changes

Contoso plans to implement the following changes:

Migrate the payment processing system to Azure.

Migrate the historical transaction data to Azure Cosmos DB to address the performance issues.

Migration Requirements

Contoso identifies the following general migration requirements:

Infrastructure services must remain available if a region or a data center fails. Failover must occur
without any administrative intervention.
Whenever possible, Azure managed services must be used to minimize management overhead.
Whenever possible, costs must be minimized.

Contoso identifies the following requirements for the payment processing system:

If a data center fails, ensure that the payment processing system remains available without any
administrative intervention. The middle-tier and the web front end must continue to operate without any
additional configurations.
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.
Minimize the effort required to modify the middle-tier API and the back-end tier of the payment
processing system.
Payment processing system must be able to use grouping and joining tables on encrypted columns.
Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
Ensure that the payment processing system preserves its current compliance status.
Host the middle tier of the payment processing system on a virtual machine.

Contoso identifies the following requirements for the historical transaction query system:

Minimize the use of on-premises infrastructure services.

Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
Minimize the frequency of table scans.
If a region fails, ensure that the historical transaction query system remains available without any
administrative intervention.

Information Security Requirements

The IT security team wants to ensure that identity management is performed by using Active Directory.
Password hashes must be stored on-premises only.

Access to all business-critical systems must rely on Active Directory credentials. Any suspicious
authentication attempts must trigger a multi-factor authentication prompt automatically. Legitimate users
must be able to authenticate successfully by using multi-factor authentication.

QUESTION 1
You need to recommend a solution for implementing the back-end tier of the payment processing system in
Azure.

What should you include in the recommendation?

A. an Azure SQL Database managed instance

B. a SQL Server database on an Azure virtual machine
C. an Azure SQL Database single database
D. an Azure SQL Database elastic pool

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
You need to recommend a solution for protecting the content of the payment processing system.

What should you include in the recommendation?

A. Transparent Data Encryption (TDE)

B. Azure Storage Service Encryption
C. Always Encrypted with randomized encryption
D. Always Encrypted with deterministic encryption

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:

QUESTION 3
HOTSPOT

You need to recommend a solution for the data store of the historical transaction query system.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Design a Data Platform Solution

Testlet 2

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main
office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment

Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There
are no trust relationships between the forests.

Corp.fabrikam.com is a production forest that contains identities used for internal user and computer
authentication.

Rd.fabrikam.com is used by their research and development (R&D) department only.

Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office
contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the Internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is
used by customers to place and track orders. WebApp1 has a web tier that uses Microsoft Internet
Information Services (IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the
database tier are deployed to virtual machines that run on Hyper-V.

The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software
Assurance.

Problem Statements

The use of WebApp1 is unpredictable. At peak times, users often report delays. At other times, many
resources for WebApp1 are underutilized.

Requirements

Planned Changes

Fabrikam plans to move most of its production workloads to Azure during the next few years.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming
Microsoft Office 365 deployment.

All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements

Fabrikam identifies the following technical requirements:

Web site content must be easily updated from a single point.

User input must be minimized when provisioning new web app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the directory
synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not
be affected by a link failure between Azure and the on-premises network.

Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the
company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 1
You need to recommend a data storage strategy for WebApp1.

What should you include in the recommendation?

A. a fixed-size DTU Azure SQL database

B. an Azure virtual machine that runs SQL Server
C. an Azure SQL Database elastic pool
D. a vCore-based Azure SQL database
Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Design a Data Platform Solution

Question Set 3

QUESTION 1
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that has four departments. Each department will deploy
several Azure app services and Azure SQL databases.

You need to recommend a solution to report the costs for each department to deploy the app services and
the databases. The solution must provide a consolidated view for cost reporting.

Solution: Create a resources group for each resource type. Assign tags to each resource group.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference: corrected as per that exam topic

Explanation:
Tags enable you to retrieve related resources from different resource groups. This approach is helpful when
you need to organize resources for billing or management.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

QUESTION 2
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that has four departments. Each department will deploy
several Azure app services and Azure SQL databases.

You need to recommend a solution to report the costs for each department to deploy the app services and
the databases. The solution must provide a consolidated view for cost reporting.

Solution: Place all resources in the same resource group. Assign tags to each resource.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation
 Explanation/Reference:
Answer is yes as per the exam topicExplanation:
Instead, create a resources group for each resource type. Assign tags to each resource

Note: Tags enable you to retrieve related resources from different resource groups. This approach is
helpful when you need to organize resources for billing or management.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

QUESTION 3
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that has four departments. Each department will deploy
several Azure app services and Azure SQL databases.

You need to recommend a solution to report the costs for each department to deploy the app services and
the databases. The solution must provide a consolidated view for cost reporting.

Solution: Create a new subscription for each department.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, create a resources group for each resource type. Assign tags to each resource

Note: Tags enable you to retrieve related resources from different resource groups. This approach is
helpful when you need to organize resources for billing or management.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

QUESTION 4
HOTSPOT

You plan to deploy logical Azure SQL Database servers to the East US Azure region and the West US
Azure region. Each server will contain 20 databases. Each database will be accessed by a different user
who resides in a different on-premises location. The databases will be configured to use active geo-
replication.

You need to recommend a solution that meets the following requirements:

Restricts user access to each database

Restricts network access to each database based on each user’s respective location
Ensures that the databases remain accessible from client applications if the local Azure region fails

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:
Answer-

Box 1 –
Transact-
SQL
Box 2 –
Transact-
SQL

Section: (none)
Explanation

Explanation/Reference:

QUESTION 5
You have an Azure subscription that contains 100 virtual machines.

You plan to design a data protection strategy to encrypt the virtual disks.

You need to recommend a solution to encrypt the disks by using Azure Disk Encryption. The solution must
provide the ability to encrypt operating system disks and data disks.

What should you include in the recommendation?

A. a passphrase
B. a certificate
C. a key
D. a secret

Correct Answer: C
Section: (none)
Explanation
Explanation/Reference:
Explanation:
For enhanced virtual machine (VM) security and compliance, virtual disks in Azure can be encrypted. Disks
are encrypted by using cryptographic keys that are secured in an Azure Key Vault. You control these
cryptographic keys and can audit their use.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/encrypt-disks

QUESTION 6
You deploy Azure App Service Web Apps that connect to on-premises Microsoft SQL Server instances by
using Azure ExpressRoute. You plan to migrate the SQL Server instances to Azure.

Migration of the SQL Server instances to Azure must:

Support automatic patching and version updates to SQL Server.

Provide automatic backup services.
Allow for high-availability of the instances.
Provide a native VNET with private IP addressing.
Encrypt all data in transit.
Be in a single-tenant environment with dedicated underlying infrastructure (compute, storage)

You need to migrate the SQL Server instances to Azure.

Which Azure service should you use?

A. Azure SQL Database with elastic pools

B. SQL Server in Docker containers running on Azure Kubernetes Service (AKS)
C. SQL Server Infrastructure-as-a-Service (IaaS) virtual machine (VM)
D. SQL Server in a Docker container running on Azure Container Instances (ACI)
E. Azure SQL Database Managed Instance

Correct Answer: E
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure SQL Database Managed Instance configured for Hybrid workloads. Use this topology if your Azure
SQL Database Managed Instance is connected to your on-premises network. This approach provides the
most simplified network routing and yields maximum data throughput during the migration.

Reference:
https://docs.microsoft.com/en-us/azure/dms/resource-network-topologies

QUESTION 7
You are designing an Azure Web App that includes many static content files.

The application is accessed from locations all over the world by using a custom domain name.

You need to recommend an approach for providing access to the static content with the least amount of
latency.

Which two actions should you recommend? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A. Configure a custom domain name that is an alias for the Azure Storage domain.
B. Configure a CNAME DNS record for the Azure Content Delivery Network (CDN) domain.
C. Place the static content in Azure Table storage.
D. Place the static content in Azure Blob storage and enable Content Delivery Network (CDN) on the
account.
Correct Answer: BD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
D: Add Azure Content Delivery Network (CDN) to a web app in Azure App Service.
B: When you use a CDN endpoint to deliver content, a custom domain is necessary if you would like your
own domain name to be visible in your CDN URL. Having a visible domain name can be convenient for your
customers and useful for branding purposes.
Create a CNAME DNS record, and associate the custom domain with your CDN endpoint.

Reference:
https://docs.microsoft.com/en-us/azure/cdn/cdn-map-content-to-custom-domain

https://docs.microsoft.com/en-us/azure/cdn/cdn-add-to-web-app

QUESTION 8
You are developing a sales application that will contain several Azure cloud services and will handle
different components of a transaction. Different cloud services will process customer orders, billing,
payment, inventory, and shipping.

You need to recommend a solution to enable the cloud services to asynchronously communicate
transaction information by using REST messages.

What would you include in the recommendation?

A. Azure Traffic Manager

B. Azure Data Lake
C. Azure Blob storage
D. Azure Service Bus
E. Azure Application Gateway

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Asynchronous messaging can be implemented in a variety of different ways. With queues, topics, and
subscriptions, Azure Service Bus supports asynchronism via a store and forward mechanism.

Reference:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-async-messaging

QUESTION 9
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that has four departments. Each department will deploy
several Azure app services and Azure SQL databases.

You need to recommend a solution to report the costs for each department to deploy the app services and
the databases. The solution must provide a consolidated view for cost reporting.

Solution: Create a separate resource group for each department. Place the resources for each department
in its respective resource group.
Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead create a resources group for each resource type. Assign tags to each resource group.

Note: Tags enable you to retrieve related resources from different resource groups. This approach is
helpful when you need to organize resources for billing or management.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

QUESTION 10
You are developing a sales application that will contain several Azure cloud services and will handle
different components of a transaction. Different cloud services will process customer orders, billing,
payment, inventory, and shipping.

You need to recommend a solution to enable the cloud services to asynchronously communicate
transaction information by using REST messages.

What would you include in the recommendation?

A. Azure Traffic Manager

B. Azure Notification Hubs
C. Azure Blob storage
D. Azure Queue storage

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Asynchronous messaging can be implemented in a variety of different ways. With queues, topics, and
subscriptions.
The queue service REST API: The Queue service stores messages that may be read by any client who has
access to the storage account.

Incorrect Answers:
B: Azure Notification Hubs provide an easy-to-use and scaled-out push engine that allows you to send
notifications to any platform. This communication is not asynchronous, however.

Reference:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-async-messaging

https://docs.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api

QUESTION 11
You have an Azure subscription that contains an Azure Cosmos DB account.

You need to recommend a solution to generate an alert from Azure Log Analytics when a request charge
for a query exceeds 50 request units more than 20 times within a 15-minute window.

What should you recommend?

A. Create a search query to identify when requestCharge_s exceeds 50. Configure an alert threshold of 20
and a period of 15.
B. Create a search query to identify when duration_s exceeds 20 and requestCharge_s exceeds 50.
Configure a period of 15.
C. Create a search query to identify when requestCharge_s exceeds 20. Configure a period of 15 and a
frequency of 20.
D. Create a search query to identify when duration_s exceeds 20. Configure a period of 15.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 12
You have 70 TB of files on your on-premises file server.

You need to recommend solution for importing data to Azure. The solution must minimize cost.

What Azure service should you recommend?

A. Azure StorSimple
B. Azure Stack
C. Azure Data Box
D. Azure Batch

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Microsoft has engineered an extremely powerful solution that helps customers get their data to the Azure
public cloud in a cost-effective, secure, and efficient manner with powerful Azure and machine learning at
play. The solution is called Data Box.
Data Box and is in general availability status. It is a rugged device that allows organizations to have 100 TB
of capacity on which to copy their data and then send it to be transferred to Azure.

Incorrect Answers:
A: StoreSimple would not be able to handle 70 TB of data.

References:
https://www.vembu.com/blog/what-is-microsoft-azure-data-box-disk-edge-heavy-gateway-overview/

QUESTION 13
You have an Azure subscription.

Your on-premises network contains a file server named Server1. Server1 stores 5 TB of company files that
are accessed rarely.

You plan to copy the files to Azure Storage.

You need to implement a storage solution for the files that meets the following requirements:

The files must be available within 24 hours of being requested.

Storage costs must be minimized.

Which two possible storage solutions achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. Create a general-purpose v2 storage account that is set to the Cool access tier. Create a file share in
the storage account and copy the files to the file share.
B. Create a general-purpose v2 storage account that is set to the Hot access tier. Create a blob container,
copy the files to the blob container, and set each file to the Archive access tier.
C. Create a general-purpose v1 storage account. Create a file share in the storage account and copy the
files to the file share.
D. Create an Azure Blob storage account that is set to the Cool access tier. Create a blob container, copy
the files to the blob container, and set each file to the Archive access tier.
E. Create a general-purpose v1 storage account. Create a blob container and copy the files to the blob
container.

Correct Answer: B&D

Section: (none)
Explanation

Explanation/Reference:
Explanation:
A: Azure storage offers different access tiers, which allow you to store blob object data in the most cost-
effective manner.
The Cool access tier is optimized for storing data that is infrequently accessed and stored for at least 30
days.

E: Using a file share is cheaper than using a blob container.

Incorrect Answers:
B, D: The Archive tier is optimized for storing data that is rarely accessed and stored for at least 180 days
with flexible latency requirements (on the order of hours).

C: Using a Blob container would be cheaper than using a file share.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

QUESTION 14
You are designing a data protection strategy for Azure virtual machines. All the virtual machines are in the
Standard tier and use managed disks.

You need to recommend a solution that meets the following requirements:

The use of encryption keys is audited.

All the data is encrypted at rest always.
You manage the encryption keys, not Microsoft.

What should you include in the recommendation?

A. BitLocker Drive Encryption (BitLocker)

B. Azure Storage Service Encryption
C. client-side encryption
D. Azure Disk Encryption

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/security/azure-security-disk-encryption-overview

QUESTION 15 Suresh.Palani
You have 100 servers that run Windows Server 2012 R2 and host Microsoft2020-08-04
SQL Server21:29:33
2014 instances.
The instances host databases that have the following characteristics: --------------------------------------------
Q15 - Hint
Key to the solution is mentioning of CLR
(commonla
n
gu
a
g
eruntime). CLR is not supported for
Single Database or Elastic pool. Which
makes Managed Instance (and instance
pools) the only correct answer
 The largest database is currently 3 TB. None of the databases will ever exceed 4 TB.
Stored procedures are implemented by using CLR.

You plan to move all the data from SQL Server to Azure.

You need to recommend an Azure service to host the databases. The solution must meet the following
requirements:

Whenever possible, minimize management overhead for the migrated databases.

Minimize the number of database changes required to facilitate the migration.
Ensure that users can authenticate by using their Active Directory credentials.

What should you include in the recommendation?

A. Azure SQL Database single databases

B. Azure SQL Database Managed Instance
C. Azure SQL Database elastic pools
D. SQL Server 2016 on Azure virtual machines

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance

QUESTION 16
DRAG DROP

You are designing a virtual machine that will run Microsoft SQL Server and will contain two data disks. The
first data disk will store log files, and the second data disk will store data. Both disks are P40 managed
disks.

You need to recommend a caching policy for each disk. The policy must provide the best overall
performance for the virtual machine.

Which caching policy should you recommend for each disk? To answer, drag the appropriate policies to the
correct disks. Each policy may be used once, more than once, or not at all. You may need to drag the split
bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-sql-
performance

QUESTION 17
You plan to create an Azure Cosmos DB account that uses the SQL API. The account will contain data
added by a web application. The web application will send data daily.

You need to recommend a notification solution that meets the following requirements:

Sends email notifications when data is received from IoT devices.

Minimizes compute cost.

What should you include in the recommendation?

A. Deploy a function app that is configured to use the Consumption plan and a SendGrid binding.
B. Deploy an Azure logic app that has a SendGrid connector configured to use an Azure Cosmos DB
action.
C. Deploy a function app that is configured to use the Consumption plan and an Azure Event Hubs binding.
D. Deploy an Azure logic app that has a webhook configured to use a SendGrid action.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You can send email by using SendGrid bindings in Azure Functions. Azure Functions supports an output
binding for SendGrid.

Note: When you're using the Consumption plan, instances of the Azure Functions host are dynamically
added and removed based on the number of incoming events.

Reference:
https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-sendgrid

https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale#consumption-plan

QUESTION 18
You have Azure virtual machines that run a custom line-of-business web application.

You plan to use a third-party solution to parse event logs from the virtual machines stored in an Azure
storage account.

You need to recommend a solution to save the event logs from the virtual machines to the Azure Storage
account. The solution must minimize costs and complexity.

What should you include in the recommendation?

A. Azure VM Diagnostics Extension

B. Azure Monitor Metrics
C. event log subscriptions
D. Azure Monitor Logs

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The Azure Diagnostics VM extension enables you to collect monitoring data, such as performance counters
and event logs, from your Windows VM. You can granularly specify what data you want to collect and where
you want the data to go, such as an Azure Storage account or an Azure Event Hub.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/extensions-diagnostics

QUESTION 19
DRAG DROP

You are planning an Azure solution that will host production databases for a high-performance application.
The solution will include the following components:

Two virtual machines that will run Microsoft SQL Server 2016, will be deployed to different data centers
in the same Azure region, and will be part of an Always On availability group.
SQL Server data that will be backed up by using the Automated Backup feature of the SQL Server IaaS
Agent Extension (SQLIaaSExtension)

You identify the storage priorities for various data types as shown in the following table.

Which storage type should you recommend for each data type? To answer, drag the appropriate storage
types to the correct data types. Each storage type may be used once, more than once, or not at all. You
may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 20
HOTSPOT

Your company deploys several Linux and Windows virtual machines (VMs) to Azure. The VMs are deployed
with the Microsoft Dependency Agent and the Log Analytics Agent installed by using Azure VM extensions.
On-premises connectivity has been enabled by using Azure ExpressRoute.

You need to design a solution to monitor the VMs.

Which Azure monitoring services should you use? To answer, select the appropriate Azure monitoring
services in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Azure Traffic Analytics

Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud
networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide
insights into traffic flow in your Azure cloud. With traffic analytics, you can:

Identify security threats to, and secure your network, with information such as open-ports, applications
attempting internet access, and virtual machines (VM) connecting to rogue networks.
Visualize network activity across your Azure subscriptions and identify hot spots.
Understand traffic flow patterns across Azure regions and the internet to optimize your network
deployment for performance and capacity.
Pinpoint network misconfigurations leading to failed connections in your network.

Box 2: Azure Service Map

Service Map automatically discovers application components on Windows and Linux systems and maps the
communication between services. With Service Map, you can view your servers in the way that you think of
them: as interconnected systems that deliver critical services. Service Map shows connections between
servers, processes, inbound and outbound connection latency, and ports across any TCP-connected
architecture, with no configuration required other than the installation of an agent.

Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/service-map
QUESTION 23
HOTSPOT

You have an on-premises file server that stores 2 TB of data files.

You plan to move the data files to Azure Blob storage in the Central Europe region.

You need to recommend a storage account type to store the data files and a replication solution for the
storage account. The solution must meet the following requirements:

Be available if a single Azure datacenter fails.

Support storage tiers.
Minimize cost.

What should you recommend? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Blob storage

Blob storage supports storage tiers

Note: Azure offers three storage tiers to store data in blob storage: Hot Access tier, Cool Access tier, and
Archive tier. These tiers target data at different stages of its lifecycle and offer cost-effective storage options
for different use cases.

Box 2: Zone-redundant storage (ZRS)

Data in an Azure Storage account is always replicated three times in the primary region. Azure Storage
offers two options for how your data is replicated in the primary region:
Zone-redundant storage (ZRS) copies your data synchronously across three Azure availability zones in
the primary region.
Locally redundant storage (LRS) copies your data synchronously three times within a single physical
location in the primary region. LRS is the least expensive replication option, but is not recommended for
applications requiring high availability.

References:
https://cloud.netapp.com/blog/storage-tiers-in-azure-blob-storage-find-the-best-for-your-data

https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy

QUESTION 24
HOTSPOT

Your on-premises network contains a file server named Server1 that stores 500 GB of data.

You need to use Azure Data Factory to copy the data from Server1 to Azure Storage.

You add a new data factory.

What should you do next? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Install a self-hosted integration runtime

The Integration Runtime is a customer-managed data integration infrastructure used by Azure Data Factory
to provide data integration capabilities across different network environments.

Box 2: Create a pipeline

With ADF, existing data processing services can be composed into data pipelines that are highly available
and managed in the cloud. These data pipelines can be scheduled to ingest, prepare, transform, analyze,
and publish data, and ADF manages and orchestrates the complex data and processing dependencies

References:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-sql-azure-adf

QUESTION 25
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage account that contains two 1-GB data files named File1 and File2. The data files
are set to use the archive access tier.

You need to ensure that File1 is accessible immediately when a retrieval request is initiated.
Solution: For File1, you set Access tier to Cool.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use the hot access tier.
The hot access tier has higher storage costs than cool and archive tiers, but the lowest access costs.
Example usage scenarios for the hot access tier include:

Data that's in active use or expected to be accessed (read from and written to) frequently.
Data that's staged for processing and eventual migration to the cool access tier.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

QUESTION 26
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage account that contains two 1-GB data files named File1 and File2. The data files
are set to use the archive access tier.

You need to ensure that File1 is accessible immediately when a retrieval request is initiated.

Solution: You move File1 to a new storage account. For File1, you set Access tier to Archive.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use the hot access tier.
The hot access tier has higher storage costs than cool and archive tiers, but the lowest access costs.
Example usage scenarios for the hot access tier include:

Data that's in active use or expected to be accessed (read from and written to) frequently.
Data that's staged for processing and eventual migration to the cool access tier.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

QUESTION 27
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage account that contains two 1-GB data files named File1 and File2. The data files
are set to use the archive access tier.

You need to ensure that File1 is accessible immediately when a retrieval request is initiated.

Solution: For File1, you set Access tier to Hot.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The hot access tier has higher storage costs than cool and archive tiers, but the lowest access costs.
Example usage scenarios for the hot access tier include:

Data that's in active use or expected to be accessed (read from and written to) frequently.
Data that's staged for processing and eventual migration to the cool access tier.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

QUESTION 28
You have an application named App1. App1 generates log files that must be archived for five years. The log
files must be readable by App1 but must not be modified.

Which storage solution should you recommend for archiving?

A. Use an Azure Blob storage account and a time-based retention policy

B. Ingest the log files into an Azure Log Analytics workspace
C. Use an Azure Blob Storage account configured to use the Archive access tier
D. Use an Azure file share that has access control enabled

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM
(Write Once, Read Many) state.

Immutable storage supports:

Time-based retention policy support: Users can set policies to store data for a specified interval. When a
time-based retention policy is set, blobs can be created and read, but not modified or deleted. After the
retention period has expired, blobs can be deleted but not overwritten.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

QUESTION 29
You use Azure Application Insights.
You plan to use continuous export.

You need to store Application Insights data for five years.

Which Azure service should you use?

A. Azure SQL Database

B. Azure Storage
C. Azure Monitor Logs
D. Azure Backup

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Create a Continuous Export.
1. In the Application Insights resource for your app under configure on the left, open Continuous Export
and choose Add:
2. Choose the telemetry data types you want to export.
3. Create or select an Azure storage account where you want to store the data.
Click Add, Export Destination, Storage account, and then either create a new store or choose an
existing store.
4. Create or select a container in the storage.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/app/export-telemetry#continuous-export-advanced-
storage-configuration

QUESTION 30
HOTSPOT

You have two on-premises file servers named Server1 and Server2. The servers contain data files in the
folders shown in the following table.

You have resources in an Azure Storage account named storage1 as shown in the following table.

You plan to use Azure Data Factory to copy the data files to the folders shown in the following table.
You need to identify the minimum number of connections and datasets that you must create in Data
Factory. The solution must prevent other data files in the subfolders of D:\Data from being copied to Azure.

How many connections and datasets should you identify? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: 2
The Azure Storage and Azure SQL Database linked services contain connection strings that Data Factory
uses at runtime to connect to your Azure Storage and Azure SQL Database, respectively.

Box 2: 3
A dataset is a named view of data that simply points or references the data you want to use in your
activities as inputs and outputs.
Datasets identify data within different data stores, such as tables, files, folders, and documents. For
example, an Azure Blob dataset specifies the blob container and folder in Blob storage from which the
activity should read the data.

Reference:
https://docs.microsoft.com/en-us/azure/data-factory/concepts-datasets-linked-services

QUESTION 31
You have data files in Azure Blob storage.

You plan to transform the files and move them to Azure Data Lake Storage.

You need to transform the data by using mapping data flow.

Which Azure service should you use?

A. Azure Storage Sync

B. Azure Databricks
C. Azure Data Box Gateway
D. Azure Data Factory
Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You can use Copy Activity in Azure Data Factory to copy data from and to Azure Data Lake Storage Gen2,
and use Data Flow to transform data in Azure Data Lake Storage Gen2.

Reference:
https://docs.microsoft.com/en-us/azure/data-factory/connector-azure-data-lake-storage

QUESTION 32 Suresh.Palani
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager
2020-08-04 23:41:42
resource deployments in your subscription.
--------------------------------------------
What should you include in the recommendation? Q32 -
The Azure Activity Log provides insight into
A. Azure Log Analytics subscription-levelevents that have occurred in Azure. This
includes a range of data, from Azure
B. Application Insights
Resource Manager operational data to
C. the Change Tracking management solution updates on Service Health events. Activity
D. Azure Monitor metrics logs are kept for 90 days. You can query for
any range of dates, as long as the starting
Correct Answer: C date isn't more than 90 days in the past.
Section: (none) References:
Explanation https://docs.microsoft.com/en-
us/azure/azure-resource-manager/resource-
Explanation/Reference: group-audit
Explanation:
Azure Automation now supports update management, inventory, and change tracking.

Update management delivers visibility of update compliance across Azure, on-premises, and other clouds
for both Windows and Linux. Create scheduled deployments to orchestrate the installation of updates within
a defined maintenance window. Exclude specific updates and get detailed troubleshooting logs to identify
any issues during the deployment.

Incorrect Answers:
D: Azure Monitor metrics include:
Model Deploy Started: Number of model deployments started in this workspace
Model Deploy Succeeded: Number of model deployments that succeeded in this workspace
Model Deploy Failed: Number of model deployments that failed in this workspace

Reference:
Suresh.Palani
https://azure.microsoft.com/en-us/blog/update-management-inventory-and-change-tracking-in-azure-
2020-07-28 16:31:55
automation-now-generally-available/
--------------------------------------------
Question Set 3
Ends Q1 -Q32
Design a Business Continuity Strategy

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Contoso, Ltd. is a US-based financial services company that has a main office in New York and a branch
office in San Francisco.

Existing Environment

Payment Processing System

Contoso hosts a business-critical payment processing system in its New York data center. The system has
three tiers: a front-end web app, a middle-tier web API, and a back-end data store implemented as a
Microsoft SQL Server 2014 database. All servers run Windows Server 2012 R2.

The front-end and middle-tier components are hosted by using Microsoft Internet Information Services (IIS).
The application code is written in C# and ASP.NET. The middle-tier API uses the Entity Framework to
communicate to the SQL Server database. Maintenance of the database is performed by using SQL Server
Agent jobs.

The database is currently 2 TB and is not expected to grow beyond 3 TB.

The payment processing system has the following compliance-related requirements:

Encrypt data in transit and at rest. Only the front-end and middle-tier components must be able to
access the encryption keys that protect the data store.
Keep backups of the data in two separate physical locations that are at least 200 miles apart and can be
restored for up to seven years.
Support blocking inbound and outbound traffic based on the source IP address, the destination IP
address, and the port number.
Collect Windows security logs from all the middle-tier servers and retain the logs for a period of seven
years.
Inspect inbound and outbound traffic from the front-end tier by using highly available network
appliances.
Only allow all access to all the tiers from the internal network of Contoso.

Tape backups are configured by using an on-premises deployment of Microsoft System Center Data
Protection Manager (DPM), and then shipped offsite for long term storage.
Historical Transaction Query System

Contoso recently migrated a business-critical workload to Azure. The workload contains a .NET web
service for querying the historical transaction data residing in Azure Table Storage. The .NET web service
is accessible from a client app that was developed in-house and runs on the client computers in the New
York office. The data in the table storage is 50 GB and is not expected to increase.

Current Issues

The Contoso IT team discovers poor performance of the historical transaction query system, at the queries
frequently cause table scans.

Requirements

Planned Changes

Contoso plans to implement the following changes:

Migrate the payment processing system to Azure.

Migrate the historical transaction data to Azure Cosmos DB to address the performance issues.

Migration Requirements

Contoso identifies the following general migration requirements:

Infrastructure services must remain available if a region or a data center fails. Failover must occur
without any administrative intervention.
Whenever possible, Azure managed services must be used to minimize management overhead.
Whenever possible, costs must be minimized.

Contoso identifies the following requirements for the payment processing system:

If a data center fails, ensure that the payment processing system remains available without any
administrative intervention. The middle-tier and the web front end must continue to operate without any
additional configurations.
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.
Minimize the effort required to modify the middle-tier API and the back-end tier of the payment
processing system.
Payment processing system must be able to use grouping and joining tables on encrypted columns.
Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
Ensure that the payment processing system preserves its current compliance status.
Host the middle tier of the payment processing system on a virtual machine.

Contoso identifies the following requirements for the historical transaction query system:

Minimize the use of on-premises infrastructure services.

Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
Minimize the frequency of table scans.
If a region fails, ensure that the historical transaction query system remains available without any
administrative intervention.

Information Security Requirements

The IT security team wants to ensure that identity management is performed by using Active Directory.
Password hashes must be stored on-premises only.

Access to all business-critical systems must rely on Active Directory credentials. Any suspicious
authentication attempts must trigger a multi-factor authentication prompt automatically. Legitimate users
must be able to authenticate successfully by using multi-factor authentication.

QUESTION 1
You need to recommend a backup solution for the data store of the payment processing system.
What should you include in the recommendation?

A. Microsoft System Center Data Protection Manager (DPM)

B. Azure SQL long-term backup retention
C. Azure Backup Server
D. a Recovery Services vault
E. Azure Managed Disks

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-long-term-backup-retention-configure

QUESTION 2
You need to recommend a disaster recovery solution for the back-end tier of the payment processing
system.

What should you include in the recommendation?

A. Always On Failover Cluster Instances

B. Azure Site Recovery
C. an auto-failover group
D. geo-redundant database backups

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Scenario:
The back-end data store is implemented as a Microsoft SQL Server 2014 database.
If a data center fails, ensure that the payment processing system remains available without any
administrative intervention.

Note: Auto-failover groups is a SQL Database feature that allows you to manage replication and failover of
a group of databases on a SQL Database server or all databases in a managed instance to another region.
It is a declarative abstraction on top of the existing active geo-replication feature, designed to simplify
deployment and management of geo-replicated databases at scale.

Reference:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auto-failover-group

QUESTION 3
You need to recommend a high-availability solution for the middle tier of the payment processing system.

What should you include in the recommendation?

A. the Isolated App service plan

B. availability zones
C. an availability set
D. the Premium App Service plan

Correct Answer: B
Section: (none)
Explanation
Explanation/Reference:
Design a Business Continuity Strategy

Testlet 2

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main
office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment

Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There
are no trust relationships between the forests.

Corp.fabrikam.com is a production forest that contains identities used for internal user and computer
authentication.

Rd.fabrikam.com is used by the research and development (R&D) department only.

Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office
contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the Internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is
used by customers to place and track orders.

WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that
runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that
run on Hyper-V.

The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software
Assurance.

Problem Statements
The use of Web App1 is unpredictable. At peak times, users often report delays. At other times, many
resources for WebApp1 are underutilized.

Requirements

Planned Changes

Fabrikam plans to move most of its production workloads to Azure during the next few years.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming
Microsoft Office 365 deployment.

All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements

Fabrikam identifies the following technical requirements:

Web site content must be easily updated from a single point.

User input must be minimized when provisioning new app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the directory
synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not
be affected by a link failure between Azure and the on-premises network.

Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the
company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 1
You need to recommend a solution to meet the database retention requirement.

What should you recommend?

A. Configure geo-replication of the database

B. Configure Azure Site Recovery
C. Configure a long-term retention policy for the database
D. Use automatic Azure SQL Database backups

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
HOTSPOT

You design a solution for the web tier of WebApp1 as shown in the exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Yes
Any new deployments to Azure must be redundant in case an Azure region fails.

Traffic Manager uses DNS to direct client requests to the most appropriate service endpoint based on a
traffic-routing method and the health of the endpoints. An endpoint is any Internet-facing service hosted
inside or outside of Azure. Traffic Manager provides a range of traffic-routing methods and endpoint
monitoring options to suit different application needs and automatic failover models. Traffic Manager is
resilient to failure, including the failure of an entire Azure region.

Box 2: Yes
Recent changes in Azure brought some significant changes in autoscaling options for Azure Web Apps (i.e.
Azure App Service to be precise as scaling happens on App Service plan level and has effect on all Web
Apps running in that App Service plan).

Box 3: No
Traffic Manager provides a range of traffic-routing methods and endpoint monitoring options to suit different
application needs and automatic failover models. Traffic Manager is resilient to failure, including the failure
of an entire Azure region.

Reference:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview

https://blogs.msdn.microsoft.com/hsirtl/2017/07/03/autoscaling-azure-web-apps/
Design a Business Continuity Strategy

Question Set 3

QUESTION 1
You plan to deploy a payroll system to Azure. The payroll system will use Azure virtual machines that run
SUSE Linux Enterprise Server and Windows.

You need to recommend a business continuity solution for the payroll system. The solution must meet the
following requirements:

Minimize costs.
Provide business continuity if an Azure region fails.
Provide a recovery time objective (RTO) of 120 minutes.
Provide a recovery point objective (RPO) of five minutes.

What should you include in the recommendation?

A. Microsoft System Center Data Protection Manager (DPM)

B. Azure Site Recovery
C. unmanaged disks that use geo-redundant storage (GRS)
D. Azure Backup

Correct Answer: B
Section: (none)
Explanation –
corrected as per the
exam topics

Explanation/Reference:
Explanation:
If your storage account has GRS enabled, then your data is durable even in the case of a complete regional
outage or a disaster in which the primary region isn't recoverable.

Note: The recovery time objective (RTO) is the targeted duration of time and a service level within which a
business process must be restored after a disaster (or disruption) in order to avoid unacceptable
consequences associated with a break in business continuity.

Incorrect Answers:
B: Azure Site Recovery would not protect against an Azure region failure.

Azure Site Recovery guarantees a two-hour Recovery Time Objective.

Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs

https://azure.microsoft.com/en-us/support/legal/sla/site-recovery/v1_0/

QUESTION 2
The accounting department at your company migrates to a new financial accounting software. The
accounting department must keep file-based database backups for seven years for compliance purposes. It
is unlikely that the backups will be used to recover data.

You need to move the backups to Azure. The solution must minimize costs.

Where should you store the backups?

A. Azure SQL Database

B. Azure Blob storage that uses the Archive tier
C. a Recovery Services vault
D. Azure Blob storage that uses the Cool tier

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 3
HOTSPOT

Your company has two on-premises sites in New York and Los Angeles and Azure virtual networks in the
East US Azure region and the West US Azure region. Each on-premises site has Azure ExpressRoute
Global Reach circuits to both regions.

You need to recommend a solution that meets the following requirements:

Outbound traffic to the Internet from workloads hosted on the virtual networks must be routed through
the closest available on-premises site.
If an on-premises site fails, traffic from the workloads on the virtual networks to the Internet must reroute
automatically to the other site.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 4
You plan to store data in Azure Blob storage for many years. The stored data will be accessed rarely.

You need to ensure that the data in Blob storage is always available for immediate access. The solution
must minimize storage costs.

Which storage tier should you use?

A. Cool
B. Archive
C. Hot

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure cool tier is equivalent to the Amazon S3 Infrequent Access (S3-IA) storage in AWS that provides a
low cost high performance storage for infrequently access data.

Note: Azure’s cool storage tier, also known as Azure cool Blob storage, is for infrequently-accessed data
that needs to be stored for a minimum of 30 days. Typical use cases include backing up data before tiering
to archival systems, legal data, media files, system audit information, datasets used for big data analysis
and more.

The storage cost for this Azure cold storage tier is lower than that of hot storage tier. Since it is expected
that the data stored in this tier will be accessed less frequently, the data access charges are high when
compared to hot tier. There are no additional changes required in your applications as these tiers can be
accessed using APIs in the same manner that you access Azure storage.

Incorrect Answers:
B: Even though Azure archive storage offers the lowest cost in terms of data storage, its data retrieval
charges are higher than that of hot and cool tiers. In fact, the data in the archive tier remains offline until the
tier of the data is changed using a process called hydration. The process of hydrating data in the archive
storage tier and moving it to either hot or cool tier could take up to 15 hours and, hence, it is only intended
for data that can afford that kind of access delay.

C: The storage cost for this Azure cold storage tier is lower than that of hot storage tier.

Reference:
https://cloud.netapp.com/blog/low-cost-storage-options-on-azure

QUESTION 5
HOTSPOT

You have a virtual machine scale set named SS1.

You configure autoscaling as shown in the following exhibit.

You configure the scale out and scale in rules to have a duration of 10 minutes and a cool down time of 10
minutes.

Use the drop-down menus to select the answer choice that answers each question based on the
information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Corrected using the exam topics answers.
QUESTION 6
HOTSPOT

You have 20 Azure virtual machines that run Windows Server 2016 based on a custom virtual machine
image. Each virtual machine hosts an instance of a VSS-capable web app that was developed in-house.
Each instance is accessed by using a public endpoint. Each instance uses a separate database. The
average database size is 200 GB.

You need to design a disaster recovery solution for individual instances. The solution must meet the
following requirements:

Provide a recovery time objective (RTO) of six hours

Provide a recovery point objective (RPO) of eight hours
Support recovery to a different Azure region
Support VSS-based backups
Minimize costs

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
QUESTION 7
HOTSPOT

You plan to deploy the backup policy shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 8
HOTSPOT

You have databases in Azure as shown in the following table.

You are designing a data retention policy.

You need to identify which databases can retain a daily backup for up to 35 days and which databases can
retain monthly backups for up to 120 months.

Which databases should you identify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Answer-

Box 1- SQLDB2 and SQLDB3 only

Box 2 - SQLDB1, SQLDB2 and SQLDB3 only

DB that can retain daily backup for upto 35 days - SQLDB2 and SQLDB3 only
DB that can retain monthly backups for upto 120 months - SQLDB1, SQLDB2 and SQLDB3
only

QUESTION 9
You have an on-premises network and an Azure subscription. The on-premises network has several branch
offices.

A branch office in Toronto contains a virtual machine named VM1 that is configured as a file server. Users
access the shared files on VM1 from all the offices.

You need to recommend a solution to ensure that the users can access the shares files as quickly as
possible if the Toronto branch office is inaccessible.
What should you include in the recommendation?

A. a Recovery Services vault and Azure Backup

B. an Azure file share and Azure File Sync
C. Azure blob containers and Azure File Sync
D. a Recovery Services vault and Windows Server Backup

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility,
performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server
into a quick cache of your Azure file share.

You need an Azure file share in the same region that you want to deploy Azure File Sync.

Incorrect Answers:
A: Backups would be a slower solution.

Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide

QUESTION 10
You have an Azure subscription for used for testing and development purposes only. The subscription
contains Azure virtual machines that unmanaged, standard hard disk drives (HDD).

You need to recommend a recovery strategy for the virtual machines if an Azure region fails for a sustained
period. The recovery time objective (RTO) can be up to seven days. The solution must minimize costs.

What should you include in the recommendation?

A. Store the disks in a Standard_LRS storage account. Configure Azure site Recovery. If a failure occurs,
initiate a manual failover.
B. Store the disks in a Standard_GRS storage account. Configure Azure Recovery. If a failure occurs,
initiate a manual failover.
C. Store the disks in a Standard_LRS storage account. If a disaster occurs, manually create the virtual
machines by used Azure Resources Manager templates.
D. Store the disks in a Standard_GRS storage account. If a disaster occurs, manually create the virtual
machines by used Azure Resources Manager templates.

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Geo-redundant storage (GRS) is designed to provide at least 99.99999999999999% (16 9's) durability of
objects over a given year by replicating your data to a secondary region that is hundreds of miles away from
the primary region. If your storage account has GRS enabled, then your data is durable even in the case of
a complete regional outage or a disaster in which the primary region isn't recoverable.

GRS replicates your data to another data center in a secondary region, but that data is available to be read
only if Microsoft initiates a failover from the primary to secondary region.

Incorrect Answers:
A, C: If a datacenter-level disaster (for example, fire or flooding) occurs, all replicas in a storage account
using LRS may be lost or unrecoverable. To mitigate this risk, Microsoft recommends using zone-
redundant storage (ZRS), geo-redundant storage (GRS), or geo-zone-redundant storage (GZRS).

Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs

QUESTION 12
You have an Azure Storage account that contains the data shown in the following exhibit.
You need to identify which files can be accessed immediately from the storage account.

Which files should you identify?

A. File1.bin only
B. File2.bin only
C. File3.bin only
D. File1.bin and File2.bin only
E. File1.bin, File2.bin, and File3.bin

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Hot - Optimized for storing data that is accessed frequently.
Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.
Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible
latency requirements (on the order of hours).

Note: Lease state of the blob. Possible values: available|leased|expired|breaking|broken

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers

QUESTION 13
HOTSPOT

You plan to create a storage account and to save the files as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.
NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers#archive-access-tier-
preview

QUESTION 14
You plan to use Azure Site Recovery to protect several on-premises physical server workloads. Each server
workload is independent of the other. The workloads are stateless.

You need to recommend a failover strategy to ensure that if the on-premises data center fails, the
workloads are available in Azure as quickly as possible.

Which failover strategy should you include in the recommendation?

A. Latest
B. Latest app-consistent
C. Latest multi-VM processed
D. Latest processed
Suresh.Palani
2020-08-05 21:14:24
Correct Answer: D --------------------------------------------
Section: (none) Latest processed: Use this option to fail over
Explanation V
Msto the latest recovery point already
processed by Site Recovery. You can see
Explanation/Reference: the latest processed recovery point in the
Reference: VM Latest Recovery Points. This option
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-failover provides a low RTO as no time is spent to
processing the unprocessed data
QUESTION 15
DRAG DROP

Your company identifies the following business continuity and disaster recovery objectives for virtual
machines that host sales, finance, and reporting applications in the company’s on-premises data center:

The finance application requires that data be retained for seven years. In the event of a disaster, the
application must be able to run from Azure. The recovery time objective (RTO) is 10 minutes.
The reporting application must be able to recover point-in-time data at a daily granularity. The RTO is
eight hours.
The sales application must be able to fail over to a second on-premises data center.

You need to recommend which Azure services meet the business continuity and disaster recovery
objectives. The solution must minimize costs.

What should you recommend for each application? To answer, drag the appropriate services to the correct
applications. Each service may be used once, more than once, or not at all. You may need to drag the split
bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 16
You plan to move a web application named App1 from an on-premises data center to Azure.

App1 depends on a custom COM component that is installed on the host server.

You need to recommend a solution to host App1 in Azure. The solution must meet the following
requirements:

App1 must be available to users if an Azure data center becomes unavailable.

Costs must be minimized.

What should you include in the recommendation?

A. In two Azure regions, deploy a Traffic Manager profile and a web app.
B. In two Azure regions, deploy a load balancer and a virtual machine scale set.
C. Deploy a load balancer and a virtual machine scale set across two availability zones.
D. In two Azure regions, deploy a load balancer and a web app.

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 17
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an on-premises Hyper-V cluster that hosts 20 virtual machines. Some virtual machines run
Windows Server 2016 and some run Linux.

You plan to migrate the virtual machines to an Azure subscription.

You need to recommend a solution to replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing an Azure Storage account that has a file service and a blob
service, and then using the Data Migration Assistant.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Data Migration Assistant is used to migrate SQL databases.
Instead use Azure Site Recovery.

References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview

QUESTION 18
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an on-premises Hyper-V cluster that hosts 20 virtual machines. Some virtual machines run
Windows Server 2016 and some run Linux.

You plan to migrate the virtual machines to an Azure subscription.

You need to recommend a solution to replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing an Azure Storage account, and then running AzCopy.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
AzCopy only copy files, not the disks.
Instead use Azure Site Recovery.

References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview

QUESTION 19
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an on-premises Hyper-V cluster that hosts 20 virtual machines. Some virtual machines run
Windows Server 2016 and some run Linux.

You plan to migrate the virtual machines to an Azure subscription.

You need to recommend a solution to replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing a Recovery Services vault, and then using Azure Site Recovery.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Site Recovery can replicate on-premises VMware VMs, Hyper-V VMs, physical servers (Windows and
Linux), Azure Stack VMs to Azure.

Note: Site Recovery helps ensure business continuity by keeping business apps and workloads running
during outages. Site Recovery replicates workloads running on physical and virtual machines (VMs) from a
primary site to a secondary location. When an outage occurs at your primary site, you fail over to secondary
location, and access apps from there. After the primary location is running again, you can fail back to it.

References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview

QUESTION 21
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage v2 account named storage1.

You plan to archive data to storage1.

You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.

Solution: You create a file share, and you configure an access policy.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead of a file share, an immutable Blob storage is required.

Time-based retention policy support: Users can set policies to store data for a specified interval. When a
time-based retention policy is set, blobs can be created and read, but not modified or deleted. After the
retention period has expired, blobs can be deleted but not overwritten.

Note: Set retention policies and legal holds

1. Create a new container or select an existing container to store the blobs that need to be kept in the
immutable state. The container must be in a general-purpose v2 or Blob storage account.

2. Select Access policy in the container settings. Then select Add policy under Immutable blob storage.

3. To enable time-based retention, select Time-based retention from the drop-down menu.

4. Enter the retention interval in days (acceptable values are 1 to 146000 days).

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutability-policies-manage

QUESTION 22
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage v2 account named storage1.

You plan to archive data to storage1.

You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.

Solution: You create an Azure Blob storage container, and you configure a legal hold access policy.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM
(Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-
specified interval. For the duration of the retention interval, blobs can be created and read, but cannot be
modified or deleted. Immutable storage is available for general-purpose v2 and Blob storage accounts in all
Azure regions.

Note: Set retention policies and legal holds

1. Create a new container or select an existing container to store the blobs that need to be kept in the
immutable state. The container must be in a general-purpose v2 or Blob storage account.

2. Select Access policy in the container settings. Then select Add policy under Immutable blob storage.

Either

3a. To enable legal holds, select Add Policy. Select Legal hold from the drop-down menu.

Or
3b. To enable time-based retention, select Time-based retention from the drop-down menu.

4. Enter the retention interval in days (acceptable values are 1 to 146000 days).
References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutability-policies-manage

QUESTION 23
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage v2 account named storage1.

You plan to archive data to storage1.

You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.

Solution: You create a file share and snapshots.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead you could create an Azure Blob storage container, and you configure a legal hold access policy.

References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

QUESTION 24
You plan to archive 10 TB of on-premises data files to Azure.

You need to recommend a data archival solution. The solution must minimize the cost of storing the data
files.

Which Azure Storage account type should you include in the recommendation?

A. Premium Storage (general purpose v1)

B. Standard StorageV2 (general purpose v2)
C. Standard Storage (general purpose v1)
D. Premium StorageV2 (general purpose v2)

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Standard StorageV2 supports the Archive access tier, which would be the cheapest solution.

Incorrect Answers:
A, D: Each Premium storage account offers 35 TB of disk and 10 TB of snapshot capacity
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-introduction

QUESTION 25
You are planning to deploy an application named App1 that will run in containers on Azure Kubernetes
Service (AKS) clusters. The AKS clusters will be distributed across four Azure regions.

You need to recommend a storage solution for App1. Updated container images must be replicated
automatically to all the AKS clusters.

Which storage solution should you recommend?

A. Azure Content Delivery Network (CDN)

B. Premium SKU Azure Container Registry
C. Azure Cache for Redis
D. geo-redundant storage (GRS) accounts

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Enable geo-replication for container images.
Best practice: Store your container images in Azure Container Registry and geo-replicate the registry to
each AKS region.

To deploy and run your applications in AKS, you need a way to store and pull the container images.
Container Registry integrates with AKS, so it can securely store your container images or Helm charts.
Container Registry supports multimaster geo-replication to automatically replicate your images to Azure
regions around the world.

Geo-replication is a feature of Premium SKU container registries.

Note:
When you use Container Registry geo-replication to pull images from the same region, the results are:

Faster: You pull images from high-speed, low-latency network connections within the same Azure region.
More reliable: If a region is unavailable, your AKS cluster pulls the images from an available container
registry.
Cheaper: There's no network egress charge between datacenters.

Reference:
https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region

QUESTION 27
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You have an Azure Storage v2 account named storage1.

You plan to archive data to storage1.

You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.

Solution: You create an Azure Blob storage container, you configure a time-based retention policy, and you
lock the policy.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Time-based retention policy support: Users can set policies to store data for a specified interval. When a
time-based retention policy is set, blobs can be created and read, but not modified or deleted. After the
retention period has expired, blobs can be deleted but not overwritten.

Note:
Immutable storage for Azure Blob storage enables users to store business-critical data objects in a WORM
(Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-
specified interval. For the duration of the retention interval, blobs can be created and read, but cannot be
modified or deleted. Immutable storage is available for general-purpose v2 and Blob storage accounts in all
Azure regions.

Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage

QUESTION 28
Your company purchases an app named App1.

You plan to run App1 on seven Azure virtual machines in an Availability Set. The number of fault domains is
set to 3. The number of update domains is set to 20.

You need to identify how many App1 instances will remain available during a period of planned
maintenance.

How many App1 instances should you identify?

A. 1
B. 2
C. 6
D. 7

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Only one update domain is rebooted at a time. Here there are 7 update domain with one VM each (and 13
update domain with no VM).

Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

QUESTION 29
You plan to deploy 10 applications to Azure. The applications will be deployed to two Azure Kubernetes
Service (AKS) clusters. Each cluster will be deployed to a separate Azure region.

The application deployment must meet the following requirements:

Ensure that the applications remain available if a single AKS cluster fails.
Ensure that the connection traffic over the internet is encrypted by using SSL without having to configure
SSL on each container instance.

Which Azure service should you include in the recommendation?

A. Azure Front Door

B. Azure Traffic Manager
C. Azure Load Balancer
D. AKS ingress controller

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Front Door enables you to define, manage, and monitor the global routing for your web traffic by
optimizing for best performance and instant global failover for high availability. With Front Door, you can
transform your global (multi-region) consumer and enterprise applications into robust, high-performance
personalized modern applications, APIs, and content that reaches a global audience with Azure.

Front Door works at Layer 7 or HTTP/HTTPS layer and uses anycast protocol with split TCP and
Microsoft's global network for improving global connectivity.

Incorrect Answers:
B: Azure Traffic Manager uses DNS (layer 3) to shape traffic. SSL works at Layer 6.

Azure Traffic Manager can direct customers to their closest AKS cluster and application instance. For the
best performance and redundancy, direct all application traffic through Traffic Manager before it goes to
your AKS cluster.

Reference:
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-overview

Design for Deployment, Migration and Integration

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main
office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment

Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There
are no trust relationships between the forests.

Corp.fabrikam.com is a production forest that contains identities used for internal user and computer
authentication.

Rd.fabrikam.com is used by the research and development (R&D) department only.

Network Infrastructure
Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office
contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the Internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is
used by customers to place and track orders.

WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that
runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that
run on Hyper-V.

The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software
Assurance.

Problem Statements
The use of Web App1 is unpredictable. At peak times, users often report delays. At other times, many
resources for WebApp1 are underutilized.

Requirements

Planned Changes

Fabrikam plans to move most of its production workloads to Azure during the next few years.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming
Microsoft Office 365 deployment.

All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements

Fabrikam identifies the following technical requirements:

Web site content must be easily updated from a single point.

User input must be minimized when provisioning new app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the directory
synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not
be affected by a link failure between Azure and the on-premises network.

Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the
company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 1
HOTSPOT

You are evaluating the components of the migration to Azure that require you to provision an Azure Storage
account.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
You need to recommend a strategy for migrating the database content of WebApp1 to Azure.

What should you include in the recommendation?

A. Use Azure Site Recovery to replicate the SQL servers to Azure

B. Use SQL Server transactional replication
C. Copy the VHD that contains the Azure SQL database files to Azure Blob storage
D. Copy the BACPAC file that contains the Azure SQL database files to Azure Blob storage

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Before you upload a Windows virtual machine (VM) from on-premises to Azure, you must prepare the
virtual hard disk (VHD or VHDX).

Scenario: WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database
tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual
machines that run on Hyper-V.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image

QUESTION 3
You need to recommend a strategy for the web tier of WebApp1. The solution must minimize costs.

What should you recommend?

A. Configure the Scale Up settings for a web app

B. Create a runbook that resizes virtual machines automatically to a smaller size outside of business hours
C. Deploy a virtual machine scale set that scales out on a 75 percent CPU threshold
D. Configure the Scale Out settings for a web app

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Design for Deployment, Migration and Integration

Question Set 2 Suresh.Palani

2020-07-28 16:37:46
QUESTION 1
--------------------------------------------
DRAG DROP
Question Set 5 Starts
You plan to import data from your on-premises environment into Azure. TheQ1
data-Q15
is shown in the following
table.

What should you recommend using to migrate the data? To answer, drag the appropriate tools to the
correct data sources. Each tool may be used once, more than once, or not at all. You may need to drag the
split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/dms/tutorial-sql-server-to-azure-sql
https://docs.microsoft.com/en-us/azure/cosmos-db/import-data

QUESTION 2
You have an on-premises deployment of MongoDB.

You plan to migrate MongoDB to an Azure Cosmos DB account that uses the MongoDB API.

You need to recommend a solution for migrating MongoDB to Azure Cosmos DB.

What should you include in the recommendation?

A. mongorestore
B. Data Migration Assistant
C. Azure Storage Explorer
D. Azure Cosmos DB Data Migration Tool

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/mongodb-migrate

QUESTION 3
Your company plans to publish APIs for its services by using Azure API Management.

You discover that service responses include the AspNet-Version header.

You need to recommend a solution to remove AspNet-Version from the response of the published APIs.

What should you include in the recommendation?

A. a new product
B. a modification to the URL scheme
C. a new policy
D. a new revision

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Set a new transformation policy to transform an API to strip response headers.

References:
https://docs.microsoft.com/en-us/azure/api-management/transform-api

QUESTION 4
Your company has 300 virtual machines hosted in a Vmware environment. The virtual machines vary in
size and have various utilization levels.

You plan to move all the virtual machines to Azure.

You need to recommend how many and what size Azure virtual machines will be required to move the
current workloads to Azure. The solution must minimize administrative effort.

What should you use to make the recommendation?

A. Azure Advisor
B. Azure Migrate
C. Azure Pricing calculator
D. Azure Cost Management
Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 5
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that wants to move a .NET Core web application from
an on-premises data center to Azure. The web application relies on a Microsoft SQL Server 2016 database
on Windows Server 2016. The database server will not move to Azure.

A separate networking team is responsible for configuring network permissions.

The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure virtual
network named VNET1.

You need to recommend a solution for deploying the web application.

Solution:
Deploy the web application to a web app hosted in a Standard App Service plan. Create and configure an
Azure App Service Hybrid Connections endpoint.
On the on-premises network, deploy the Hybrid Connection Manager. Configure the Hybrid Connection
Manager to access both the Hybrid Connection endpoint and the SQL Server instance.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, use VNet Integration.

Note: VNet Integration gives your web app access to resources in your virtual network. VNet Integration is
often used to enable access from apps to a databases and web services running in your VNet.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

QUESTION 6
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

A company has custom ASP.NET and Java applications that run on old versions of Windows and Linux.
The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for the
applications. The solution must support storage orchestration.

Solution: You create an Azure virtual network, a public IP address, and load balancer. Then add virtual
machines (VMs) to the solution and deploy individual containers on them.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead you should deploy each application to an Azure Container instance.

Note: Docker Containers are the global standard and are natively supported in Azure, offering enterprises
an interesting and flexible way to migrate legacy apps for both future proofing and cost benefits.

Reference:
https://docs.microsoft.com/en-us/dotnet/standard/modernize-with-azure-and-containers/modernize-existing-
apps-to-cloud-optimized/deploy-existing-net-apps-as-windows-containers

QUESTION 7
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

A company has custom ASP.NET and Java applications that run old versions of Windows and Linux. The
company plans to place applications in containers.

You need to design a solution that includes networking, service discovery, and load balancing for the
applications. The solution must support storage orchestration.

Solution: Deploy a Kubernetes cluster that has the desired number of instances of the applications.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead you should deploy each application to an Azure Container instance.

Note: Docker Containers are the global standard and are natively supported in Azure, offering enterprises
an interesting and flexible way to migrate legacy apps for both future proofing and cost benefits.

Reference:
https://docs.microsoft.com/en-us/dotnet/standard/modernize-with-azure-and-containers/modernize-existing-
apps-to-cloud-optimized/deploy-existing-net-apps-as-windows-containers

QUESTION 8
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

A company has custom ASP.NET and Java applications that run old versions of Windows and Linux. The
company plans to place applications in containers.

You need to design a solution that includes networking, service discovery, and load balancing for the
applications. The solution must support storage orchestration.

Solution: You deploy each application to an Azure Container instance.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Docker Containers are the global standard and are natively supported in Azure, offering enterprises an
interesting and flexible way to migrate legacy apps for both future proofing and cost benefits.

Containers are modular and portable. Docker containers are supported on any server operating system
(Linux and Windows), in any major public cloud (Microsoft Azure, Amazon AWS, Google, IBM), and in on-
premises and private or hybrid cloud environments.

Reference:
https://docs.microsoft.com/en-us/dotnet/standard/modernize-with-azure-and-containers/modernize-existing-
apps-to-cloud-optimized/deploy-existing-net-apps-as-windows-containers

QUESTION 9
HOTSPOT

You have a web application that uses a MongoDB database. You plan to migrate the web application to
Azure.

You must migrate to Cosmos DB while minimizing code and configuration changes.

You need to design the Cosmos DB configuration.

What should you recommend? To answer, select the appropriate values in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

MongoDB compatibility: API

API: MongoDB API

Azure Cosmos DB comes with multiple APIs:
SQL API, a JSON document database service that supports SQL queries. This is compatible with the
former Azure DocumentDB.
MongoDB API, compatible with existing Mongo DB libraries, drivers, tools and applications.
Cassandra API, compatible with existing Apache Cassandra libraries, drivers, tools, and applications.
Azure Table API, a key-value database service compatible with existing Azure Table Storage.
Gremlin (graph) API, a graph database service supporting Apache Tinkerpop’s graph traversal
language, Gremlin.

Reference:
https://docs.microsoft.com/en-us/azure/cosmos-db/create-mongodb-dotnet

QUESTION 10
Suresh.Palani
You manage an application instance. The application consumes data from multiple databases. Application
2020-08-10 09:13:07
code references database tables using a combination of the server, database, and table name.
--------------------------------------------
You need to migrate the application instance to Azure. Q10 - Answer
B. SQL Server in an Azure virtual
machine
What are two possible ways to achieve this goal? Each correct answer presents D. SQL solution.
a complete Managed Instance

NOTE: Each correct selection is worth one point.

A. SQL Server Stretch Database
B. SQL Server in an Azure virtual machine
C. Azure SQL Database
D. SQL Managed Instance

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
A: Access your SQL Server data seamlessly regardless of whether it's on-premises or stretched to the
cloud. You set the policy that determines where data is stored, and SQL Server handles the data movement
in the background. The entire table is always online and queryable. And, Stretch Database doesn't require
any changes to existing queries or applications - the location of the data is completely transparent to the
application.

D: The managed instance deployment model is designed for customers looking to migrate a large number
of apps from on-premises or IaaS, self-built, or ISV provided environment to fully managed PaaS cloud
environment, with as low migration effort as possible. Using the fully automated Data Migration Service
(DMS) in Azure, customers can lift and shift their on-premises SQL Server to a managed instance that
offers compatibility with SQL Server on-premises and complete isolation of customer instances with native
VNet support.

Reference:
https://docs.microsoft.com/en-us/sql/sql-server/stretch-database/stretch-database

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance

QUESTION 11
Suresh.Palani
You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to use 10 on-
2020-08-10 09:15:37
premises SQL Server databases as their destinations.
--------------------------------------------
You plan to migrate the 10 on-premises databases to Azure SQL Database.Q11 - Answer B
Azure Data Factory
You need to recommend a solution to host the SSIS packages in Azure. The solution must ensure that the
packages can target the SQL Database instances as their destinations.

What should you include in the recommendation?

A. SQL Server Migration Assistant (SSMA)

B. Azure Data Factory
C. Data Migration Assistant
D. Azure Data Catalog

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 12
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

A company has custom ASP.NET and Java applications that run on old versions of Windows and Linux.
The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for the
applications. The solution must support storage orchestration.

Solution: You deploy each application to an Azure Web App that has container support.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 13
HOTSPOT

Your company develops a web service that is deployed to an Azure virtual machine named VM1. The web
service allows an API to access real-time data from VM1.

The current virtual machine deployment is shown in the Deployment exhibit.

The chief technology officer (CTO) sends you the following email message: “Our developers have deployed
the web service to a virtual machine named VM1. Testing has shown that the APIs is accessible from VM1
and VM2. Our partners must be able to connect to the API over the Internet. Partners will use this data in
applications that they develop”.

You deploy an Azure API Management (APIM) service. The relevant API Management configuration is
shown in the API exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/api-management/api-management-using-with-vnet

QUESTION 15
You have 100 devices that write performance data to Azure Blob storage.

You plan to store and analyze the performance data in an Azure SQL database.

You need to recommend a solution to move the performance data to the SQL database.

What should you include in the recommendation?

A. Azure Data Box

B. Azure Data Factory
C. Azure Database Migration Service
D. Data Migration Assistant

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You can copy data from Azure Blob to Azure SQL Database using Azure Data Factory.

Reference:
https://docs.microsoft.com/en-us/azure/data-factory/tutorial-copy-data-dot-net
Design an Infrastructure Strategy

Testlet 1

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Contoso, Ltd. is a US-based financial services company that has a main office in New York and a branch
office in San Francisco.

Existing Environment

Payment Processing System

Contoso hosts a business-critical payment processing system in its New York data center. The system has
three tiers: a front-end web app, a middle-tier web API, and a back-end data store implemented as a
Microsoft SQL Server 2014 database. All servers run Windows Server 2012 R2.

The front-end and middle-tier components are hosted by using Microsoft Internet Information Services (IIS).
The application code is written in C# and ASP.NET. The middle-tier API uses the Entity Framework to
communicate to the SQL Server database. Maintenance of the database is performed by using SQL Server
Agent jobs.

The database is currently 2 TB and is not expected to grow beyond 3 TB.

The payment processing system has the following compliance-related requirements:

Encrypt data in transit and at rest. Only the front-end and middle-tier components must be able to
access the encryption keys that protect the data store.
Keep backups of the data in two separate physical locations that are at least 200 miles apart and can be
restored for up to seven years.
Support blocking inbound and outbound traffic based on the source IP address, the destination IP
address, and the port number.
Collect Windows security logs from all the middle-tier servers and retain the logs for a period of seven
years.
Inspect inbound and outbound traffic from the front-end tier by using highly available network
appliances.
Only allow all access to all the tiers from the internal network of Contoso.

Tape backups are configured by using an on-premises deployment of Microsoft System Center Data
Protection Manager (DPM), and then shipped offsite for long term storage.
Historical Transaction Query System

Contoso recently migrated a business-critical workload to Azure. The workload contains a .NET web
service for querying the historical transaction data residing in Azure Table Storage. The .NET web service
is accessible from a client app that was developed in-house and runs on the client computers in the New
York office. The data in the table storage is 50 GB and is not expected to increase.

Current Issues

The Contoso IT team discovers poor performance of the historical transaction query system, at the queries
frequently cause table scans.

Requirements

Planned Changes

Contoso plans to implement the following changes:

Migrate the payment processing system to Azure.

Migrate the historical transaction data to Azure Cosmos DB to address the performance issues.

Migration Requirements

Contoso identifies the following general migration requirements:

Infrastructure services must remain available if a region or a data center fails. Failover must occur
without any administrative intervention.
Whenever possible, Azure managed services must be used to minimize management overhead.
Whenever possible, costs must be minimized.

Contoso identifies the following requirements for the payment processing system:

If a data center fails, ensure that the payment processing system remains available without any
administrative intervention. The middle-tier and the web front end must continue to operate without any
additional configurations.
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.
Minimize the effort required to modify the middle-tier API and the back-end tier of the payment
processing system.
Payment processing system must be able to use grouping and joining tables on encrypted columns.
Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
Ensure that the payment processing system preserves its current compliance status.
Host the middle tier of the payment processing system on a virtual machine.

Contoso identifies the following requirements for the historical transaction query system:

Minimize the use of on-premises infrastructure services.

Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
Minimize the frequency of table scans.
If a region fails, ensure that the historical transaction query system remains available without any
administrative intervention.

Information Security Requirements

The IT security team wants to ensure that identity management is performed by using Active Directory.
Password hashes must be stored on-premises only.

Access to all business-critical systems must rely on Active Directory credentials. Any suspicious
authentication attempts must trigger a multi-factor authentication prompt automatically. Legitimate users
must be able to authenticate successfully by using multi-factor authentication.
QUESTION 1
You need to recommend a compute solution for the middle tier of the payment processing system.

What should you include in the recommendation?

A. Azure Kubernetes Service (AKS)

B. virtual machine scale sets
C. availability sets
D. Function App

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 2
You need to recommend a solution for the network configuration of the front-end tier of the payment
processing.

What should you include in the recommendation?

A. Azure Application Gateway

B. Traffic Manager
C. a Standard Load Balancer
D. a Basic load Balancer

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Scenario:
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA)
of 99.99 percent availability.

With Azure Load Balancer, you can scale your applications and create high availability for your services.
Load Balancer supports inbound and outbound scenarios, provides low latency and high throughput, and
scales up to millions of flows for all TCP and UDP applications.

Azure Load Balancer is available in two SKUs: Basic and Standard. There are differences in scale,
features, and pricing. Standard SLA guarantees a 99.99% for data path with two healthy virtual machines.
Basic SLA does not exist.

Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
Design an Infrastructure Strategy

Testlet 2

Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this
exam in the time provided.

To answer the questions included in a case study, you will need to reference information that is provided in
the case study. Case studies might contain exhibits and other resources that provide more information
about the scenario that is described in the case study. Each question is independent of the other questions
in this case study.

At the end of this case study, a review screen will appear. This screen allows you to review your answers
and to make changes before you move to the next section of the exam. After you begin a new section, you
cannot return to this section.

To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to
explore the content of the case study before you answer the questions. Clicking these buttons displays
information such as business requirement, existing environment, and problem statements. If the case study
has an All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to the
question.

Overview

Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main
office in London and three branch offices in Amsterdam, Berlin, and Rome.

Existing Environment

Active Directory Environment

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com. There
are no trust relationships between the forests.

Corp.fabrikam.com is a production forest that contains identities used for internal user and computer
authentication.

Rd.fabrikam.com is used by the research and development (R&D) department only.

Network Infrastructure

Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office
contains all the domain controllers for the rd.fabrikam.com forest.

All the offices have a high-speed connection to the Internet.

An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is
used by customers to place and track orders.

WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that
runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that
run on Hyper-V.

The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.

Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software
Assurance.

Problem Statements
The use of Web App1 is unpredictable. At peak times, users often report delays. At other times, many
resources for WebApp1 are underutilized.

Requirements

Planned Changes

Fabrikam plans to move most of its production workloads to Azure during the next few years.

As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming
Microsoft Office 365 deployment.

All R&D operations will remain on-premises.

Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements

Fabrikam identifies the following technical requirements:

Web site content must be easily updated from a single point.

User input must be minimized when provisioning new app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the directory
synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not
be affected by a link failure between Azure and the on-premises network.

Database Requirements

Fabrikam identifies the following database requirements:

Database metrics for the production instance of WebApp1 must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements

Fabrikam identifies the following security requirements:

Company information including policies, templates, and data must be inaccessible to anyone outside the
company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

QUESTION 1
You need to recommend a notification solution for the IT Support distribution group.

What should you include in the recommendation?

A. Azure Network Watcher

B. an action group
C. a SendGrid account with advanced reporting
D. Azure AD Connect Health

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations
Design an Infrastructure Strategy

Question Set 3 Suresh.Palani

2020-07-28 22:25:10
QUESTION 1
--------------------------------------------
Note: This question is a part of series of questions that present the same scenario. Each question
Question Set 6 Starts
in the series contains a unique solution that might meet the stated goals. Some question sets might
Q1 -Q62
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet
the following requirements:

Provide access to the full .NET framework.

Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy a web app in an Isolated App Service plan.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, you should deploy an Azure virtual machine to two Azure regions, and you create a Traffic
Manager profile.

QUESTION 2
You are designing an Azure solution.

The network traffic for the solution must be securely distributed by providing the following features:

HTTPS protocol
Round robin routing
SSL offloading

You need to recommend a load balancing option.

What should you recommend?

A. Azure Load Balancer

B. Azure Traffic Manager
C. Azure Internal Load Balancer (ILB)
D. Azure Application Gateway

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
If you are looking for Transport Layer Security (TLS) protocol termination ("SSL offload") or per-HTTP/
HTTPS request, application-layer processing, review Application Gateway.
Application Gateway is a layer 7 load balancer, which means it works only with web traffic (HTTP, HTTPS,
WebSocket, and HTTP/2). It supports capabilities such as SSL termination, cookie-based session affinity,
and round robin for load-balancing traffic. Load Balancer load-balances traffic at layer 4 (TCP or UDP).

Reference:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

QUESTION 3
You manage a solution in Azure.

You must collect usage data including MAC addresses from all devices on the network.

You need to recommend a monitoring solution.

What should you recommend?

A. Activity Log Analytics

B. Azure Network Security Group Analytics
C. Network Performance Monitor
D. Azure Application Gateway Analytics
E. Azure Wire Data

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
A network security group (NSG) includes rules that allow or deny traffic to a virtual network subnet, network
interface, or both. When you enable diagnostic logging for an NSG, you can log the following categories of
information:

Event: Entries are logged for which NSG rules are applied to VMs, based on MAC address. The status for
these rules is collected every 60 seconds.
Rule counter: Contains entries for how many times each NSG rule is applied to deny or allow traffic.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log

QUESTION 4
A partner manages on-premises and Azure environments. The partner deploys an on-premises solution
that needs to use Azure services. The partner deploys a virtual appliance.

All network traffic that is directed to a specific subnet must flow through the virtual appliance.

You need to recommend solutions to manage network traffic.

Which two options should you recommend? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. Configure Azure Traffic Manager

B. Implement an Azure virtual network
C. Configure a routing table with forced tunneling
D. Implement Azure ExpressRoute

Correct Answer: CD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
C: Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location
via a Site-to-Site VPN tunnel for inspection and auditing. This is a critical security requirement for most
enterprise IT policies. Without forced tunneling, Internet-bound traffic from your VMs in Azure always
traverses from Azure network infrastructure directly out to the Internet, without the option to allow you to
inspect or audit the traffic.

Forced tunneling in Azure is configured via virtual network user-defined routes.

D: ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private
connection facilitated by a connectivity provider. With ExpressRoute, you can establish connections to
Microsoft cloud services, such as Microsoft Azure, Office 365, and Dynamics 365.

Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual
cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not
go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds,
lower latencies, and higher security than typical connections over the Internet.

Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction

QUESTION 5
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are migrating an on-premises application to Azure. One component of the application is a legacy
Windows native executable that performs image processing.

The image processing application must run every hour. During times that the image processing application
is not running, it should not be consuming any Azure compute resources.

You need to ensure that the image processing application runs correctly every hour.

Solution: Create an Azure Batch application that runs the image processing application every hour.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use an Azure Logic Apps, which helps you automate workflows that run on a schedule.

Reference:
https://docs.microsoft.com/en-us/azure/logic-apps/tutorial-build-schedule-recurring-logic-app-workflow

QUESTION 6
HOTSPOT

You have an Azure subscription that contains 300 Azure virtual machines that run Windows Server 2016.

You need to centrally monitor all warning events in the System logs of the virtual machines.

What should you include in the solutions? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Resource to create in Azure: Dependency Agent

The Map feature in Azure Monitor for VMs gets its data from the Microsoft Dependency agent. The
Dependency agent relies on the Log Analytics agent for its connection to Log Analytics. So your system
must have the Log Analytics agent installed and configured with the Dependency agent.

Whether you enable Azure Monitor for VMs for a single Azure VM or you use the at-scale deployment
method, use the Azure VM Dependency agent extension to install the agent as part of the experience.

In a hybrid environment, you can download and install the Dependency agent manually. If your VMs are
hosted outside Azure, use an automated deployment method

Configuration to perform on the virtual machines: Enable Virtual Machine Scale Set
To set up Azure Monitor for VMs:
Enable a single Azure VM or virtual machine scale set by selecting Insights (preview) directly from the
VM or virtual machine scale set.
Enable two or more Azure VMs and virtual machine scale sets by using Azure Policy. This method
ensures that on existing and new VMs and scale sets, the required dependencies are installed and
 properly configured. Noncompliant VMs and scale sets are reported, so you can decide whether to
enable them and to remediate them.
Enable two or more Azure VMs or virtual machine scale sets across a specified subscription or resource
group by using PowerShell.

Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/insights/vminsights-enable-overview

QUESTION 7
You plan to run an image rendering workload in Azure. The workload uses parallel compute processes.

What is the best service to use to run the workload? More than one answer choice may achieve the goal.
Select the BEST answer.

A. an Azure virtual machine scale set

B. Azure Kubernetes Service (AKS)
C. Azure Batch
D. Azure Function App

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Batch works well with intrinsically parallel (also known as "embarrassingly parallel") workloads.
Intrinsically parallel workloads are those where the applications can run independently, and each instance
completes part of the work. When the applications are executing, they might access some common data,
but they do not communicate with other instances of the application. Intrinsically parallel workloads can
therefore run at a large scale, determined by the amount of compute resources available to run applications
simultaneously.

Reference:
https://docs.microsoft.com/en-us/azure/batch/batch-technical-overview

QUESTION 8
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager
resource deployments in your subscription.

What should you include in the recommendation?

A. the Change Tracking management solution

B. Azure Activity Log
C. Application Insights
D. Azure Advisor

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
The Azure Activity Log provides insight into subscription-level events that have occurred in Azure. This
includes a range of data, from Azure Resource Manager operational data to updates on Service Health
events.

Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't
more than 90 days in the past.

Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-audit
QUESTION 9
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing a storage solution to support on-premises resources and Azure-hosted resources.

You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Blob storage in the design.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure StorSimple replicates to Azure Blob storage.

QUESTION 10
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing a storage solution to support on-premises resources and Azure-hosted resources.

You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Data Lake Storage in the design.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 11
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing a storage solution to support on-premises resources and Azure-hosted resources.
You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Table Storage in the design.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 12
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing a storage solution to support on-premises resources and Azure-hosted resources.

You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure StorSimple in the design.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 13
You use Azure virtual machines to run a custom application that uses an Azure SQL Database instance on
the back end.

The IT department at your company recently enabled forced tunneling.

Since the configuration change, developers have noticed degraded performance when they access the
database from the Azure virtual machine.

You need to recommend a solution to minimize latency when accessing the database. The solution must
minimize costs.

What should you include in the recommendation?

A. Azure SQL Database Managed Instance

B. virtual network service endpoints
C. Always On availability groups
D. Azure virtual machines that run Microsoft SQL Server servers
Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 14
DRAG DROP

You are designing a network connectivity strategy for a new Azure subscription. You identify the following
requirements:

The Azure virtual machines on a subnet named Subnet1 must be accessible only from the computers in
your London office.
Engineers require access to the Azure virtual machines on a subnet named Subnet2 over the Internet
on a specific TCP/IP management port.
The Azure virtual machines in the West Europe Azure region must be able to communicate on all ports
to the Azure virtual machines in the North Europe Azure region.

You need to recommend which components must be used to meet the requirements. The solution must
minimize costs and administrative effort whenever possible.

What should you include in the recommendation? To answer, drag the appropriate components to the
correct requirements. Each component may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 15
You develop a new Azure Web App that uses multiple Azure blobs and static content. The Web App uses a
large number of JavaScript files and cascading style sheets. Some of these files contain references to other
files. Users are geographically dispersed.

You need to minimize the time to load individual pages.

What should you do?

A. Migrate the Web App to Azure Service Fabric

B. Use an Azure Content Delivery Network (CDN)
C. Implement an Azure Redis Cache
D. Create a services layer by using an Azure-hosted ASP.NET web API
E. Enable the Always On feature of the Web App

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:

QUESTION 16
You have 100 Standard_F2s_v2 Azure virtual machines. Each virtual machine has two network adapters.

You need to increase the network performance of the workloads running on the virtual machines. The
solution must meet the following requirements:

The CPU-to-memory ratio must remain the same.

The solution must minimize costs.

What should you do?

A. Configure NIC teaming

B. Enable RDMA over InfiniBand
C. Enable SR-IOV
D. Install an additional network adapter

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its
networking performance. This high-performance path bypasses the host from the datapath, reducing
latency, jitter, and CPU utilization, for use with the most demanding network workloads on supported VM
types.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/create-vm-accelerated-networking-cli

QUESTION 17
You have a .NET web service named Service1 that has the following requirements:
 Must read and write temporary files to the local file system.
Must write to the Application event log.

You need to recommend a solution to host Service1 in Azure. The solution must meet the following
requirements:

Minimize maintenance overhead.

Minimize costs.

What should you include in the recommendation?

A. an Azure virtual machine scale set

B. an Azure function
C. an App Service Environment
D. an Azure web app

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 18
You have an Azure subscription that contains an Azure Blob storage account named store1.

You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores 500
GB of company files.

You need to store a copy of the company files in store1.

Which two possible Azure services achieve this goal? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. an Azure Import/Export job

B. an integration account
C. an Azure Batch account
D. Azure Data Factory
E. an On-premises data gateway

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 19
You have a web app named App1 that is hosted on-premises and on four Azure virtual machines. Each
virtual machine is in a different region.

You need to recommend a solution to ensure that users will always connect to the closest instance of App1.
The solution must prevent the users from attempting to connect to a failed instance of App1.

Which two possible recommendations achieve the goal? Each correct answer presents a complete
solution.

NOTE: Each correct selection is worth one point.

A. Azure Front Door Service

B. Azure Load Balancer
C. round-robin DNS
D. Azure Traffic Manager
E. Azure Application Gateway

Correct Answer: AD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 20 Suresh.Palani
HOTSPOT 2020-08-10 09:50:14
--------------------------------------------
You plan to deploy a network-intensive application to several Azure virtual machines.
Q20 - Answer
You need to recommend a solution that meets the following requirements: Compute Optimized
Standard_F8s SR-IOV
Minimizes the use of the virtual machine processors to transfer data
Minimizes network latency

Which virtual machine size and feature should you use? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-hpc#h-series

QUESTION 21
You are designing a microservices architecture that will support a web application.

The solution must meet the following requirements:

Allow independent upgrades to each microservice

Deploy the solution on-premises and to Azure
Set policies for performing automatic repairs to the microservices
Support low-latency and hyper-scale operations

You need to recommend a technology.

What should you recommend?

A. Azure Service Fabric

B. Azure Logic App
C. Azure Container Instance
D. Azure Virtual Machine Scale Set

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Service Fabric is a distributed systems platform that makes it easy to package, deploy, and manage
scalable and reliable microservices and containers.

You can use Azure Service Fabric to create Service Fabric clusters on any virtual machines or computers
running Windows Server.

Reference: https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-overview
QUESTION 22
HOTSPOT

You have an Azure environment that contains the Azure subscription and the virtual networks shown in the
following table.

You need to recommend a virtual network peering solution to ensure that the resources connected to any
other virtual network. The solution must minimize administrative effort. Which virtual network peering
topology should you recommend? To answer, select the appropriate topology in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-different-deployment-models-
portal

QUESTION 23
You are designing a solution for a company to deploy software for testing and production.

The solution must meet the following requirements:

Applications must be deployed to several different environments and must run without installation of
dependencies.
Existing published application must be ported to the new solution.
Application developers must be given flexibility when architecting their code.

You need to recommend a solution for hosting applications.

What should you select?

A. Azure worker role

B. Azure Kubernetes Service
C. Azure Functions
D. Azure Batch

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Kubernetes is open-source orchestration software for deploying, managing, and scaling containers. The
fully managed Azure Kubernetes Service (AKS) makes deploying and managing containerized applications
easy. It offers serverless Kubernetes.

Reference:
https://azure.microsoft.com/en-us/services/kubernetes-service/

QUESTION 24
You have 100 Standard_F2s_v2 Azure virtual machines. Each virtual machine has two network adapters.

You need to increase the network performance of the workloads running on the virtual machines. The
solution must meet the following requirements:

The CPU-to-memory ratio must remain the same.

The solution must minimize costs.

What should you do?

A. Configure NIC teaming

B. Enable RDMA over InfiniBand
C. Enable Accelerated Networking.
D. Install an additional network adapter

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Accelerated networking enables single root I/O virtualization (SR-IOV) to a VM, greatly improving its
networking performance. This high-performance path bypasses the host from the datapath, reducing
latency, jitter, and CPU utilization, for use with the most demanding network workloads on supported VM
types.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/create-vm-accelerated-networking-cli

QUESTION 25
HOTSPOT

You have the application architecture shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Modify the Azure Traffic Manager routing

Azure Traffic Manager supports six traffic-routing methods to determine how to route network traffic to the
various service endpoints.

Box 2: Endpoint monitor settings in the Azure Traffic Manager

Azure Traffic Manager includes built-in endpoint monitoring and automatic endpoint failover. This feature
helps you deliver high-availability applications that are resilient to endpoint failure, including Azure region
failures.

To configure endpoint monitoring, you must specify the following settings on your Traffic Manager profile:
Protocol, Port, Path, custom header settings, etc.

Reference:
https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-routing-methods

https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoring

QUESTION 26
HOTSPOT

You are designing a solution for a stateless front-end application named Application1. Application1 will be
hosted on two Azure virtual machines named VM1 and VM2.

You plan to load balance connections to VM1 and VM2 from the Internet by using one Azure load balancer.

You need to recommend the minimum number of required public IP addresses.

How many public IP addresses should you recommend using for each resource? To answer, select the
appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 27
DRAG DROP

You have an Azure subscription. The subscription contains Azure virtual machines that run Windows Server
2016 and Linux.

You need to use Azure Monitor to design an alerting strategy for security-related events.

Which Log Analytics tables should you query? To answer, drag the appropriate tables to the correct log
types. Each value may be used once, more than once, or not at all. You may need to drag the split bar
between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 28
HOTSPOT

You have the network topology shown in the following exhibit.

You have a user-defined route that has a default route of 0.0.0.0/0 and the next hop set to the network
virtual appliance.

You configure the Azure Storage account to use virtual network service endpoints.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

QUESTION 29
You are designing a container solution in Azure that will include two containers. One container will host a
web API that will be available to the public. The other container will perform health monitoring of the web
API and will remain private. The two containers will be deployed together as a group.

You need to recommend a compute service for the containers. The solution must minimize costs and
maintenance overhead.

What should you include in the recommendation?

A. Azure Service Fabric

B. Azure Container Service
C. Azure Kubernetes Service (AKS)
D. Azure Container Instances

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Container Instances supports the deployment of multiple containers onto a single host using a
container group. A container group is useful when building an application sidecar for logging, monitoring, or
any other configuration where a service needs a second attached process.

Reference:
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-multi-container-group

QUESTION 30
HOTSPOT

Your company has three branch offices and an Azure subscription. Each branch office contains a Hyper-V
host that hosts application servers.

You need to recommend a storage solution for the branch offices. The solution must ensure that the
application servers can connect to a central storage device by using iSCSI connections. Data saved to the
iSCSI storage device from the application servers must be uploaded to Azure automatically.

Which components should you include in the recommendation? To answer, select the appropriate options
in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:

Section: (none)
Explanation
Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/storsimple/storsimple-ova-overview

QUESTION 31
DRAG DROP

You have an on-premises network that uses an IP address space of 172.16.0.0/16.

You plan to deploy 25 virtual machines to a new Azure subscription.

You identify the following technical requirements:

All Azure virtual machines must be placed on the same subnet named Subnet1.
All the Azure virtual machines must be able to communicate with all on-premises servers.
The servers must be able to communicate between the on-premises network and Azure by using a site-
to-site VPN.

You need to recommend a subnet design that meets the technical requirements.

What should you include in the recommendation? To answer, drag the appropriate network addresses to
the correct subnets. Each network address may be used once, more than once, or not at all. You may need
to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
QUESTION 32
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are migrating an on-premises application to Azure. One component of the application is a legacy
Windows native executable that performs image processing.

The image processing application must run every hour. During times that the image processing application
is not running, it should not be consuming any Azure compute resources.

You need to ensure that the image processing application runs correctly every hour.

Solution: Create an Azure WebJob that runs the image processing application every hour.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use an Azure Logic Apps, which helps you automate workflows that run on a schedule.

Reference:
https://docs.microsoft.com/en-us/azure/logic-apps/tutorial-build-schedule-recurring-logic-app-workflow

QUESTION 33
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are migrating an on-premises application to Azure. One component of the application is a legacy
Windows native executable that performs image processing.

The image processing application must run every hour. During times that the image processing application
is not running, it should not be consuming any Azure compute resources.

You need to ensure that the image processing application runs correctly every hour.

Solution: Create an Azure Function to run the image processing application every hour.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead use an Azure Logic Apps, which helps you automate workflows that run on a schedule.

Reference:
https://docs.microsoft.com/en-us/azure/logic-apps/tutorial-build-schedule-recurring-logic-app-workflow

QUESTION 34
DRAG DROP

An organization has an on-premises server that runs Windows Server 2003. The server hosts an IIS-based
stateless web application that uses forms authentication. The application consists of classic Active Server
Pages (ASP) pages and third-party components (DLLs) that are registered in the Windows registry.

The deployment process for the web application is manual and is prone to errors. The deployment process
makes it difficult to roll out updates, scale out, and recover after failures.

You need to design a modernization approach for the web application that meets the following
requirements:

Improve the deployment process.

Ensure that the application can run in the cloud.
Minimize changes to application code.
Minimize administrative effort required to implement the modernization solution.

What should you recommend? To answer, drag the appropriate actions to the correct approaches. Each
action may be used once, more than once, or not at all. You may need to drag the split bar between panes
or scroll to view content.

NOTE: Each correct selection is worth point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 35 Suresh.Palani
You need to recommend a data storage solution that meets the following requirements:
2020-08-10 09:26:14
--------------------------------------------
Ensures that applications can access the data by using a REST connection
Hosts 20 independent tables of varying sizes and usage patterns Q35 - Answer B
Automatically replicates the data to a second Azure region tables in an Azure Storage account that use
Minimizes costs geo-redundantstorage (GRS)

What should you recommend?

A. an Azure SQL Database elastic database pool that uses active geo-replication
B. tables in an Azure Storage account that use geo-redundant storage (GRS)
C. tables in an Azure Storage account that use read-access geo-redundant storage (RA-GR)
D. an Azure SQL Database that uses active geo-replication

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 36
You deploy two instances of an Azure web app. One instance is in the East US Azure region and the other
instance is in the West US Azure region. The web app uses Azure Blob storage to deliver large files to end
users.

You need to recommend a solution for delivering the files to the users. The solution must meet the following
requirements:

Ensure that the users receive files from the same region as the web app that they access.
Ensure that the files only need to be updated once.
Minimize costs.

What should you include in the recommendation?

A. Azure File Sync

B. Distributed File System (DFS)
C. read-access geo-redundant storage (RA-GRS)
D. geo-redundant storage (GRS)

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 37
Your company has an on-premises Windows HPC cluster. The cluster runs an intrinsically parallel,
compute-intensive workload that performs financial risk modelling.

You plan to migrate the workload to Azure Batch.

You need to design a solution that will support the workload. The solution must meet the following
requirements:
 Support the large-scale parallel execution of Azure Batch jobs.
Minimize cost.

What should you include in the solution?

A. Basic A-series virtual machines

B. low-priority virtual machines
C. burstable virtual machines
D. Azure virtual machine sizes that support the Message Passing Interface (MPI) API

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/batch/batch-technical-overview

QUESTION 38
DRAG DROP

Your company has users who work remotely from laptops.

You plan to move some of the applications accessed by the remote users to Azure virtual machines. The
users will access the applications in Azure by using a point-to-site VPN connection. You will use certificates
generated from an on-premises-based certification authority (CA).

You need to recommend which certificates are required for the deployment.

What should you include in the recommendation? To answer, drag the appropriate certificates to the
correct targets. Each certificate may be used once, more than once, or not at all. You may need to drag the
split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 39
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are migrating an on-premises application to Azure. One component of the application is a legacy
Windows native executable that performs image processing.

The image processing application must run every hour. During times that the image processing application
is not running, it should not be consuming any Azure compute resources.

You need to ensure that the image processing application runs correctly every hour.

Solution: Create a Logic App to run the image processing application every hour.

Does the solution meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Logic Apps helps you automate workflows that run on a schedule.

Reference:
https://docs.microsoft.com/en-us/azure/logic-apps/tutorial-build-schedule-recurring-logic-app-workflow

QUESTION 40
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that wants to move a .NET Core web application from
an on-premises data center to Azure. The web application relies on a Microsoft SQL Server 2016 database
on Windows Server 2016. The database server will not move to Azure.

A separate networking team is responsible for configuring network permissions.

The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure virtual
network named VNET1.

You need to recommend a solution for deploying the web application.

Solution: Deploy the web application to a web app hosted in a Premium App Service plan. Configure VNET
Integration for the App Service plan.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:
Explanation:
VNet Integration gives your web app access to resources in your virtual network. VNet Integration is often
used to enable access from apps to a databases and web services running in your VNet.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

QUESTION 41
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that wants to move a .NET Core web application from
an on-premises data center to Azure. The web application relies on a Microsoft SQL Server 2016 database
on Windows Server 2016. The database server will not move to Azure.

A separate networking team is responsible for configuring network permissions.

The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure virtual
network named VNET1.

You need to recommend a solution for deploying the web application.

Solution: Deploy the web application by using an Azure Kubernetes Service (AKS) container on VNET1.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, use VNet Integration.
Note: VNet Integration gives your web app access to resources in your virtual network. VNet Integration is
often used to enable access from apps to a databases and web services running in your VNet.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

QUESTION 42
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You are designing an Azure solution for a company that wants to move a .NET Core web application from
an on-premises data center to Azure. The web application relies on a Microsoft SQL Server 2016 database
on Windows Server 2016. The database server will not move to Azure.

A separate networking team is responsible for configuring network permissions.

The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure virtual
network named VNET1.

You need to recommend a solution for deploying the web application.

Solution: Deploy the web application to a web app hosted in an isolated App Service plan on VNET1.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, use VNet Integration.

Note: VNet Integration gives your web app access to resources in your virtual network. VNet Integration is
often used to enable access from apps to a databases and web services running in your VNet.

Reference:
https://docs.microsoft.com/en-us/azure/app-service/web-sites-integrate-with-vnet

QUESTION 43
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet
the following requirements:

Provide access to the full .NET framework.

Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy a virtual machine scale set that uses autoscaling.
Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Instead, you should deploy an Azure virtual machine to two Azure regions, and you create a Traffic
Manager profile.

QUESTION 44
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet
the following requirements:

Provide access to the full .NET framework.

Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy an Azure virtual machine to two Azure regions, and you create a Traffic Manager
profile.

Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Need two virtual machines, not just one.

QUESTION 45
Note: This question is a part of series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet
the following requirements:

Provide access to the full .NET framework.

Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy two Azure virtual machines to two Azure regions, and you deploy an Azure Application
Gateway.
Does this meet the goal?

A. Yes
B. No

Correct Answer: B
Section: (none)
Explanation

Explanation/Reference:
Explanation:
You need to deploy two Azure virtual machine to two Azure regions, but also create a Traffic Manager
profile.

QUESTION 46
You plan to deploy an API by using Azure API Management.

You need to recommend a solution to protect the API from a distributed denial of service (DDoS) attack.

What should you recommend?

A. Create network security groups (NSGs).

B. Enable quotas.
C. Enable rate limiting.
D. Strip the Powered-By responsible header.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:

QUESTION 47
You manage on-premises networks and Azure virtual networks.

You need a secure private connection between the on-premises networks and the Azure virtual networks.
The connection must offer a redundant pair of cross connections to provide high availability.

What should you recommend?

A. ExpressRoute
B. Azure Load Balancer
C. virtual network peering
D. VPN Gateway

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 48
DRAG DROP

An organization has an on-premises server that runs Windows Server 2003. The server hosts an IIS-based
stateless web application that uses forms authentication. The application consists of classic Active Server
Pages (ASP) pages and third-party components (DLLs) that are registered in the Windows registry.
The deployment process for the web application is manual and is prone to errors. The deployment process
makes it difficult to roll out updates, scale out, and recover after failures.

You need to design a modernization approach for the web application that meets the following
requirements:

Improve the deployment process.

Ensure that the application can run in the cloud.
Minimize changes to application code.
Minimize administrative effort required to implement the modernization solution.

What should you recommend? To answer, drag the appropriate actions to the correct approaches. Each
action may be used once, more than once, or not at all. You may need to drag the split bar between panes
or scroll to view content.

NOTE: Each correct selection is worth point.

Select and Place:

Correct Answer:

Section: (none)
Explanation

Explanation/Reference:

QUESTION 49
You use a virtual network to extend an on-premises IT environment into the cloud. The virtual network has
two virtual machines (VMs) that store sensitive data.

The data must only be available using internal communication channels. Internet access to those VMs is
not permitted.

You need to ensure that the VMs cannot access the Internet.

Which two options should you recommend? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. network interface (NIC)

B. Source Network Address Translation (SNAT)
C. Azure ExpressRoute
D. Network Security Groups (NSG)

Correct Answer: CD
Section: (none)
Explanation

Explanation/Reference:

QUESTION 50
Your company plans to migrate its on-premises data to Azure.

You need to recommend which Azure services can be used to store the data. The solution must meet the
following requirements:

Encrypt all data while at rest.

Encrypt data only by using a key generated by the company.

Which two possible services can you recommend? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

A. Azure Table storage

B. Azure Backup
C. Azure Blob storage
D. Azure Queue storage
E. Azure Files

Correct Answer: CE
Section: (none)
Explanation

Explanation/Reference:
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption-customer-managed-
keys

QUESTION 51
You architect a solution that calculates 3D geometry from height-map data.

You have the following requirements:

Perform calculations in Azure.

Each node must communicate data to every other node.
Maximize the number of nodes to calculate multiple scenes as fast as possible.
Require the least amount of effort to implement.

You need to recommend a solution.

Which two actions should you recommend? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

A. Create a render farm that uses Azure Batch.

B. Enable parallel file systems on Azure.
C. Enable parallel task execution on compute nodes.
D. Create a render farm that uses virtual machine (VM) scale sets.
E. Create a render farm that uses virtual machines (VMs).

Correct Answer: AC
Section: (none)
Explanation

Explanation/Reference:

QUESTION 52
HOTSPOT

You are designing an Azure web app.

You plan to deploy the web app to the North Europe Azure region and the West Europe Azure region.

You need to recommend a solution for the web app. The solution must meet the following requirements:

Users must always access the web app from the North Europe region, unless the region fails.
The web app must be available to users if an Azure region is unavailable.
Deployment costs must be minimized.

What should you include in the recommendation? To answer, select the appropriate options in the answer
area.

NOTE: Each correct selection is worth one point.

Hot Area:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:

QUESTION 53
DRAG DROP

You need to design an architecture to capture the creation of users and the assignment of roles. The
captured data must be stored in Azure Cosmos DB.

Which Azure services should you include in the design? To answer, drag the appropriate services to the
correct targets. Each service may be used once, more than once, or not at all. You may need to drag the
split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Correct Answer:
Section: (none)
Explanation

Explanation/Reference:
Explanation:

Note: You can select Logs from either the Azure Monitor menu or the Log Analytics workspaces menu.

Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/log-query-overview

QUESTION 54
You are developing a web application that provides streaming video to users. You configure the application
to use continuous integration and deployment.

The app must be highly available and provide a continuous streaming experience for users.

You need to recommend a solution that allows the application to store data in a geographical location that is
closest to the user.
What should you recommend?

A. Azure App Service Web Apps

B. Azure App Service Isolated
C. Azure Redis Cache
D. Azure Content Delivery Network (CDN)

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Azure Content Delivery Network (CDN) is a global CDN solution for delivering high-bandwidth content. It
can be hosted in Azure or any other location. With Azure CDN, you can cache static objects loaded from
Azure Blob storage, a web application, or any publicly accessible web server, by using the closest point of
presence (POP) server. Azure CDN can also accelerate dynamic content, which cannot be cached, by
leveraging various network and routing optimizations.

Reference:
https://docs.microsoft.com/en-in/azure/cdn/

QUESTION 55
HOTSPOT

Your company deploys an Azure App Service Web App.

During testing the application fails under load. The application cannot handle more than 100 concurrent
user sessions. You enable the Always On feature. You also configure auto-scaling to increase instance
counts from two to 10 based on HTTP queue length.

You need to improve the performance of the application.

Which solution should you use for each application scenario? To answer, select the appropriate options in
the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:
Correct Answer:

Section: (none)
Explanation

Explanation/Reference:
Explanation:

Box 1: Content Delivery Network

A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content
to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to
end users, to minimize latency.
Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering high-
bandwidth content to users by caching their content at strategically placed physical nodes across the world.
Azure CDN can also accelerate dynamic content, which cannot be cached, by leveraging various network
optimizations using CDN POPs. For example, route optimization to bypass Border Gateway Protocol
(BGP).

Box 2: Azure Redis Cache

Azure Cache for Redis is based on the popular software Redis. It is typically used as a cache to improve
the performance and scalability of systems that rely heavily on backend data-stores. Performance is
improved by temporarily copying frequently accessed data to fast storage located close to the application.
With Azure Cache for Redis, this fast storage is located in-memory with Azure Cache for Redis instead of
being loaded from disk by a database.

Reference:
https://docs.microsoft.com/en-us/azure/azure-cache-for-redis/cache-overview

QUESTION 58
You are developing a sales application that will contain several Azure cloud services and will handle
different components of a transaction. Different cloud services will process customer orders, billing,
payment, inventory, and shipping.

You need to recommend a solution to enable the cloud services to asynchronously communicate
transaction information by using REST messages.

What should you include in the recommendation?

A. Azure Data Lake

B. Azure Service Fabric
C. Azure Service Bus
D. Azure Notification Hubs

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Service Bus is a transactional message broker and ensures transactional integrity for all internal operations
against its message stores. All transfers of messages inside of Service Bus, such as moving messages to
a dead-letter queue or automatic forwarding of messages between entities, are transactional.

Incorrect Answers:
D: Azure Notification Hubs is a massively scalable mobile push notification engine for quickly sending
millions of notifications to iOS, Android, Windows, or Kindle devices.

References:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-transactions

QUESTION 59
Use the following login credentials as needed:

To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]

Azure Password: KJn29!aBBB

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new
browser tab.

The following information is for technical support purposes only:

Lab Instance: 10989444
You need to recommend a networking solution to ensure that NWVM1 and NWVM3 can successfully
establish network connections to one another. The solution must be implemented as quickly as possible.

What should you include in the recommendation?

NOTE: To answer this question, sign in to the Azure portal and explore an Azure resource group
named ResourceGroup1lod10989444.

A. two Azure firewalls

B. two network security groups (NSGs)
C. two virtual network peerings
D. two local network gateways and one site-to-site VPN

Correct Answer: D
Section: (none)
Explanation

Explanation/Reference:
Reference: Suresh.Palani
https://azure.microsoft.com/es-es/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-different-
2020-08-10 08:03:19
regions/
--------------------------------------------
QUESTION 60 SIMULATION Q59-Q59 Ends
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must meet
the following requirements:

Provide access to the full .NET framework.

Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager
profile.

Does this meet the goal?

A. Yes
B. No

Correct Answer: A
Section: (none)
Explanation

Explanation/Reference:

QUESTION 61
Suresh.Palani
Use the following login credentials as needed:
2020-08-10 08:05:01
--------------------------------------------
To enter your username, place your cursor in the Sign in box and click on the username below.
SIMULATION Q61-Q62 Starts
To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]

Azure Password: KJn29!aBBB
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new
browser tab.

The following information is for technical support purposes only:

Lab Instance: 10989444
You need to add an additional network interface to NWVM2.

What should you do first?

NOTE: To answer this question, sign in to the Azure portal and explore an Azure resource group
named ResourceGroup1lod10989444.

A. Connect NWVM2NetworkInterface2 to a load balancer.

B. Add a new virtual network.
C. Modify the virtual machine size.
D. Add a subnet to NWDemoRG_VNET.

Correct Answer: C
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Constraints on adding a network interface card to a VM:
A VM must have at least one network interface attached to it.
A VM can only have as many network interfaces attached to it as the VM size supports.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-vm#constraints

QUESTION 62
Use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.

To enter your password, place your cursor in the Enter password box and click on the password below.

Azure Username: [email protected]

Azure Password: KJn29!aBBB

If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new
browser tab.

The following information is for technical support purposes only:

Lab Instance: 10989444
You need to ensure that remote SSH connections can be established securely from the Internet to
NWVM3.

Which two actions should you perform? Each correct answer presents part of the solution. (Choose two.)

NOTE: Each correct selection is worth one point.

NOTE: To answer this question, sign in to the Azure portal and explore an Azure resource group
named ResourceGroup1lod10989444.

A. Deploy a network security group (NSG), and then attach the NSG to NWVM3NetworkInterface.
B. Deploy an application gateway that contains a publish rule.
C. Deploy a load balancer that contains a NAT rule, and then add NWVM3NetworkInterface to the backend
pool.
D. Move NWVM3NetworkInterface to NWDemoRG_VNET.
E. Deploy a gateway subnet, and then attach NWVM3PubIP to the subnet.

Correct Answer: CD
Section: (none)
Explanation

Explanation/Reference:
Explanation:
Internal load balancer. Network traffic from the VPN gateway is routed to the cloud application through an
internal load balancer. The load balancer is located in the front-end subnet of the application.

Incorrect Answers:
A, E: Do not deploy any VMs to the gateway subnet. Also, do not assign an NSG to this subnet, as it will
cause the gateway to stop functioning.
Suresh.Palani
2020-08-10 08:05:31
Reference: --------------------------------------------
Suresh.Palani
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn
2020-08-10 13:10:03
SIMULATION Q61-Q62 Ends
--------------------------------------------
Question Set 6 Ends
Q1 - Q62
Question #2

Your company uses Microsoft System Center "" Service Manager on its on-premises network.
You plan to deploy several services to Azure.
You need to recommend a solution to push Azure service health alerts to Service Manager.
What should you include in the recommendation?
• A. Azure Notification Hubs
• B. Azure Event Hubs
• C. IT Service Management Connector (ITSM)
• D. Application Insights Connector

Answer:
C. IT Service Management Connector (ITSM)

Question #6

You need to recommend a solution to generate a monthly report of all the new Azure Resource
Manager resource deployments in your subscription.
What should you include in the recommendation?
• A. Azure Analysis Services
• B. Azure Activity Log
• C. Azure Monitor action groups
• D. Azure Advisor
• E. Azure Monitor metrics
• F. Azure Log Analytics
• G. Application Insights

Answer-
B. Azure Activity Log

Question #7

HOTSPOT -
You have an Azure App Service Web App that includes Azure Blob storage and an Azure SQL
Database instance. The application is instrumented by using the
Application Insights SDK.
You need to design a monitoring solution for the web app.
Which Azure monitoring services should you use? To answer, select the appropriate Azure
monitoring services in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

1) Azure Log Analytics (Correlation )

2) Azure Service Map (Visualization)
3) Azure Application Insight (App code)
4) Azure Application Insight (User behavior on app / web page)

Question #13

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure subscription named Project1. Only a group named Project1admins is assigned
roles in the Project1 subscription. The Project1 subscription contains all the resources for an
application named Application1.
Your company is developing a new application named Application2. The members of the
Application2 development team belong to an Azure Active Directory
(Azure AD) group named App2Dev.
You identify the following requirements for Application2:
✑ Identify any AD FS issues and their potential resolutions. The members of App2Dev must be prevented from changing the role assignments in Azure.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The members of App2Dev must be able to create new Azure resources required by Application2.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. All the required role assignments for Application2 will be performed by the members of
Project1admins.
You need to recommend a solution for the role assignments of Application2.

Solution: Create a new Azure subscription named Project2. Assign Project1admins the User Access
Administrator role for the Project2 subscription. Assign
App2Dev the Owner role for the Project2 subscription.

Does this meet the goal?

• A. Yes
• B. No

Answer-

B- No

Question #19

HOTSPOT -
Your company has an API that returns XML data to internal applications.
You plan to migrate the applications to Azure. You also plan to allow the company's partners to
access the API.
You need to recommend an API management solution that meets the following requirements:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Internal applications must receive data in the JSON format once the applications migrate to
Azure.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Partner applications must have their header information stripped before the applications receive
the data.
What should you include in the recommendation? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

Box1 - 1
Box2 - 2
Box3 – 2

Question #20

You have an Azure subscription.

You need to recommend a solution to provide developers with the ability to provision Azure virtual
machines. The solution must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Only allow the creation of the virtual machines in specific regions.
✑ Identify any AD FS issues and their potential resolutions. Only allow the creation of specific sizes of virtual machines.

What should include in the recommendation?

 • A. conditional access policies
• B. Azure Policy
• C. Azure Resource Manager templates
• D. role-based access control (RBAC)

Answer

B. Azure Policy

Question #32

HOTSPOT -
You manage a network that includes an on-premises Active Directory Domain Services domain and
an Azure Active Directory (Azure AD).
Employees are required to use different accounts when using on-premises or cloud resources. You
must recommend a solution that lets employees sign in to all company resources by using a single
account. The solution must implement an identity provider.
You need provide guidance on the different identity providers.
How should you describe each identity provider? To answer, select the appropriate description from
each list in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Question #44

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
Your company has deployed several virtual machines (VMs) on-premises and to Azure. Azure
ExpressRoute has been deployed and configured for on-premises to Azure connectivity.
Several VMs are exhibiting network connectivity issues.
You need to analyze the network traffic to determine whether packets are being allowed or denied to
the VMs.
Solution: Use Azure Advisor to analyze the network traffic.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #52

You are designing a security solution for a company's Azure Active Directory (Azure AD). The
company currently uses Azure AD Premium for all employees.
Contractors will periodically access the corporate network based on demand.
You must ensure that all employees and contractors are required to log on by using two-factor
authentication. The solution must minimize costs.
You need to recommend a solution.
What should you recommend?
• A. Purchase Azure Multi-Factor Authentication licenses for the employees and the
contractors
• B. Use the Multi-Factor Authentication provider in Azure and configure the usage model for
each authentication type
• C. Use the Multi-Factor Authentication provider in Azure and configure the usage model for
each enabled user
• D. Purchase Azure Multi-Factor Authentication licenses for the contractors only

Answer-

B. Use the Multi-Factor Authentication provider in Azure and configure the usage model for each
enabled user
Check Once – B also correct...

Question #68

HOTSPOT -

Your company deploys several Linux and Windows virtual machines (VMs) to Azure. The VMs are
deployed with the Microsoft Dependency Agent and the Log
Analytics Agent installed by using Azure VM extensions. On-premises connectivity has been
enabled by using Azure ExpressRoute.
You need to design a solution to monitor the VMs.
Which Azure monitoring services should you use? To answer, select the appropriate Azure
monitoring services in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer-
Question #73

HOTSPOT -
You plan to deploy the backup policy shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Question #74

You plan to use Azure Site Recovery to protect several on-premises physical server workloads.
Each server workload is independent of the other. The workloads are stateless.
You need to recommend a failover strategy to ensure that if the on-premises data center fails, the
workloads are available in Azure as quickly as possible.
Which failover strategy should you include in the recommendation?
• A. Latest
• B. Latest app-consistent
• C. Latest multi-VM processed
• D. Latest processed

Answer-

D. Latest processed

Question #75

DRAG DROP -
Your company identifies the following business continuity and disaster recovery objectives for
virtual machines that host sales, finance, and reporting applications in the company's on-premises
data center:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The finance application requires that data be retained for seven years. In the event of a disaster,
the application must be able to run from Azure. The recovery time objective (RTO) is 10 minutes.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The reporting application must be able to recover point-in-time data at a daily granularity. The
RTO is eight hours.
✑ Identify any AD FS issues and their potential resolutions. The sales application must be able to fail over to a second on-premises data center.
You need to recommend which Azure services meet the business continuity and disaster recovery
objectives. The solution must minimize costs.
What should you recommend for each application? To answer, drag the appropriate services to the
correct applications. Each service may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-

Box1 - Sales – Azure Site Recovery only (ASR)

Box2 - Finance - Azure Site Recovery and Azure Backup (ASR + Backup)
Box3 - Reporting – Azure Backup Only

Question #76

You plan to move a web application named App1 from an on-premises data center to Azure.
App1 depends on a custom COM component that is installed on the host server.
You need to recommend a solution to host App1 in Azure. The solution must meet the following
requirements:
✑ Identify any AD FS issues and their potential resolutions. App1 must be available to users if an Azure data center becomes unavailable.
✑ Identify any AD FS issues and their potential resolutions. Costs must be minimized.

What should you include in the recommendation?

• A. In two Azure regions, deploy a Traffic Manager profile and a web app.
• B. In two Azure regions, deploy a load balancer and a virtual machine scale set.
• C. Deploy a load balancer and a virtual machine scale set across two availability zones.
• D. In two Azure regions, deploy a load balancer and a web app.
Answer-

C- Deploy a load balancer and a virtual machine scale set across two availability zones.

Question #85

DRAG DROP -
You plan to import data from your on-premises environment into Azure. The data is shown in the
following table.
What should you recommend using to migrate the data? To answer, drag the appropriate tools to the
correct data sources. Each tool may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-

Question #86

You have an on-premises deployment of MongoDB.

You plan to migrate MongoDB to an Azure Cosmos DB account that uses the MongoDB API.
You need to recommend a solution for migrating MongoDB to Azure Cosmos DB.
What should you include in the recommendation?
• A. mongorestore
• B. Data Migration Assistant
• C. Azure Storage Explorer
• D. Azure Cosmos DB Data Migration Tool
Answer-

D. Azure Cosmos DB Data Migration Tool

Question #87

Your company plans to publish APIs for its services by using Azure API Management.
You discover that service responses include the AspNet-Version header.
You need to recommend a solution to remove AspNet-Version from the response of the published
APIs.
What should you include in the recommendation?
• A. a new product
• B. a modification to the URL scheme
• C. a new policy
• D. a new revision
Answer-

C. a new policy

Question #88

Your company has 300 virtual machines hosted in a Vmware environment. The virtual machines
vary in size and have various utilization levels.
You plan to move all the virtual machines to Azure.
You need to recommend how many and what size Azure virtual machines will be required to move
the current workloads to Azure. The solution must minimize administrative effort.

What should you use to make the recommendation?

• A. Azure Advisor
• B. Azure Migrate
• C. Azure Pricing calculator
• D. Azure Cost Management

Answer-

B. Azure Migrate

Question #89
Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing an Azure solution for a company that wants to move a .NET Core web
application from an on-premises data center to Azure. The web application relies on a Microsoft
SQL Server 2016 database on Windows Server 2016. The database server will not move to Azure.
A separate networking team is responsible for configuring network permissions.
The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure
virtual network named VNET1.
You need to recommend a solution for deploying the web application.
Solution:
Deploy the web application to a web app hosted in a Standard App Service plan. Create and
configure an Azure App Service Hybrid Connections endpoint.
On the on-premises network, deploy the Hybrid Connection Manager. Configure the Hybrid
Connection Manager to access both the Hybrid Connection endpoint and the SQL Server instance.

Does this meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #90

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
A company has custom ASP.NET and Java applications that run old versions of Windows and
Linux. The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for
the applications. The solution must support storage orchestration.
Solution: You create an Azure virtual network, public IP address, and load balancer. Then add
virtual machines (VMs) to the solution and deploy individual containers on them.
Does the solution meet the goal?
• A. Yes
• B. No
Answer-

B. No

Question #91

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
A company has custom ASP.NET and Java applications that run old versions of Windows and
Linux. The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for
the applications. The solution must support storage orchestration.
Solution: Deploy a Kubernetes cluster that has the desired number of instances of the applications.
Does the solution meet the goal?
• A. Yes
• B. No

Answer-

A. Yes

Question #92

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
A company has custom ASP.NET and Java applications that run old versions of Windows and
Linux. The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for
the applications. The solution must support storage orchestration.
Solution: You deploy each application to an Azure Container instance.

Does the solution meet the goal?

• A. Yes
• B. No
Answer-
B. No

Question #93

HOTSPOT -
You have a web application that uses a MongoDB database. You plan to migrate the web
application to Azure.
You must migrate to Cosmos DB while minimizing code and configuration changes.
You need to design the Cosmos DB configuration.
What should you recommend? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Box1 Database &
Box2 MongoDB API

Question #94

You manage an application instance. The application consumes data from multiple databases.
Application code references database tables using a combination of the server, database, and table
name.
You need to migrate the application instance to Azure.
What are two possible ways to achieve this goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
• A. SQL Server Stretch Database
• B. SQL Server in an Azure virtual machine
• C. Azure SQL Database
• D. SQL Managed Instance

Answer-

• B. SQL Server in an Azure virtual machine

• D. SQL Managed Instance

Question #95

You have 100 Microsoft SQL Server Integration Services (SSIS) packages that are configured to
use 10 on-premises SQL Server databases as their destinations.
You plan to migrate the 10 on-premises databases to Azure SQL Database.
You need to recommend a solution to host the SSIS packages in Azure. The solution must ensure
that the packages can target the SQL Database instances as their destinations.
What should you include in the recommendation?
• A. SQL Server Migration Assistant (SSMA)
• B. Azure Data Factory
• C. Data Migration Assistant
• D. Azure Data Catalog

Answer-

B. Azure Data Factory

Question #96

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
A company has custom ASP.NET and Java applications that run on old versions of Windows and
Linux. The company plans to place applications in containers.
You need to design a solution that includes networking, service discovery, and load balancing for
the applications. The solution must support storage orchestration.

Solution: You deploy each application to an Azure Web App that has container support.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #98

HOTSPOT -
Your company develops a web service that is deployed to an Azure virtual machine named VM1.
The web service allows an API to access real-time data from
VM1.
The current virtual machine deployment is shown in the Deployment exhibit. (Click the
Deployment tab).
The chief technology officer (CTO) sends you the following email message: "Our developers have
deployed the web service to a virtual machine named VM1.
Testing has shown that the APIs is accessible from VM1 and VM2. Our partners must be able to
connect to the API over the Internet. Partners will use this data in application that they develop".
You deploy an Azure API Management (APIM) service. The relevant API Management
configuration is shown in the API exhibit. (Click the API tab).

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Question #99

HOTSPOT -
You have the application architecture shown in the following exhibit.

Use the drop-down menus to select choice that completes each statement based on the information
presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Question #100

HOTSPOT -
You are designing a solution for a stateless front-end application named Application1. Application1
will be hosted on two Azure virtual machines named VM1 and
VM2.
You plan to load balance connections to VM1 and VM2 from the Internet by using one Azure load
balancer.
You need to recommend the minimum number of required public IP addresses.
How many public IP addresses should you recommend using for each resource? To answer, select
the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-
Question #101

You need to recommend a data storage solution that meets the following requirements:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Ensures that application can access the data by using a REST connection
Hosts 20 independent tables of varying sizes and usage patterns
✑ Identify any AD FS issues and their potential resolutions. Automatically replicates the data to a second Azure region
✑ Identify any AD FS issues and their potential resolutions. Minimizes costs

What should you recommend?

• A. an Azure SQL Database elastic database pool that uses active geo-replication
• B. tables in an Azure Storage account that uses geo-redundant storage (GRS)
• C. tables in an Azure Storage account that use read-access geo-redundant storage (RA-GR)
• D. an Azure SQL database that uses active geo-replication

Answer-

B. tables in an Azure Storage account that uses geo-redundant storage (GRS)

Explaination:
You are so wrong mate. 2nd replica can be - your data replicated in the same data center - your data
replicated in another data center in the same region - your data replicated in another data center in
another region These are then the different levels which you need for your disaster strategy. If a
region fails, the first two options are not helpful. GRS and RA-GRS both mean the third option.
However, in GRS you would only be able to read from the fall back location once the disaster
occured and first data source becomes unavailble. The RA-GRS however, gives you a way to read
from the 2nd location already which is useful in same cases but more expensive than simply GRS.
Here, we do not have a requirement to read data from the 2nd location while the first is still actively
working. Hence B is the cheaper option.

Question #102

You deploy two instances of an Azure web app. One instance is in the East US Azure region and the
other instance is in the West US Azure region. The web app uses Azure Blob storage to deliver large
files to end users.
You need to recommend a solution for delivering the files to the users. The solution must meet the
following requirements:
✑ Identify any AD FS issues and their potential resolutions. Ensure that the users receive files from the same region as the web app that they access.
✑ Identify any AD FS issues and their potential resolutions. Ensure that the files only need to be updated once.
✑ Identify any AD FS issues and their potential resolutions. Minimize costs.

What should you include in the recommendation?

• A. Azure File Sync
• B. Distributed File System (DFS)
• C. read-access geo-redundant storage (RA-GRS)
• D. geo-redundant storage (GRS)

Answer-

C. read-access geo-redundant storage (RA-GRS)

Explaination-

RA-GRS is correct answer as the data would be readily accessible in the second region. In case of
GRS, data is accessible in the second region only in case of a failover. See link:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs GRS replicates
your data to another data center in a secondary region, but that data is available to be read only if
Microsoft initiates a failover from the primary to secondary region
Question #103

Your company has an on-premises Windows HPC cluster. The cluster runs an intrinsically parallel,
compute-intensive workload that performs financial risk modelling.
You plan to migrate the workload to Azure Batch.
You need to design a solution that will support the workload. The solution must meet the following
requirements:
✑ Identify any AD FS issues and their potential resolutions. Support the large-scale parallel execution of Azure Batch jobs.
✑ Identify any AD FS issues and their potential resolutions. Minimize cost.

What should you include in the solution?

• A. Basic A-series virtual machines
• B. low-priority virtual machines
• C. burstable virtual machines
• D. Azure virtual machine sizes that support the Message Passing Interface (MPI) API

Answer-

B. low-priority virtual machines

Question #104

DRAG DROP -
Your company has users who work remotely from laptops.
You plan to move some of the applications accessed by the remote users to Azure virtual machines.
The users will access the applications in Azure by using a point-to-site VPN connection. You will
use certificates generated from an on-premises-based certification authority (CA).
You need to recommend which certificates are required for the deployment.
What should you include in the recommendation? To answer, drag the appropriate certificates to the
correct targets. Each certificate may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-

Question #105

DRAG DROP -
You have an Azure subscription. The subscription contains Azure virtual machines that run
Windows Server 2016 and Linux.
You need to use Azure Log Analytics design an alerting strategy for security-related events.
Which Log Analytics tables should you query? To answer, drag the appropriate tables to the correct
log types. Each value may be used once, more than once, or not at all. You may need to drag the
split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer

Question #106

HOTSPOT -
You have the network topology shown in the following exhibit.
You have a user-defined route that has a default route of 0.0.0.0/0 and the next hop set to the
network virtual appliance.
You configure the Azure Storage account to use virtual network service endpoints.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer-

Question #107

You are designing a container solution in Azure that will include two containers. One container will
host a web API that will be available to the public. The other container will perform health
monitoring of the web API and will remain private. The two containers will be deployed together as
a group.
You need to recommend a compute service for the containers. The solution must minimize costs and
maintenance overhead.

What should you include in the recommendation?

• A. Azure Service Fabric
• B. Azure Container Service
• C. Azure Kubernetes Service (AKS)
• D. Azure Container Instances

Answer-

D. Azure Container Instances

Question #108

HOTSPOT -
Your company has three branch offices and an Azure subscription. Each branch office contains a
Hyper-V host that hosts application servers.
You need to recommend a storage solution for the branch offices. The solution must ensure that the
application servers can connect to a central storage device by using iSCSI connections. Data saved
to the iSCSI storage device from the application servers must be uploaded to Azure automatically.
Which components should you include in the recommendation? To answer, select the appropriate
options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

Question #109

DRAG DROP -
You have an on-premises network that uses an IP address space of 172.16.0.0/16.
You plan to deploy 25 virtual machines to a new Azure subscription.
You identify the following technical requirements:
✑ Identify any AD FS issues and their potential resolutions. All Azure virtual machines must be placed on the same subnet named Subnet1.
✑ Identify any AD FS issues and their potential resolutions. All the Azure virtual machines must be able to communicate with all on-premises servers.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The servers must be able to communicate between the on-premises network and Azure by using
a site-to-site VPN.
You need to recommend a subnet design that meets the technical requirements.
What should you include in the recommendation? To answer, drag the appropriate network
addresses to the correct subnets. Each network address may be used once, more than once, or not at
all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-

Question #110

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are migrating an on-premises application to Azure. One component of the application is a
legacy Windows native executable that performs image processing.
The image processing application must run every hour. During times that the image processing
application is not running, it should not be consuming any Azure compute resources.
You need to ensure that the image processing application runs correctly every hour.
Solution: Create an Azure WebJob that runs the image processing application every hour.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #111

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are migrating an on-premises application to Azure. One component of the application is a
legacy Windows native executable that performs image processing.
The image processing application must run every hour. During times that the image processing
application is not running, it should not be consuming any Azure compute resources.
You need to ensure that the image processing application runs correctly every hour.
Solution: Create an Azure Function to run the image processing application every hour.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

A. Yes

Question #112
Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are migrating an on-premises application to Azure. One component of the application is a
legacy Windows native executable that performs image processing.
The image processing application must run every hour. During times that the image processing
application is not running, it should not be consuming any Azure compute resources.
You need to ensure that the image processing application runs correctly every hour.
Solution: Create a Logic App to run the image processing application every hour.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #113

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing an Azure solution for a company that wants to move a .NET Core web
application from an on-premises data center to Azure. The web application relies on a Microsoft
SQL Server 2016 database on Windows Server 2016. The database server will not move to Azure.
A separate networking team is responsible for configuring network permissions.
The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure
virtual network named VNET1.
You need to recommend a solution for deploying the web application.

Solution: Deploy the web application to a web app hosted in a Premium App Service plan.
Configure VNET Integration for the App Service plan.

Does this meet the goal?

• A. Yes
• B. No
Answer-

A. Yes

Question #114

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing an Azure solution for a company that wants to move a .NET Core web
application from an on-premises data center to Azure. The web application relies on a Microsoft
SQL Server 2016 database on Windows Server 2016. The database server will not move to Azure.
A separate networking team is responsible for configuring network permissions.
The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure
virtual network named VNET1.
You need to recommend a solution for deploying the web application.

Solution: Deploy the web application by using an Azure Kubernetes Service (AKS) container on
VNET1.

Does this meet the goal?

• A. Yes
• B. No

Answer

B. No

Question #115

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing an Azure solution for a company that wants to move a .NET Core web
application from an on-premises data center to Azure. The web application relies on a Microsoft
SQL Server 2016 database on Windows Server 2016. The database server will not move to Azure.
A separate networking team is responsible for configuring network permissions.
The company uses Azure ExpressRoute and has an ExpressRoute gateway connected to an Azure
virtual network named VNET1.
You need to recommend a solution for deploying the web application.

Solution: Deploy the web application to a web app hosted in an isolated App Service plan on
VNET1.

Does this meet the goal?

• A. Yes
• B. No

Answer-

B. No (Check once on certbolt)

Question #116

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution
must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Provide access to the full .NET framework.
✑ Identify any AD FS issues and their potential resolutions. Provide redundancy if an Azure region fails.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy a virtual machine scale set that uses autoscaling.

Does this meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #117

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution
must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Provide access to the full .NET framework.
✑ Identify any AD FS issues and their potential resolutions. Provide redundancy if an Azure region fails.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy an Azure virtual machine to two Azure regions, and you create a Traffic
Manager profile.

Does this meet the goal?

• A. Yes
• B. No

Answer-

A. Yes

Question #118

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution
must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Provide access to the full .NET framework.
✑ Identify any AD FS issues and their potential resolutions. Provide redundancy if an Azure region fails.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy an Azure virtual machine to two Azure regions, and you deploy an Azure
Application Gateway.

Does this meet the goal?

• A. Yes
• B. No

Answer-
B. No

Question #119

You plan to deploy an API by using Azure API Management.

You need to recommend a solution to protect the API from a distributed denial of service (DDoS)
attack.

What should you recommend?

• A. Create network security groups (NSGs).
• B. Enable quotas.
• C. Enable rate limiting.
• D. Strip the Powered-By responsible header.

Answer

A. Create network security groups (NSGs).

Check once – C is also correct

Question #120

You manage on-premises networks and Azure virtual networks.

You need a secure private connection between the on-premises networks and the Azure virtual
networks. The connection must offer a redundant pair of cross connections to provide high
availability.

What should you recommend?

• A. ExpressRoute
• B. Azure Load Balancer
• C. virtual network peering
• D. VPN Gateway

Answer-

A. ExpressRoute
Question #121

DRAG DROP -
An organization has an on-premises server that runs Windows Server 2003. The server hosts an IIS-
based stateless web application that uses forms authentication. The application consists of classic
Active Server Pages (ASP) pages and third-party components (DLLs) that are registered in the
Windows registry.
The deployment process for the web application is manual and is prone to errors. The deployment
process makes it difficult to roll out updates, scale out, and recover after failures.
You need to design a modernization approach for the web application that meets the following
requirements:
✑ Identify any AD FS issues and their potential resolutions. Improve the deployment process.
✑ Identify any AD FS issues and their potential resolutions. Ensure that the application can run in the cloud.
✑ Identify any AD FS issues and their potential resolutions. Minimize changes to application code.
✑ Identify any AD FS issues and their potential resolutions. Minimize administrative effort required to implement the modernization solution.
What should you recommend? To answer, drag the appropriate actions to the correct approaches.
Each action may be used once, more than once, or not at all.
You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth point.
Select and Place:

Answer-
Question #122

You use a virtual network to extend an on-premises IT environment into the cloud. The virtual
network has two virtual machines (VMs) that store sensitive data.
The data must only be available using internal communication channels. Internet access to those
VMs is not permitted.
You need to ensure that the VMs cannot access the Internet.
Which two options should you recommend? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

• A. network interface (NIC)
• B. Source Network Address Translation (SNAT)
• C. Azure ExpressRoute
• D. Network Security Groups (NSG)

Answer-

C. Azure ExpressRoute
D. Network Security Groups (NSG)

Question #123

Your company plans to migrate its on-premises data to Azure.

You need to recommend which Azure services can be used to store the data. The solution must meet
the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Encrypt all data while at rest.
✑ Identify any AD FS issues and their potential resolutions. Encrypt data only by using a key generated by the company.
Which two possible services can you recommend? Each correct answer presents a complete
solution.
NOTE: Each correct selection is worth one point.
• A. Azure Table storage
• B. Azure Backup
• C. Azure Blob storage
• D. Azure Queue storage
• E. Azure Files

Answer-

C. Azure Blob storage

E. Azure Files

Question #124

You architect a solution that calculates 3D geometry from height-map data.

You have the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Perform calculations in Azure.
✑ Identify any AD FS issues and their potential resolutions. Each node must communicate data to every other node.
✑ Identify any AD FS issues and their potential resolutions. Maximize the number of nodes to calculate multiple scenes as fast as possible.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Require the least amount of effort to implement.
You need to recommend a solution.
Which two actions should you recommend? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• A. Create a render farm that uses Azure Batch.
• B. Enable parallel file systems on Azure.
• C. Enable parallel task execution on compute nodes.
• D. Create a render farm that uses virtual machine (VM) scale sets.
• E. Create a render farm that uses virtual machines (VMs).

Answer

A. Create a render farm that uses Azure Batch.

C. Enable parallel task execution on compute nodes.

Question #125

HOTSPOT -
You are designing an Azure web app.
You plan to deploy the web app to the North Europe Azure region and the West Europe Azure
region.
You need to recommend a solution for the web app. The solution must meet the following
requirements:
✑ Identify any AD FS issues and their potential resolutions. Users must always access the web app from the North Europe region, unless the region fails.
✑ Identify any AD FS issues and their potential resolutions. The web app must be available to users if an Azure region is unavailable.
✑ Identify any AD FS issues and their potential resolutions. Deployment costs must be minimized.
What should you include in the recommendation? To answer, select the appropriate options in the
answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Answer-
Question # 126

DRAG DROP -
You need to design an architecture to capture the creation of users and the assignment of roles. The
captured data must be stored in Azure Cosmos DB.
Which Azure services should you include in the design? To answer, drag the appropriate services to
the correct targets. Each service may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer
Question #127

You are developing a web application that provides streaming video to users. You configure the
application to use continuous integration and deployment.
The app must be highly available and provide a continuous streaming experience for users.
You need to recommend a solution that allows the application to store data in a geographical
location that is closest to the user.

What should you recommend?

• A. Azure App Service Web Apps
• B. Azure App Service Isolated
• C. Azure Redis Cache
• D. Azure Content Delivery Network (CDN)
Answer-

D. Azure Content Delivery Network (CDN)

Question #128

HOTSPOT -
Your company deploys an Azure App Service Web App.
During testing the application fails under load. The application cannot handle more than 100
concurrent user sessions. You enable the Always On feature. You also configure auto-scaling to
increase counts from two to 10 based on HTTP queue length.
You need to improve the performance of the application.
Which solution should you use for each application scenario? To answer, select the appropriate
options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

Answer-
Question #129

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution
must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Provide access to the full .NET framework.
✑ Identify any AD FS issues and their potential resolutions. Provide redundancy if an Azure region fails.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Grant administrators access to the operating system to install custom application dependencies.

Solution: You deploy a web app in an Isolated App Service plan.

Does this meet the goal?

• A. Yes
• B. No

Answer-

B. No
Question #130

You are designing an Azure solution.

The network traffic for the solution must be securely distributed by providing the following
features:

HTTPS protocol -
✑ Identify any AD FS issues and their potential resolutions. Round robin routing
✑ Identify any AD FS issues and their potential resolutions. SSL offloading
You need to recommend a load balancing option.

What should you recommend?

• A. Azure Load Balancer
• B. Azure Traffic Manager
• C. Azure Internal Load Balancer (ILB)
• D. Azure Application Gateway

Answer-

D. Azure Application Gateway

Question #131

You manage a solution in Azure.

You must collect usage data including MAC addresses from all devices on the network.
You need to recommend a monitoring solution.

What should you recommend?

• A. Activity Log Analytics
• B. Azure Network Security Group Analytics
• C. Network Performance Monitor
• D. Azure Application Gateway Analytics
• E. Azure Wire Data

Answer-

B. Azure Network Security Group Analytics

Question #132

A partner manages on-premises and Azure environments. The partner deploys an on-premises
solution that needs to use Azure services. The partner deploys a virtual appliance.
All network traffic that is directed to a specific subnet must flow through the virtual appliance.
You need to recommend solutions to manage network traffic.

Which two options should you recommend? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

• A. Configure Azure Traffic Manager
• B. Implement an Azure virtual network
• C. Configure a routing table with forced tunneling
• D. Implement Azure ExpressRoute

Answer-

C. Configure a routing table with forced tunneling

D. Implement Azure ExpressRoute

Question #133

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are migrating an on-premises application to Azure. One component of the application is a
legacy Windows native executable that performs image processing.
The image processing application must run every hour. During times that the image processing
application is not running, it should not be consuming any Azure compute resources.
You need to ensure that the image processing application runs correctly every hour.

Solution: Create an Azure Batch application that runs the image processing application every hour.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

A. Yes (check once)

Question #135

You plan to run an image rendering workload in Azure. The workload uses parallel compute
processes.
What is the best service to use to run the workload? More than one answer choice may achieve the
goal. Select the BEST answer.
• A. an Azure virtual machine scale set
• B. Azure Kubernetes Service (AKS)
• C. Azure Batch
• D. Azure Container Service

Answer

C. Azure Batch

Question #137

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing a storage solution to support on-premises resources and Azure-hosted resources.
You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Blob storage in the design.

Does the solution meet the goal?

 • A. Yes
• B. No

Answer-

A. Yes

Question #138

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing a storage solution to support on-premises resources and Azure-hosted resources.
You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Data Lake Storage in the design.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

B. No

Question #139

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing a storage solution to support on-premises resources and Azure-hosted resources.
You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure Data Table Storage in the design.

Does the solution meet the goal?

• A. Yes
 • B. No

Answer-

B. No

Question #140

Note: This question is part of series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You are designing a storage solution to support on-premises resources and Azure-hosted resources.
You need to provide on-premises storage that has built-in replication to Azure.

Solution: You include Azure StorSimple in the design.

Does the solution meet the goal?

• A. Yes
• B. No

Answer-

A. Yes

Question #141

You use Azure virtual machines to run a custom application that uses an Azure SQL Database
instance on the back end.
The IT department at your company recently enabled forced tunneling.
Since the configuration change, developers have noticed degraded performance when they access
the database.
You need to recommend a solution to minimize latency when accessing the database. The solution
must minimize costs.
What should you include in the recommendation?
• A. Azure SQL Database Managed Instance
• B. virtual network service endpoints
• C. Always On availability groups
• D. Azure virtual machines that run Microsoft SQL Server servers
Answer-

B. virtual network service endpoints

Question #142

DRAG DROP -
You are designing a network connectivity strategy for a new Azure subscription. You identify the
following requirements:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The Azure virtual machines on a subnet named Subnet1 must be accessible only from the
computers in your London office.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Engineers require access to the Azure virtual machine on a subnet named Subnet2 over the
Internet on a specific TCP/IP management port.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The Azure virtual machines in the West Europe Azure region must be able to communicate on all
ports to the Azure virtual machines in the North Europe Azure region.
You need to recommend which components must be used to meet the requirements. The solution
must minimize costs and administrative effort whenever possible.
What should you include in the recommendation? To answer, drag the appropriate components to
the correct requirements. Each component may be used once, more than once, or not at all. You may
need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-

A site-to-site VPN: The Azure virtual machine on Subnet1 must be accessible only from the
computers in the London Office

A Network Security Group (NSG): Engineers require access to the Azure virtual machines on
Subnet2 over the Internet on a specific TCP/IP management port

Virtual Network Peering: The Azure virtual machines in the West Europe region must be able to
communicate on all ports to the Azure virtual machines in the North Europe region.

Question #143

You develop a new Azure Web App that uses multiple Azure blobs and static content. The Web App
uses a large number of JavaScript files and cascading style sheets. Some of these files contain
references to other files. Users are geographically dispersed.
You need to minimize the time to load individual pages.

What should you do?

 • A. Migrate the Web App to Azure Service Fabric
• B. Use an Azure Content Delivery Network (CDN)
• C. Implement an Azure Redis Cache
• D. Create a services layer by using an Azure-hosted ASP.NET web API
• E. Enable the Always On feature of the Web App

Answer-

B. Use an Azure Content Delivery Network (CDN)

Question #144

You have 100 Standard_F2s_v2 Azure virtual machines. Each virtual machine has two network
adapters.
You need to increase the network performance of the workloads running on the virtual machines.
The solution must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. The CPU-to-memory ratio must remain the same.
✑ Identify any AD FS issues and their potential resolutions. The solution must minimize costs.

What should you do?

• A. Configure NIC teaming
• B. Enable RDMA over InfiniBand
• C. Enable SR-IOV
• D. Install an additional network adapter

Answer-

C. Enable SR-IOV

Question #145

You have a .NET web service named Service1 that has the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Must read and write temporary files to the local file system.
✑ Identify any AD FS issues and their potential resolutions. Must write to the Windows Application event log.
You need to recommend a solution to host Service1 in Azure. The solution must meet the following
requirements:
✑ Identify any AD FS issues and their potential resolutions. Minimize maintenance overhead.
✑ Identify any AD FS issues and their potential resolutions. Minimize costs.
What should you include in the recommendation?
• A. an Azure virtual machine scale set
• B. an Azure function
 • C. an App Service Environment
• D. an Azure web app

Answer-

B. an Azure function
or
A. an Azure virtual machine scale set
Check once

Question #146

You have an Azure subscription that contains an Azure Blob storage account named store1.
You have an on-premises file server named Server1 that runs Windows Server 2016. Server1 stores
500 GB of company files.
You need to store a copy of the company files in store1.
Which two possible Azure services achieve this goal? Each correct answer presents a complete
solution.

NOTE: Each correct selection is worth one point.

• A. an Azure Import/Export job
• B. an integration account
• C. an Azure Batch account
• D. Azure data Factory
• E. an On-premises data gateway

Answer-

A. an Azure Import/Export job

D. Azure data Factory

Question #147

You have a web app named App1 that is hosted on-premises and on four Azure virtual machines.
Each virtual machine is in a different region.
You need to recommend a solution to ensure that users will always connect to the closest instance of
App1. The solution must prevent the users from attempting to connect to a failed instance of App1.
Which two possible recommendations achieve the goal? Each correct answer presents a complete
solution.
NOTE: Each correct selection is worth one point.
• A. Azure Front Door Service
 • B. Azure Load Balancer
• C. round-robin DNS
• D. Azure Traffic Manager
• E. Azure Application Gateway

Answer

A. Azure Front Door Service

D. Azure Traffic Manager

Question #148

HOTSPOT -
You plan to deploy a network-intensive application to several Azure virtual machines.
You need to recommend a solution that meets the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Minimizes the use of the virtual machine processors to transfer data
✑ Identify any AD FS issues and their potential resolutions. Minimizes network latency
Which virtual machine size and feature should you use? To answer, select the appropriate options in
the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer
Box 1 - Compute Optimized Standard_F8s

Box 2 - Single Root I/O Virtualization (SR-IOV)

Question #149

You are designing a microservices architecture that will support a web application.
The solution must meet the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Allow independent upgrades to each microservice
✑ Identify any AD FS issues and their potential resolutions. Deploy the solution on-premises and to Azure
✑ Identify any AD FS issues and their potential resolutions. Set policies for performing automatic repairs to the microservices
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Support low-latency and hyper-scale operations
You need to recommend a technology.

What should you recommend?

• A. Azure Service Fabric
• B. Azure Container Service
• C. Azure Container Instance
• D. Azure Virtual Machine Scale Set

Answer-

A. Azure Service Fabric

Case Study
Topic 8 - Testlet 10

Question #1Topic 8
Introductory InfoCase study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on
this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is
provided in the case study. Case studies might contain exhibits and other resources that provide
more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your
answers and to make changes before you move to the next section of the exam. After you begin a
new section, you cannot return to this section.

To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane
to explore the content of the case study before you answer the questions. Clicking these buttons
displays information such as business requirement, existing environment, and problem statements.
If the case study has an
All Information tab, note that the information displayed is identical to the information displayed on
the subsequent tabs. When you are ready to answer a question, click the Question button to return to
the question.

Overview -
Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a
main office in London and three branch offices in Amsterdam,
Berlin, and Rome.

Existing Environment -

Active Directory Environment -

The network contains two Active Directory forests named corp.fabrikam.com and rd.fabrikam.com.
There are no trust relationships between the forests.
Corp.fabrikam.com is a production forest that contains identities used for internal user and
computer authentication.
Rd.fabrikam.com is used by the research and development (R&D) department only.

Network Infrastructure -
Each office contains at least one domain controller from the corp.fabrikam.com domain. The main
office contains all the domain controllers for the rd.fabrikam.com forest.
All the offices have a high-speed connection to the Internet.
An existing application named WebApp1 is hosted in the data center of the London office.
WebApp1 is used by customers to place and track orders.
WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier
that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual
machines that run on Hyper-V.
The IT department currently uses a separate Hyper-V environment to test updates to WebApp1.
Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes
Software Assurance.

Problem Statements -
The use of Web App1 is unpredictable. At peak times, users often report delays. At other times,
many resources for WebApp1 are underutilized.
Requirements -

Planned Changes -
Fabrikam plans to move most of its production workloads to Azure during the next few years.
As one of its first projects, the company plans to establish a hybrid identity model, facilitating an
upcoming Microsoft Office 365 deployment.
All R&D operations will remain on-premises.
Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.

Technical Requirements -
Fabrikam identifies the following technical requirements:
Web site content must be easily updated from a single point.
User input must be minimized when provisioning new app instances.
Whenever possible, existing on-premises licenses must be used to reduce cost.
Users must always authenticate by using their corp.fabrikam.com UPN identity.
Any new deployments to Azure must be redundant in case an Azure region fails.
Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS).
An email distribution group named IT Support must be notified of any issues relating to the
directory synchronization services.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com
must not be affected by a link failure between Azure and the on- premises network.

Database Requirements -
Fabrikam identifies the following database requirements:
Database metrics for the production instance of WebApp1, must be available for analysis so that
database administrators can optimize the performance settings.
To avoid disrupting customer access, database downtime must be minimized when databases are
migrated.
Database backups must be retained for a minimum of seven years to meet compliance requirements.

Security Requirements -
Fabrikam identifies the following security requirements:
Company information including policies, templates, and data must be inaccessible to anyone
outside the company.
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet
link fails.
Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com
credentials.
All administrative access to the Azure portal must be secured by using multi-factor authentication.
The testing of WebApp1 updates must not be visible to anyone outside the company.

Question
 You need to recommend a notification solution for the IT Support distribution group.
What should you include in the recommendation?
• A. Azure Network Watcher
• B. an action group
• C. a SendGrid account with advanced reporting
• D. Azure AD Connect Health

Answer-

C. Azure AD Connect Health

I can start only Questions

Question -16

HOTSPOT -
You are evaluating the components of the migration to Azure that require you
to provision an Azure Storage account.
For each of the following statements, select Yes if the statement is true.
 Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

B1 - NO
B2 - NO
B3 – YES

Question - 17

You need to recommend a strategy for migrating the database content of

WebApp1 to Azure.
What should you include in the recommendation?

• A. Use Azure Site Recovery to replicate the SQL servers to Azure

• B. Use SQL Server transactional replication
• C. Copy the VHD that contains the Azure SQL database files to Azure Blob
storage
• D. Copy the BACPAC file that contains the Azure SQL database files to Azure
Blob storage

Answer

B. Use SQL Server transactional replication

 Question - 18

You need to recommend a strategy for the web tier of WebApp1. The solution must
minimize costs.
What should you recommend?

• A. Configure the Scale Up settings for a web app

• B. Create a runbook that resizes virtual machines automatically to a smaller size outside of business
hours
• C. Deploy a virtual machine scale set that scales out on a 75 percent CPU threshold
• D. Configure the Scale Out settings for a web app

Answer-

D. Configure the Scale Out settings for a web app

Question - 19

You need to recommend a compute solution for the middle tier of the payment
processing system.

What should you include in the recommendation?

• A. Azure Kubernetes Service (AKS)
• B. virtual machine scale sets
• C. availability sets
• D. App Service Environments (ASEs)

Answer

B. virtual machine scale sets

 Question #150

You need to recommend a data storage solution that meets the following requirements:
✑ Identify any AD FS issues and their potential resolutions. Ensures that application can access the data by using a REST connection
✑ Identify any AD FS issues and their potential resolutions. Hosts 20 independent tables of varying sizes and usage patterns
✑ Identify any AD FS issues and their potential resolutions. Automatically replicates the data to a second Azure region
✑ Identify any AD FS issues and their potential resolutions. Minimizes costs
What should you recommend?

• A. an Azure SQL Database elastic database pool that uses active geo-replication
• B. tables in an Azure Storage account that uses geo-redundant storage (GRS)
• C. tables in an Azure Storage account that use read-access geo-redundant storage (RA-GR)
• D. an Azure SQL database that uses active geo-replication

Answer-

B. tables in an Azure Storage account that uses geo-redundant

storage (GRS)

Question #156

HOTSPOT -
Your company has an API that returns XML data to internal applications.
You plan to migrate the applications to Azure. You also plan to allow the
company's partners to access the API.
You need to recommend an API management solution that meets the following
requirements:
✑ Internal applications must receive data in the JSON format once the
applications migrate to Azure.
✑ Partner applications must have their header information stripped before the
applications receive the data.
What should you include in the recommendation? To answer, select the
appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer

Box1 - 1
Box2 - 2
Box3 – 2
Question #164

DRAG DROP -
Your company identifies the following business continuity and disaster recovery objectives for
virtual machines that host sales, finance, and reporting applications in the company's on-premises
data center:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The finance application requires that data be retained for seven years. In the event of a disaster,
the application must be able to run from Azure. The recovery time objective (RTO) is 10 minutes.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. The reporting application must be able to recover point-in-time data at a daily granularity. The
RTO is eight hours.
✑ Identify any AD FS issues and their potential resolutions. The sales application must be able to fail over to a second on-premises data center.
You need to recommend which Azure services meet the business continuity and disaster recovery
objectives. The solution must minimize costs.
What should you recommend for each application? To answer, drag the appropriate services to the
correct applications. Each service may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Select and Place:

Reveal Solution Discussion 11

Answer-

Box1 - Sales – Azure Site Recovery only (ASR)

Box2 - Finance - Azure Site Recovery and Azure Backup (ASR + Backup)
Box3 - Reporting – Azure Backup Only

Question #166

DRAG DROP -
You plan to import data from your on-premises environment into Azure. The
data is shown in the following table.

What should you recommend using to migrate the data? To answer, drag the
appropriate tools to the correct data sources. Each tool may be used once,
more than once, or not at all. You may need to drag the split bar between
panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer

Question #167

HOTSPOT -
You have the application architecture shown in the following exhibit.
Use the drop-down menus to select choice that completes each statement based on the information
presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Reveal Solution Discussion 2

Answer
Question #168

HOTSPOT -
You are designing a solution for a stateless front-end application named Application1. Application1
will be hosted on two Azure virtual machines named VM1 and
VM2.
You plan to load balance connections to VM1 and VM2 from the Internet by using one Azure load
balancer.
You need to recommend the minimum number of required public IP addresses.
How many public IP addresses should you recommend using for each resource? To answer, select
the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Reveal Solution Discussion 1

 Question #169

You need to recommend a data storage solution that meets the following requirements:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Ensures that application can access the data by using a REST connection
Hosts 20 independent tables of varying sizes and usage patterns
✑ Identify any AD FS issues and their potential resolutions. Automatically replicates the data to a second Azure region
✑ Identify any AD FS issues and their potential resolutions. Minimizes costs
What should you recommend?

• A. an Azure SQL Database elastic database pool that uses active geo-replication
• B. tables in an Azure Storage account that uses geo-redundant storage (GRS)
• C. tables in an Azure Storage account that use read-access geo-redundant storage (RA-GR)
• D. an Azure SQL database that uses active geo-replication

Answer

D. tables in an Azure Storage account that uses geo-redundant storage (GRS)

Question #170

DRAG DROP -
Your company has users who work remotely from laptops.
You plan to move some of the applications accessed by the remote users to Azure virtual machines.
The users will access the applications in Azure by using a point-to-site VPN connection. You will
use certificates generated from an on-premises-based certification authority (CA).
You need to recommend which certificates are required for the deployment.
What should you include in the recommendation? To answer, drag the appropriate certificates to the
correct targets. Each certificate may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Answer-
Question #171

DRAG DROP -
You have an Azure subscription. The subscription contains Azure virtual
machines that run Windows Server 2016 and Linux.
You need to use Azure Log Analytics design an alerting strategy for security-
related events.
Which Log Analytics tables should you query? To answer, drag the appropriate
tables to the correct log types. Each value may be used once, more than once,
or not at all. You may need to drag the split bar between panes or scroll to view
content.
NOTE: Each correct selection is worth one point.
Select and Place:

Reveal Solution Discussion 1

Answer-

Question #172
HOTSPOT -
You have the network topology shown in the following exhibit.

You have a user-defined route that has a default route of 0.0.0.0/0 and the next hop set to the
network virtual appliance.
You configure the Azure Storage account to use virtual network service endpoints.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

Question #173

HOTSPOT -
Your company has three branch offices and an Azure subscription. Each branch office contains a
Hyper-V host that hosts application servers.
You need to recommend a storage solution for the branch offices. The solution must ensure that the
application servers can connect to a central storage device by using iSCSI connections. Data saved
to the iSCSI storage device from the application servers must be uploaded to Azure automatically.
Which components should you include in the recommendation? To answer, select the appropriate
options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer-

Question #174

DRAG DROP -
You have an on-premises network that uses an IP address space of 172.16.0.0/16.
You plan to deploy 25 virtual machines to a new Azure subscription.
You identify the following technical requirements:
✑ Identify any AD FS issues and their potential resolutions. All Azure virtual machines must be placed on the same subnet named Subnet1.
✑ Identify any AD FS issues and their potential resolutions. All the Azure virtual machines must be able to communicate with all on-premises servers.
The servers must be able to communicate between the on-premises network and Azure by using a
site-to-site VPN.
You need to recommend a subnet design that meets the technical requirements.
What should you include in the recommendation? To answer, drag the appropriate network
addresses to the correct subnets. Each network address may be used once, more than once, or not at
all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:

Question 175

HOTSPOT -
You need to recommend a solution for configuring the Azure Multi-Factor
Authentication (MFA) settings.
What should you include in the recommendation? To answer, select the
appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Answer
 Question #180

You have an Azure subscription for used for testing and development purposes only. The subscription contains
Azure virtual machines that unmanaged, standard hard disk drives (HDD).
You need to recommend a recovery strategy for the virtual machines if an Azure region fails for a sustained
period. The recovery time objective (RTO) can be up to seven days. The solution must minimize costs.
What should you include in the recommendation?

• A. Store the disks in a Standard_LRS storage account. Configure Azure site Recovery. If a failure occurs,
initiate a manual failover.
• B. Store the disks in a Standard_GRS storage account. Configure Azure Recovery. If a failure occurs, initiate a
manual failover.
• C. Store the disks in a Standard_LRS storage account. If a disaster occurs, manually create the virtual
machines by used Azure Resources Manager templates.
• D. Store the disks in a Standard_GRS storage account. If a disaster occurs, manually create the virtual
machines by used Azure Resources Manager templates.
 Answer-

B. Store the disks in a Standard_GRS storage account. Configure Azure

Recovery. If a failure occurs, initiate a manual failover.

Question #181

You are designing a solution for a company to deploy software for testing and production.
The solution must meet the following requirements:
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Applications must be deployed to several different environments and must run without
installation of dependencies.
✑ Identify any AD FS issues and their potential resolutions. Existing published application must be ported to the new solution.
✑IdentifyanyADFSissuesandtheirpotentialresolutions. Application developers must be given flexibility when architecting their code.
You need to recommend a solution for hosting applications.
What should you select?

• A. Azure worker role

• B. Azure Kubernetes Service
• C. Azure Functions
• D. Azure Batch

Answer

B. Azure Kubernetes Service

Question - 182

You need to recommend a solution for the network configuration of the front-
end tier of the payment processing.
What should you include in the recommendation?

• A. Azure Application Gateway

• B. Traffic Manager
• C. a Standard Load Balancer
• D. a Basic load Balancer

Answer-

C. a Standard Load Balancer

Question #184
 You are designing an Azure solution.
The network traffic for the solution must be securely distributed by providing the following
features:
✑ Identify any AD FS issues and their potential resolutions. HTTPS protocol

✑ Identify any AD FS issues and their potential resolutions. Round robin routing
✑ Identify any AD FS issues and their potential resolutions. SSL offloading
You need to recommend a load balancing option.

What should you recommend?

• A. Azure Load Balancer

• B. Azure Traffic Manager
• C. Azure Internal Load Balancer (ILB)
• D.Azure Application Gateway

Answer

D. Azure Application Gateway

 A.

Question #193

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an on-premises Hyper-V clusters that hosts 20 virtual machines. Some virtual machines
run Windows Server 2016 and some run Linux.
You plan to migrate the virtual machines to an Azure subscription.
You need to recommend a solution to replicate the disks of the virtual machines to Azure. The
solution must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing an Azure Storage account that has a file service and a blob
service, and then using the Data Migration Assistant.

Does this meet the goal?

• A. Yes
• B. No

Answer

B. No
 Question #194

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an on-premises Hyper-V clusters that hosts 20 virtual machines. Some virtual machines
run Windows Server 2016 and some run Linux.
You plan to migrate the virtual machines to an Azure subscription.
You need to recommend a solution to replicate the disks of the virtual machines to Azure. The
solution must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing an Azure Storage account, and then running AzCopy.

Does this meet the goal?

• A. Yes
• B. No

Answer

B- No

Question #195

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an on-premises Hyper-V clustern that hosts 20 virtual machines. Some virtual machines
run Windows Server 2016 and some run Linux.
You plan to migrate the virtual machines to an Azure subscription.
You need to recommend a solution to replicate the disks of the virtual machines to Azure. The
solution must ensure that the virtual machines remain available during the migration of the disks.

Solution: You recommend implementing a Recovery Services vault, and then using Azure Site
Recovery.
 Does this meet the goal?

• A. Yes
• B. No

Answer

A- Yes

Question #196

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named storage1.
You plan to archive data to storage1.
You need to ensure that the archived data cannot be deleted for five years. The solution must
prevent administrators from deleting the data.
Solution: You create a file share, and you configure an access policy.
Does this meet the goal?

• A.Yes
• B.No

Answer

B. No

Question #197

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named storage1.
You plan to archive data to storage1.
 You need to ensure that the archived data cannot be deleted for five years. The solution must
prevent administrators from deleting the data.

Solution: You create an Azure Blob storage container, and you configure a legal hold access policy.

Does this meet the goal?

• A. Yes
• B. No

Answer

A. Yes

Question #198

Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named storage1.
You plan to archive data to storage1.
You need to ensure that the archived data cannot be deleted for five years. The solution must
prevent administrators from deleting the data.
Solution: You create a file share and snapshots.
Does this meet the goal?

• A.Yes
B.No

Answer

B- No

Question #199
 You plan to archive 10 TB of on-premises data files to Azure.
You need to recommend a data archival solution. The solution must minimize the cost of storing the
data files.
Which Azure Storage account type should you include in the recommendation?

• A. Premium Storage (general purpose v1)

• B. Standard StorageV2 (general purpose v2)
• C. Standard Storage (general purpose v1)
• D. Premium StorageV2 (general purpose v2)

Answer

B. Standard StorageV2 (general purpose v2)

Total Questions:
84 Latest
Version

Topic 1, Fabrikam, inc Case Study A Overview:

Existing Environment
Fabrikam, Inc. is an engineering company that has offices throughout Europe. The
company has a main office in London and three branch offices in Amsterdam Berlin,
and Rome.
Active Directory Environment:
The network contains two Active Directory forests named corp.fabnkam.com and
rd.fabrikam.com. There are no trust relationships between the forests.
Corp.fabrikam.com is a production forest that contains identities used for internal user
and computer authentication. Rd.fabrikam.com is used by the research and
development (R&D) department only.
Network Infrastructure:
Each office contains at least one domain controller from the corp.fabrikam.com domain.
The main office contains all the domain controllers for the rd.fabrikam.com forest.
All the offices have a high-speed connection to the Internet.
An existing application named WebApp1 is hosted in the data center of the London
office. WebApp1 is used by customers to place and track orders. WebApp1 has a web
tier that uses Microsoft Internet Information Services (IIS) and a database tier that runs
Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual
machines that run on Hyper-V.

Visit us athttps://www.examsboost.com/test/az-304/
The IT department currently uses a separate Hyper-V environment to test updates to
WebApp1.
Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement
that includes Software Assurance.
Problem Statement:
The use of Web App1 is unpredictable. At peak times, users often report delays. Al
other times, many resources for WebApp1 are underutilized.
Requirements:
Planned
Changes:

Visit us athttps://www.examsboost.com/test/az-304/
Fabrikam plans to move most of its production workloads to Azure during the next few years.
As one of its first projects, the company plans to establish a hybrid identity model,
facilitating an upcoming Microsoft Office 365 deployment
All R&D operations will remain on-premises.
Fabrikam plans to migrate the production and test instances of WebApp1 to Azure.
Technical Requirements:
Fabrikam identifies the following technical requirements:
• Web site content must be easily updated from a single point.
• User input must be minimized when provisioning new app instances.
• Whenever possible, existing on premises licenses must be used to reduce cost.
• Users must always authenticate by using their corp.fabrikam.com UPN identity.
• Any new deployments to Azure must be redundant in case an Azure region fails.
• Whenever possible, solutions must be deployed to Azure by using platform as a
service (PaaS).
• An email distribution group named IT Support must be notified of any issues relating to the
directory synchronization services.
• Directory synchronization between Azure Active Directory (Azure AD) and
corp.fabhkam.com must not be affected by a link failure between Azure and the on
premises network.
Database Requirements:
Fabrikam identifies the following database requirements:
• Database metrics for the production instance of WebApp1 must be available for analysis
so that database administrators can optimize the performance settings.
• To avoid disrupting customer access, database downtime must be minimized when
databases are migrated.
• Database backups must be retained for a minimum of seven years to meet
compliance requirement
Security Requirements:
Fabrikam identifies the following security requirements:
*Company information including policies, templates, and data must be inaccessible to
anyone outside the company

Visit us athttps://www.examsboost.com/test/az-304/
*Users on the on-premises network must be able to authenticate to corp.fabrikam.com if
an Internet link fails. *Administrators must be able authenticate to the Azure portal by
using their corp.fabrikam.com credentials.
*All administrative access to the Azure portal must be secured by using multi-factor
authentication.
*The testing of WebApp1 updates must not be visible to anyone outside the company.

Question: 1

To meet the authentication requirements of Fabrikam, what should you include in the solution? To
answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answe
r:

1
1

Visit us athttps://www.examsboost.com/test/az-304/
0

Question: 3

You need to recommend a strategy for migrating the database content of WebApp1 to Azure. What
should you include in the recommendation?

A. Use Azure Site Recovery to replicate the SQL servers to Azure.

B. Use SQL Server transactional replication.
C. Copy the BACPAC file that contains the Azure SQL database file to Azure Blob storage.
D. Copy the VHD that contains the Azure SQL database files to Azure Blob storage

Answer: D
Explanation:
Before you upload a Windows virtual machine (VM) from on-premises to Azure, you must prepare the
virtual hard disk (VHD or VHDX).
Scenario: WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database
tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual
machines that run on Hyper-V.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image
Question: 4

You need to recommend a strategy for the web tier of WebApp1. The solution must minimize What should
you recommend?

A. Create a runbook that resizes virtual machines automatically to a smaller size outside of
business hours.
B. Configure the Scale Up settings for a web app.

Visit us athttps://www.examsboost.com/test/az-304/
C. Deploy a virtual machine scale set that scales out on a 75 percent CPU threshold.
D. Configure the Scale Out settings for a web app.

Answer: D

Question: 7

What should you include in the identity management strategy to support the planned changes?

A. Move all the domain controllers from corp.fabrikam.com to virtual networks in Azure.
B. Deploy domain controllers for corp.fabrikam.com to virtual networks in Azure.
C. Deploy a new Azure AD tenant for the authentication of new R&D projects.
D. Deploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.

Answer: B
Explanation:
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be
affected by a link failure between Azure and the on-premises network. (This requires domain controllers in
Azure)
Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link
fails. (This requires domain controllers on-premises)
Question: 8

You are evaluating the components of the migration to Azure that require you to provision an Azure
Storage account.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE:
Each correct selection is worth one point.

Answe
r:

Question: 9
You need to recommend a notification solution for the IT Support distribution group.
What should you include in the recommendation?

A. Azure Network Watcher

Visit us athttps://www.examsboost.com/test/az-304/
 B. an action group
C. a SendGrid account with advanced reporting
D. Azure AD Connect Health

Answer: D
References:
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-health-operations

Topic 2, Contoso, Ltd Case Study B Overview

Contoso,Ltd is a US-base finance service company that has a main office New York and an
office
in San Francisco.
Payment Processing Query System
Contoso hosts a business critical payment processing system in its New York data center. The
system has three tiers a front-end web app a middle -tier API and a back end data store
implemented as a Microsoft SQL Server 2014 database All servers run Windows Server
2012 R2.
The front -end and middle net components are hosted by using Microsoft Internet
Inform-non Services (IK) The application rode is written in C# and middle- tier API uses
the Entity framework to communicate the SQL Server database. Maintenance of the
database e performed by using SQL Server Ago-
The database is currently J IB and is not expected to grow beyond 3 TB.
The payment processing system has the following compliance related requirement
• Encrypt data in transit and at test. Only the front-end and middle-tier components must
be able to access the encryption keys that protect the date store.
• Keep backups of the two separate physical locations that are at last 200 miles apart and
can be restored for op to seven years.
• Support blocking inbound and outbound traffic based on the source IP address, the
description IP address, and the port number
• Collect Windows security logs from all the middle-tier servers and retain the log for a
period of seven years,
• Inspect inbound and outbound traffic from the from-end tier by using highly available
network appliances.
• Only allow all access to all the tiers from the internal network of Contoso.

Visit us athttps://www.examsboost.com/test/az-304/
Tape backups ate configured by using an on-premises deployment or Microsoft System
Center Data protection Manager (DPMX and then shaped ofsite for long term storage
Historical Transaction Query System
Contoso recently migrate a business-Critical workload to Azure. The workload contains a
NET web server for querying the historical transaction data residing in azure Table Storage.
The NET service is accessible from a client app that was developed in-house and on the
client computer in the New Your office. The data in the storage is 50 GB and is not
except to increase.
Information Security Requirement
The IT security team wants to ensure that identity management n performed by using
Active Directory. Password hashes must be stored on premises only.
Access to all business-critical systems must rely on Active Directory credentials. Any
suspicious authentication attempts must trigger multi-factor authentication prompt
automatically Legitimate users must be able to authenticate successfully by using multi-
factor authentication.
Planned Changes
Contoso plans to implement the following changes:
* Migrate the payment processing system to Azure.
* Migrate the historical transaction data to Azure Cosmos DB to address the
performance issues.
Migration Requirements
Contoso identifies the following general migration requirements:
Infrastructure services must remain available if a region or a data center fails. Failover
must occur without any administrative intervention
• Whenever possible. Azure managed serves must be used to management overhead
• Whenever possible, costs must be minimized.
Contoso identifies the following requirements for the payment processing system:
• If a data center fails, ensure that the payment processing system remains available without
any administrative intervention. The middle-tier and the web front end must continue to
operate without any additional configurations-
• If that the number of compute nodes of the from -end and the middle tiers of the
payment processing system can increase or decrease automatically based on CPU
utilization.
• Ensure that each tier of the payment processing system is subject to a Service level
Agreement (SLA) of 9959 percent availability

Visit us athttps://www.examsboost.com/test/az-304/
• Minimize the effort required to modify the middle tier API and the back-end tier of the
payment processing system.
• Generate alerts when unauthorized login attempts occur on the middle-tier virtual machines.
• Insure that the payment processing system preserves its current compliance status.
• Host the middle tier of the payment processing system on a virtual machine.
Contoso identifies the following requirements for the historical transaction query
system:
• Minimize the use of on-premises infrastructure service.
• Minimize the effort required to modify the .NET web service querying Azure Cosmos DB.
• If a region fails, ensure that the historical transaction query system remains available without
any administrative intervention.
Current Issue
The Contoso IT team discovers poor performance of the historical transaction query as
the queries frequently cause table scans.
Information Security Requirements
The IT security team wants to ensure that identity management is performed by using
Active Directory. Password hashes must be stored on-premises only.
Access to all business-critical systems must rely on Active Directory credentials. Any
suspicious authentication attempts must trigger a multi-factor authentication prompt
automatically. legitimate users must be able to authenticate successfully by using multi-
factor authentication.

Question: 10
You need to recommend a backup solution for the data store of the payment processing.
What should you include in the recommendation?

A. Microsoft System Center Data Protection Manager (DPM)

B. long-term retention
C. a Recovery Services vault
D. Azure Backup Server

Answer: B
References:

Visit us athttps://www.examsboost.com/test/az-304/
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-long-term-backup-retention- configure
Question: 11

You need to recommend a solution for protecting the content of the back-end tier of the payment
processing system.
What should you include in the recommendations?

A. Always Encrypted with deterministic encryption

B. Transparent Date Encryption (TDE)
C. Azure Storage Service Encryption
D. Always Encrypted with randomized encryption

Answer: A
Question: 12

You need to recommend a solution for the user at Contoso to authenticate to the cloud-based sconces
and the Azure AD-integrated application. What should you include in the recommendation? To answer,
select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answe
r:

Visit us athttps://www.examsboost.com/test/az-304/
 Question: 13
You need to recommend a solution for data of the historical transaction query system.
What should you include in the recommendation? To answer, Select the appropriate or options in the
answer area.
NOTE: Each correct selection is worth one point

Answe
r:

Visit us athttps://www.examsboost.com/test/az-304/
 Question: 14
You need to recommend a solution for the network configuration of the front-end tier of the payment processing.
What should you include in the recommendation?

A. Azure Application Gateway

B. Traffic Manager
C. a Standard Load Balancer
D. a Basic load Balancer

Answer: C
Explanation:
Scenario:
Ensure that the number of compute nodes of the front-end and the middle tiers of the payment
processing system can increase or decrease automatically based on CPU utilization.
Ensure that each tier of the payment processing system is subject to a Service Level Agreement (SLA) of
99.99 percent availability.
With Azure Load Balancer, you can scale your applications and create high availability for your services.
Load Balancer supports inbound and outbound scenarios, provides low latency and high throughput, and
scales up to millions of flows for all TCP and UDP applications.
Azure Load Balancer is available in two SKUs: Basic and Standard. There are differences in scale, features,
and pricing. Standard SLA guarantees a 99.99% for data path with two healthy virtual machines. Basic
SLA does not exist.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
Question: 15

Visit us athttps://www.examsboost.com/test/az-304/
You need to recommend a solution for the collection of security logs the middle tier of the payment
processing system.
What should you include in the recommendation?

A. Azure Notification Hubs

B. the Azure Diagnostics agent
C. Azure Event Hubs
D. the Azure Log Analytics agent

Answer: D
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostics-extension-overview

Question: 17

You need to recommend a solution for configuring the Azure Multi-Factor Authentication (MFA) settings.
What should you include in the recommendation? To answer, select the appropriate options in the answer
area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-sign-in-risk-policy
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-mfa-policy
Question: 18
You need to design a solution for securing access to the historical transaction data.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answer:

Question: 19 – duplicate question - question 1 – page 75

You need to recommend a solution for implementing the back-end tier of the payment processing system
in Azure.
What should you include in the recommendation?

A. an Azure SQL Database managed instance

B. a SQL Server database on an Azure virtual machine
C. an Azure SQL Database single database
D. an Azure SQL Database elastic pool

Visit us athttps://www.examsboost.com/test/az-304/
 Answer: C

Question: 21

You need to recommend a compute solution for the middle tier of the payment processing system.
What should you include in the recommendation?

A. Azure Kubernetes Service (AKS)

B. virtual machine scale sets
C. availability sets
D. App Service Environments (ASEs)

Answer: B
Question: 22 duplicate question question 2 page no 76

You need to recommend a solution for protecting the content of the payment processing system.
What should you include in the recommendation?

A. Transparent Data Encryption (TDE)

B. Azure Storage Service Encryption
C. Always Encrypted with randomized encryption
D. Always Encrypted with deterministic encryption

Answer: D

Visit us athttps://www.examsboost.com/test/az-304/
 Question: 24
You need to recommend a solution for the users at Contoso to authenticate to the cloud-based services
and the Azure AD-integrated applications.
What should you include in the recommendation? To answer, select the appropriate options in the answer
area.
NOTE: Each correct selection is worth one point.

Answe
r:

Visit us athttps://www.examsboost.com/test/az-304/
Mix Questions

Question: 26

You need to recommend a solution to generate a monthly report of all the new Azure Resource
Manager resource deployment in your subscription. What should you include in the recommendation?

A. Azure Activity Log

B. Azure Monitor action groups
C. Azure Advisor
D. Azure Monitor metrics

Answer: A
Explanation:
Activity logs are kept for 90 days. You can query for any range of dates, as long as the starting date isn't
more than 90 days in the past.
Through activity logs, you can determine:
what operations were taken on the resources in your subscription
who started the operation
when the operation occurred
the status of the operation
the values of other properties that might help you research the operation
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs
Question: 27

You have an Azure subscription that contains an Azure SQL database named
DB1. Several queries that query the data in DB1 take a long time to execute.
You need to recommend a solution to identify the queries that take the longest to execute.
What should you include in the recommendation?

A. SQL Database Advisor

B. Azure Monitor
C. Performance Recommendations
D. Query Performance Insight

Answer: D

Explanation:

Visit us athttps://www.examsboost.com/test/az-304/
Query Performance Insight provides intelligent query analysis for single and pooled databases. It helps
identify the top resource consuming and long-running queries in your workload. This helps you find the
queries to optimize to improve overall workload performance and efficiently use the resource that you are
paying for.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/query-performance-insight-use
Question: 28

Question: 30

You have an Azure subscription that contains the SQL servers shown in the following table.

The subscription contains the storage accounts shown in the following table.

Visit us athttps://www.examsboost.com/test/az-304/
You create the Azure SQL databases shown in the following table.

Answe
r:

Explanation:
Box 1: Yes
Be sure that the destination is in the same region as your database and server.
Box 2: No
Box 3: No
Reference:
https://docs.microsoft.com/en-us/azure/sql-database/sql-database-auditing

Question: 32

You have an Azure subscription that is linked to an Azure Active Directory (Azure AD) tenant. The
subscription
contains 10 resource groups, one for each department at your company.
Each department has a specific spending limit for its Azure resources.
You need to ensure that when a department reaches its spending limit, the compute resources of the
department shut down automatically.
Which two features should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Azure Logic Apps

B. Azure Monitor alerts
C. the spending limit of an Azure account
D. Cost Management budgets
E. Azure Log Analytics alerts

Answer: CD
Explanation:
C: The spending limit in Azure prevents spending over your credit amount. All new customers who sign
up for an Azure free account or subscription types that include credits over multiple months have the
spending limit turned on by default. The spending limit is equal to the amount of credit and it can’t be
changed.
D: Turn on the spending limit after removing
This feature is available only when the spending limit has been removed indefinitely for subscription types
that include credits over multiple months. You can use this feature to turn on your spending limit
automatically at the start of the next billing period.
Sign in to the Azure portal as the Account Administrator.
Search for Cost Management + Billing.
Visit us athttps://www.examsboost.com/test/az-304/
Etc.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/spending-limit
Question: 33

You plan to deploy an application named App1 that will run on five Azure virtual machines. Additional
virtual machines will be deployed later to run App1.

Visit us athttps://www.examsboost.com/test/az-304/
You need to recommend a solution to meet the following requirements for the virtual machines that will
run App1:
Ensure that the virtual machines can authenticate to Azure Active Directory (Azure AD) to gain access to
an Azure key vault, Azure Logic Apps instances, and an Azure SQL database.
Avoid assigning new roles and permissions for Azure services when you deploy additional virtual
machines.
Avoid storing secrets and certificates on the virtual machines.
Which type of identity should you include in the recommendation?

A. a service principal that is configured to use a certificate

B. a system-assigned managed identity
C. a service principal that is configured to use a client secret
D. a user-assigned managed identity

Answer: D
Explanation:
Managed identities for Azure resources is a feature of Azure Active Directory.
User-assigned managed identity can be shared. The same user-assigned managed identity can be
associated with more than one Azure resource.
Incorrect Answers:
B: System-assigned managed identity cannot be shared. It can only be associated with a single Azure
resource.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
Question: 34

You are designing a large Azure environment that will contain many subscriptions.
You plan to use Azure Policy as part of a governance solution.
To which three scopes can you assign Azure Policy definitions? Each correct answer presents a complete
solution.
NOTE: Each correct selection is worth one point.

A. management groups
B. subscriptions
C. Azure Active Directory (Azure AD) tenants
D. resource groups
E. Azure Active Directory (Azure AD) administrative units
F. compute resources

Answer: ABD
Explanation:
Azure Policy evaluates resources in Azure by comparing the properties of those resources to business
rules.

Visit us athttps://www.examsboost.com/test/az-304/
Once your business rules have been formed, the policy definition or initiative is assigned to any scope of
resources that Azure supports, such as management groups, subscriptions, resource groups, or
individual resources.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/overview
Question: 35

Your company has the divisions shown in the following table.

You plan to deploy a custom application to each subscription. The application will contain the following: A
resource group
An Azure web app
Custom role assignments
An Azure Cosmos DB account
You need to use Azure Blueprints to deploy the application to each subscription.
What is the minimum number of objects required to deploy the application? To answer, select the
appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

Explanation:
Box 1: 2
One management group for East, and one for West.
When creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to
a management group or subscription that you have Contributor access to. If the location is a management
group, the blueprint is available to assign to any child subscription of that management group.
Box 2: 1
One definition as the you plan to deploy a custom application to each subscription.
With Azure Blueprints, the relationship between the blueprint definition (what should be deployed) and the
blueprint assignment (what was deployed) is preserved.
Box 3: 4
One assignment for each subscription.
Reference:
https://docs.microsoft.com/en-us/azure/governance/blueprints/overview

Question: 37

You need to design a resource governance solution for an Azure subscription. The solution must meet
the following requirements:
Ensure that all ExpressRoute resources are created in a resource group named RG1.
Delegate the creation of the ExpressRoute resources to an Azure Active Directory (Azure AD) group
named Networking.
Use the principle of least privilege.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

Explanation:
Box 1: An Azure policy assignment at the subscription level that has an exclusion
Box 2: A custom RBAC role assignment at the level of RG1
Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to
Azure resources. To grant access, you assign roles to users, groups, service principals, or managed
identities at a particular scope.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage
Question: 38
You have an Azure Active Directory (Azure AD) tenant and Windows 10 devices.
You configure a conditional access policy as shown in the exhibit. (Click the Exhibit tab.)

Visit us athttps://www.examsboost.com/test/az-304/
What is the result of the policy?

A. All users will always be prompted for multi-factor authentication (MFA).

B. Users will be prompted for multi-factor authentication (MFA) only when they sign in from
devices that are
NOT joined to Azure AD.
C.All users will be able to sign in without using multi-factor authentication (MFA).
D. Users will be prompted for multi-factor authentication (MFA) only when they sign in from
devices that are
joined to Azure AD.

Answer: B
Explanation:

Visit us athttps://www.examsboost.com/test/az-304/
Either the device should be joined to Azure AD or MFA must be used.
Question: 39

You are designing an Azure resource deployment that will use Azure Resource Manager templates. The
deployment will use Azure Key Vault to store secrets.
You need to recommend a solution to meet the following requirements:
Prevent the IT staff that will perform the deployment from retrieving the secrets directly from Key Vault.
Use the principle of least privilege.
Which two actions should you recommend? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Create a Key Vault access policy that allows all get key permissions, get secret permissions,
and get certificate permissions.
B. From Access policies in Key Vault, enable access to the Azure Resource Manager for
template deployment.
C. Create a Key Vault access policy that allows all list key permissions, list secret permissions,
and list certificate permissions.
D. Assign the IT staff a custom role that includes the Microsoft.KeyVault/Vaults/Deploy/Action
permission.
E. Assign the Key Vault Contributor role to the IT staff.

Answer: BD
Explanation:
B: To access a key vault during template deployment, set enabledForTemplateDeployment on the key
vault to true.
D: The user who deploys the template must have the Microsoft.KeyVault/vaults/deploy/action permission
for the scope of the resource group and key vault.
Incorrect Answers:
E: To grant access to a user to manage key vaults, you assign a predefined key vault Contributor role to
the user at a specific scope.
If a user has Contributor permissions to a key vault management plane, the user can grant themselves
access to the data plane by setting a Key Vault access policy. You should tightly control who has
Contributor role access to your key vaults. Ensure that only authorized persons can access and manage
your key vaults, keys, secrets, and certificates.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/key-vault-parameter
https://docs.microsoft.com/en-us/azure/key-vault/general/overview-security
Question: 40

You have an Azure subscription that contains resources in three Azure regions.
You need to implement Azure Key Vault to meet the following requirements:
D18912E1457D5D1DDCBD40AB3BF70D5D
In the event of a regional outage, all keys must be readable.

Visit us athttps://www.examsboost.com/test/az-304/
All the resources in the subscription must be able to access Key Vault.
The number of Key Vault resources to be deployed and managed must be minimized.
How many instances of Key Vault should you implement?

A. 1
B. 2
C. 3
D. 6

Answer: A
Explanation:
The contents of your key vault are replicated within the region and to a secondary region at least 150
miles away but within the same geography. This maintains high durability of your keys and secrets. See
the Azure paired regions document for details on specific region pairs.
Example: Secrets that must be shared by your application in both Europe West and Europe North.
Minimize these as much as you can. Put these in a key vault in either of the two regions. Use the same URI from
both regions. Microsoft will fail over the Key Vault service internally.
Reference:
https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance
Question: 41

You have an Azure Active Directory (Azure AD) tenant.

You plan to provide users with access to shared files by using Azure Storage. The users will be provided
with different levels of access to various Azure file shares based on their user account or their group
membership.
You need to recommend which additional Azure services must be used to support the planned
deployment.
What should you include in the recommendation?

A. an Azure AD enterprise application

B. Azure Information Protection
C. an Azure AD Domain Services (Azure AD DS) instance
D. an Azure Front Door instance

Answer: C
Explanation:
Azure Files supports identity-based authentication over Server Message Block (SMB) throughtwo types of
Domain Services: on-premises Active Directory Domain Services (AD DS) and Azure Active Directory
Domain Services (Azure AD DS).
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory- domain-
service-enable

Question: 42

Your company has users who work remotely from laptops.

You plan to move some of the applications accessed by the remote users to Azure virtual machines. The
users will access the applications in Azure by using a point-to-site VPN connection. You will use
certificates generated from an on-premises-based certification authority (CA).
You need to recommend which certificates are required for the deployment.
What should you include in the recommendation? To answer, drag the appropriate certificates to the
correct targets. Each certificate may be used once, more than once, or not at all. You may need to drag
the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

Question: 44
You have an Azure subscription that contains a custom application named Application was developed by
an external company named fabric, Ltd. Developers at Fabrikam were assigned role-based access control
(RBAV) permissions to the Application components. All users are licensed for the Microsoft 365 E5 plan.
You need to recommends a solution to verify whether the Faricak developers still require permissions to
Application1. The solution must the following requirements.
* To the manager of the developers, send a monthly email message that lists the access
permissions to Application1.
* If the manager does not verify access permission, automatically revoke that permission.
* Minimize development
effort. What should you
recommend?

A. In Azure Active Directory (AD) Privileged Identity Management, create a custom role
assignment for the Application1 resources
B. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet
C. Create an Azure Automation runbook that runs the Get-AzureRmRoleAssignment cmdlet
D. In Azure Active Directory (Azure AD), create an access review of Application1

Answer: D

Question: 46
You manage a network that includes an on-premises Active Directory Domain Services domain and an
Azure Active Directory (Azure AD).
Employees are requires to use different accounts when using on-premises or cloud resources. You must
recommend a solution that lets employees sign in to all company resources by using a single account.
The solution must implement an identity provider.
You need provide guidance on the different identity providers.
How should you describe each identity provider? To answer, select the appropriate description from each
Visit us athttps://www.examsboost.com/test/az-304/
list in the answer area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

Explanation:
Box1: User management occurs on-premises. Azure AD authenticates employees by using on-premises
passwords.
Azure AD Domain Services for hybrid organizations
Organizations with a hybrid IT infrastructure consume a mix of cloud resources and on-premises
resources. Such organizations synchronize identity information from their on-premises directory to their
Azure AD tenant. As hybrid organizations look to migrate more of their on-premises applications to the
cloud, especially legacy directory-aware applications, Azure AD Domain Services can be useful to them.
Example: Litware Corporation has deployed Azure AD Connect, to synchronize identity information from
their on-premises directory to their Azure AD tenant. The identity information that is synchronized includes
user accounts, their credential hashes for authentication (password hash sync) and group memberships.

Visit us athttps://www.examsboost.com/test/az-304/
User accounts, group memberships, and credentials from Litware's on-premises directory are
synchronized to Azure AD via Azure AD Connect. These user accounts, group memberships, and
credentials are automatically available within the managed domain.
Box 2: User management occurs on-premises. The on-promises domain controller authenticates
employee credentials.
You can federate your on-premises environment with Azure AD and use this federation for authentication
and authorization. This sign-in method ensures that all user authentication occurs on- premises.

Visit us athttps://www.examsboost.com/test/az-304/
References:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-overview
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed

Question: 49

You are designing an order processing system in Azure that will contain the Azure resources shown in
the following table.

The order processing system will have the following transaction flow:
A customer will place an order by using App1.
When the order is received, App1 will generate a message to check for product availability at vendor 1
and vendor 2.
An integration component will process the message, and then trigger either Function1 or Function2
depending on the type of order.
Once a vendor confirms the product availability, a status message for App1 will be generated by
Function1 or Function2.
All the steps of the transaction will be logged to storage1.
Which type of resource should you recommend for the integration component?
D18912E1457D5D1DDCBD40AB3BF70D5D
Which type of resource should you recommend for the integration component?

A. an Azure Data Factory pipeline

B. an Azure Service Bus queue
C. an Azure Event Grid domain
D. an Azure Event Hubs capture

Answer: A
Visit us athttps://www.examsboost.com/test/az-304/
Explanation:
A data factory can have one or more pipelines. A pipeline is a logical grouping of activities that together
perform a task.
The activities in a pipeline define actions to perform on your data.
Data Factory has three groupings of activities: data movement activities, data transformation activities,
and control activities.

Visit us athttps://www.examsboost.com/test/az-304/
Azure Functions is now integrated with Azure Data Factory, allowing you to run an Azure function as a
step in your data factory pipelines.
Reference:
https://docs.microsoft.com/en-us/azure/data-factory/concepts-pipelines-activities
Question: 50

You have an existing implementation of Microsoft SQL Server Integration Services (SSIS) packages
stored in an SSISDB catalog on your on-premises network. The on-premises network does not have
hybrid connectivity to Azure by using Site-to-Site VPN or ExpressRoute.
You want to migrate the packages to Azure Data Factory.
You need to recommend a solution that facilitates the migration while minimizing changes to the
existing packages. The solution must minimize costs.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answe
r:

Explanation:
Box 1: Azure SQL database
You can't create the SSISDB Catalog database on Azure SQL Database at this time independently of
creating the Azure-SSIS Integration Runtime in Azure Data Factory. The Azure-SSIS IR is the runtime
environment that runs SSIS packages on Azure.
Box 2: Azure-SQL Server Integration Service Integration Runtime and self-hosted integration runtime
The Integration Runtime (IR) is the compute infrastructure used by Azure Data Factory to provide data
integration capabilities across different network environments. Azure-SSIS Integration Runtime (IR) in
Azure Data Factory (ADF) supports running SSIS packages.
Self-hosted integration runtime can be used for data movement in this scenario.
Reference:
https://docs.microsoft.com/en-us/azure/data-factory/create-azure-integration-runtime

Visit us athttps://www.examsboost.com/test/az-304/
https://docs.microsoft.com/en-us/sql/integration-services/lift-shift/ssis-azure-connect-to-catalog- database

Question: 54

You have an Azure virtual machine named VM1 that runs Windows Server 2019 and contains 500 GB of
data files.
You are designing a solution that will use Azure Data Factory to transform the data files, and then load
the files to Azure Data Lake Storage.
What should you deploy on VM1 to support the design?

A. the Azure Pipelines agent

B. the Azure File Sync agent
C. the On-premises data gateway
D. the self-hosted integration runtime in Azure

Answer: D
Explanation:
The integration runtime (IR) is the compute infrastructure that Azure Data Factory uses to provide data-
integration capabilities across different network environments. For details about IR, see Integration
runtime overview.
A self-hosted integration runtime can run copy activities between a cloud data store and a data store in a
private network. It also can dispatch transform activities against compute resources in an on-premises
network or an Azure virtual network. The installation of a self-hosted integration runtime needs an on-
premises machine or a virtual machine inside a private network.
Reference:

Visit us athttps://www.examsboost.com/test/az-304/
https://docs.microsoft.com/en-us/azure/data-factory/create-self-hosted-integration-runtime
Question: 55

Your company is designing a multi-tenant application that will use elastic pools and Azure SQL
databases. The application will be used by 30 customers.
You need to design a storage solution for the application. The solution must meet the following
requirements:
Operational costs must be minimized.
All customers must have their own database.
The customer databases will be in one of the following three Azure regions: East US, North Europe, or South
Africa North.
What is the minimum number of elastic pools and Azure SQL Database servers required? To answer,
select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answe
r:

Visit us athttps://www.examsboost.com/test/az-304/
Explanation:
Box 1: 3
The server, its pools & databases must be in the same Azure region under the same subscription.
Box 2: 3
A server can have up to 5000 databases associated to
it. Reference:
https://vincentlauzon.com/2016/12/18/azure-sql-elastic-pool-overview/
Question: 56
Your company purchases an app named App1.
You plan to tun App1 on seven Azure virtual machines In an Availability Set. The number of fault
domains is set to 3. The number of update domains is set to 20.
You need to identity how many App1 instances will remain available during a period of planned
maintenance.
How many Appl instances should you identify?

A. 1
B. 2
C. 6
D. 7

Answer: C
Explanation:
Only one update domain is rebooted at a time. Here there are 7 update domain with one VM each (and
13 update domain with no VM).
Reference:

Visit us athttps://www.examsboost.com/test/az-304/
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability
Question: 57

Note: This question is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named
storage1. You plan to archive data to storage1.
You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.
Solution: You create an Azure Blob storage container, and you configure a legal hold access
policy. Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Use an Azure Blob storage container, but use a time-based retention policy instead of a legal hold.
Note:
Immutable storage for Azure Blob storage enables users to store business-critical data objects in a
WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a
user-specified interval. For the duration of the retention interval, blobs can be created and read, but
cannot be modified or deleted. Immutable storage is available for general-purpose v2 and Blob storage
accounts in all Azure regions.
Note: Set retention policies and legal holds
1. Create a new container or select an existing container to store the blobs that need to be kept
in the immutable state. The container must be in a general-purpose v2 or Blob storage account.
2. Select Access policy in the container settings. Then select Add policy under Immutable blob
storage. Either
3a. To enable legal holds, select Add Policy. Select Legal hold from the drop-down menu.
Or
3b. To enable time-based retention, select Time-based retention from the drop-down menu.
4. Enter the retention interval in days (acceptable values are 1 to 146000 days).
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutability-policies-manage
Question: 58

Visit us athttps://www.examsboost.com/test/az-304/
Note: This question is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named
Storage1. You plan to archive data to Storage1.
You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.
Solution: You create a file share and
snapshots. Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Instead you could create an Azure Blob storage container, and you configure a legal hold access policy.
References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage
Question: 59

Note: This question is part of a series of questions that present the same scenario. Each question in the
series contains a unique solution that might meet the stated goals. Some question sets might have more
than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have an Azure Storage v2 account named
Storage1. You plan to archive data to Storage1.
You need to ensure that the archived data cannot be deleted for five years. The solution must prevent
administrators from deleting the data.
Solution: You create a file share, and you configure an access
policy. Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Instead of a file share, an immutable Blob storage is required.
Time-based retention policy support: Users can set policies to store data for a specified interval. When a time-
based retention policy is set, blobs can be created and read, but not modified or deleted. After the
retention period has expired, blobs can be deleted but not overwritten.

Visit us athttps://www.examsboost.com/test/az-304/
Note: Set retention policies and legal holds
1. Create a new container or select an existing container to store the blobs that need to be kept
in the immutable state. The container must be in a general-purpose v2 or Blob storage account.
2. Select Access policy in the container settings. Then select Add policy under Immutable blob storage.
3. To enable time-based retention, select Time-based retention from the drop-down menu.
4. Enter the retention interval in days (acceptable values are 1 to 146000
days). References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutable-storage
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-immutability-policies-manage
Question: 60

Note: This question is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it As a result, these
questions will not appear In the review screen.
You have an on-premises Hyper-V cluster that hosts 20 virtual machines. Some virtual machines run
Windows Server 2016 and some run Linux.
You plan to migrate the virtual machines to an Azure subscription.
You need to recommend a solution to replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.
Solution: You recommend implementing an Azure Storage account and then running AzCopy.
Does this meet the goal?

A. Yes
B. NO

Answer: B
Explanation:
AzCopy only copy files, not the disks.
Instead use Azure Site Recovery.
References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview
Question: 61

Note: This question Is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution, while others might not have a correct solution.
After you answer a question In this section, you will NOT be able to return to It As a result, these
questions will not appear In the review screen.
You have an on-premises Hyper-V cluster that hosts 20 virtual machines. Some virtual machines run
Windows Server 2016 and some run Linux.
You plan to migrate the virtual machines to an Azure subscription.

Visit us athttps://www.examsboost.com/test/az-304/
You need to recommend a solution to replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.
Solution: You recommend implementing an Azure Storage account that has a file service and a blob
service, and then using the Data Migration Assistant
Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Data Migration Assistant is used to migrate SQL
databases. Instead use Azure Site Recovery.
References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview
Question: 62

Note: This question is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution. while others might not have a correct solution.
After you answer a question In this section, you will NOT be able to return to it As a result these
questions will not appear In the review screen.
You have an on-premises Hyper-V cluster that hosts 20 virtual machines Some virtual machines run
Windows Server 2016 and some run Linux
You plan to morale the virtual machine? to an Azure subscription
You need to recommend 9 solution 10 replicate the disks of the virtual machines to Azure. The solution
must ensure that the virtual machines remain available during the migration of the disks.
Solution: You recommend implementing a Recovery Services vault and then using Azure Site
Recovery. Dees this meet the goal?

A. Yes
B. No

Answer: A
Explanation:
Site Recovery can replicate on-premises VMware VMs, Hyper-V VMs, physical servers (Windows and
Linux), Azure Stack VMs to Azure.
Note: Site Recovery helps ensure business continuity by keeping business apps and workloads running during
outages. Site Recovery replicates workloads running on physical and virtual machines (VMs) from a
primary site to a secondary location. When an outage occurs at your primary site, you fail over to
secondary location, and access apps from there. After the primary location is running again, you can fail
back to it.

Visit us athttps://www.examsboost.com/test/az-304/
References:
https://docs.microsoft.com/en-us/azure/site-recovery/site-recovery-overview
Question: 63

You are designing a storage solution that will use Azure Blob storage. The data will be stored in a cool
access tier or an archive access tier based on the access patterns of the data.
You identify the following types of infrequently accessed data:
Telemetry data: Deleted after two years
D18912E1457D5D1DDCBD40AB3BF70D5D
Promotional material: Deleted after 14 days Virtual
machine audit data: Deleted after 200 days
A colleague recommends using the archive access tier to store the data.
Which statement accurately describes the recommendation?

A. Storage costs will be based on a minimum of 30 days.

B. Access to the data is guaranteed within five minutes.
C. Access to the data is guaranteed within 30 minutes.
D. Storage costs will be based on a minimum of 180 days.

Answer: D
Explanation:
The following table shows a comparison of premium performance block blob storage, and the hot, cool,
and archive access tiers.

Visit us athttps://www.examsboost.com/test/az-304/
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers
Question: 64

You are planning to deploy an application named App1 that will run in containers on Azure Kubernetes
Service (AKS) clusters. The AKS clusters will be distributed across four Azure regions.
You need to recommend a storage solution for App1. Updated container images must be replicated
automatically to all the AKS clusters.
Which storage solution should you recommend?

A. Premium SKU Azure Container Registry

B. Azure Content Delivery Network (CDN)
C. geo redundant storage (GRS) accounts
D. Azure Cache for Redis

Answer: A
Explanation:
Enable geo-replication for container images.

Visit us athttps://www.examsboost.com/test/az-304/
Best practice: Store your container images in Azure Container Registry and geo-replicate the registry to
each AKS region.
To deploy and run your applications in AKS, you need a way to store and pull the container images.
Container Registry integrates with AKS, so it can securely store your container images or Helm charts.
Container Registry supports multimaster geo-replication to automatically replicate your images to Azure
regions around the world.
Geo-replication is a feature of Premium SKU container registries.
Note:
When you use Container Registry geo-replication to pull images from the same region, the results are:
Faster: You pull images from high-speed, low-latency network connections within the same Azure
region.
More reliable: If a region is unavailable, your AKS cluster pulls the images from an available container
registry.
Cheaper: There's no network egress charge between datacenters.
Reference:
https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-multi-region

Question: 66

You deploy two instances of an Azure web app. One instance is in the East US Azure region and the other
instance is in the West US Azure region. The web app uses Azure Blob storage to deliver large files to end users.
You need to recommend a solution for delivering the files to the users. The solution must meet the
following requirements:
Ensure that the users receive files from the same region as the web app that they access.
Ensure that the files only need to be updated once.
Minimize costs.
What should you include in the recommendation?

A. Azure File Sync

B. Distributed File System (DFS)
C. read-access geo-redundant storage (RA-GRS)
D. geo-redundant storage (GRS)

Answer: C
Question: 67

You are developing a web application that provides streaming video to users. You configure the
application to use continuous integration and deployment.
The app must be highly available and provide a continuous streaming experience for users.
You need to recommend a solution that allows the application to store data in a geographical location that
is closest to the user.
What should you recommend?

A. Azure App Service Web Apps

B. Azure App Service Isolated
C.Azure Redis Cache
D. Azure Content Delivery Network (CDN)

Answer: D
Explanation:
Azure Content Delivery Network (CDN) is a global CDN solution for delivering high-bandwidth content. It can be
hosted in Azure or any other location. With Azure CDN, you can cache static objects loaded from Azure Blob
storage, a web application, or any publicly accessible web server, by using the closest point of presence

Visit us athttps://www.examsboost.com/test/az-304/
(POP) server. Azure CDN can also accelerate dynamic content, which cannot be cached, by leveraging various
network and routing optimizations.
References:
https://docs.microsoft.com/en-in/azure/cdn/
Question: 68

Visit us athttps://www.examsboost.com/test/az-304/
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must
meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy a web app in an Isolated App Service plan.
Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Instead, you should deploy an Azure virtual machine to two Azure regions, and you create a Traffic
Manager profile.
Question: 69

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must
meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy a virtual machine scale set that uses autoscaling.
Does this meet the goal?

A. Yes
B. No

Answer: B
Explanation:
Instead, you should deploy two Azure virtual machines to two Azure regions, and you create a Traffic
Manager profile.
Question: 70

You need to deploy resources to host a stateless web app in an Azure subscription. The solution must
meet the following requirements:
• Provide access to the full .NET framework.
• Provide redundancy if an Azure region fails.
• Grant administrators access to the operating system to install custom application dependencies.
Solution: You deploy an Azure virtual machine to two Azure regions, and you deploy an Azure
Application Gateway.
Does this meet the goal?

Visit us athttps://www.examsboost.com/test/az-304/
A. Yes
B. No

Answer: B
Explanation:
You need to deploy two Azure virtual machines to two Azure regions, but also create a Traffic Manager
profile.
Question: 71

Note: This question is part of a series of questions that present the same scenario. Each question in the series
contains a unique solution that might meet the stated goals. Some question sets might have more than
one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You need to deploy resources to host a stateless web app in an Azure subscription. The solution must
meet the following requirements:
Provide access to the full .NET framework.
Provide redundancy if an Azure region fails.
Grant administrators access to the operating system to install custom application dependencies. Solution:
You deploy two Azure virtual machines to two Azure regions, and you create a Traffic Manager profile.
Does this meet the goal?

A. Yes
B. No

Answer: A
Question: 72

You plan to deploy a network-intensive application to several Azure virtual machines.

You need to recommend a solution that meets the following requirements: Minimizes
the use of the virtual machine processors to transfer data
Minimizes network latency
Which virtual machine size and feature should you use? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.

Visit us athttps://www.examsboost.com/test/az-304/
 Answe
r:

References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sizes-hpc#h-series
Question: 73
You need to recommend a solution to deploy containers that run an application. The application has two
tiers.
Each tier is implemented as a separate Docker Linux-based image. The solution must meet the following
requirements:
The front-end tier must be accessible by using a public IP address on port 80.
The backend tier must be accessible by using port 8080 from the front-end tier only.
Both containers must be able to access the same Azure file share.
If a container fails, the application must restart automatically.

Visit us athttps://www.examsboost.com/test/az-304/
Costs must be minimized.
What should you recommend using to host the application?

A. Azure Kubernetes Service (AKS)

B. Azure Service Fabric
C. Azure Container instances

Answer: C
Explanation:
Azure Container Instances enables a layered approach to orchestration, providing all of the scheduling
and management capabilities required to run a single container, while allowing orchestrator platforms to
manage multi-container tasks on top of it.
Because the underlying infrastructure for container instances is managed by Azure, an orchestrator
platform does not need to concern itself with finding an appropriate host machine on which to run a single
container.
Azure Container Instances can schedule both Windows and Linux containers with the same API.
Orchestration of container instances exclusively
Because they start quickly and bill by the second, an environment based exclusively on Azure Container
Instances offers the fastest way to get started and to deal with highly variable workloads.
Reference:
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-overview
https://docs.microsoft.com/en-us/azure/container-instances/container-instances-orchestrator-
relationship
Question: 74

You architect a solution that calculates 3D geometry from height-map data.

You have the following requirements:
Perform calculations in Azure.
Each node must communicate data to every other node.
Maximize the number of nodes to calculate multiple scenes as fast as possible.
Require the least amount of effort to implement.
You need to recommend a solution.
Which two actions should you recommend? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Create a render farm that uses Azure Batch.

B. Enable parallel file systems on Azure.
C. Enable parallel task execution on compute nodes.
D. Create a render farm that uses virtual machine (VM) scale sets.
E. Create a render farm that uses virtual machines (VMs).

Answer: AC

Visit us athttps://www.examsboost.com/test/az-304/
 Question: 75

Your company plans to publish APIs for its services by using Azure API Management.
You discover that service responses include the AspNet-Version header.
You need to recommend a solution to remove AspNet-Version from the response of the published APIs.
What should you include in the recommendation?

A. a new product
B. a modification to the URL scheme
C.a new policy
D. a new revision

Answer: C
References:
https://docs.microsoft.com/en-us/azure/api-management/transform-api
Question: 76

You have an Azure subscription that contains a storage account.

An application sometimes writes duplicate files to the storage account.
You have a PowerShell script that identifies and deletes duplicate files in the storage account. Currently,
the script is run manually after approval from the operations manager.
You need to recommend a serverless solution that performs the following actions:
Runs the script once an hour to identify whether duplicate files exist
Sends an email notification to the operations manager requesting approval to delete the duplicate files
Processes an email response from the operations manager specifying whether the deletion was
approved
Runs the script if the deletion was approved
What should you include in the recommendation?

A. Azure Logic Apps and Azure Functions

B. Azure Pipelines and Azure Service Fabric
C. Azure Logic Apps and Azure Event Grid
D. Azure Functions and Azure Batch

Answer: A
Explanation:
You can schedule a powershell script with Azure Logic Apps.
When you want to run code that performs a specific job in your logic apps, you can create your own
function by using Azure Functions. This service helps you create Node.js, C#, and F# functions so you don't
have to build a complete app or infrastructure to run code. You can also call logic apps from inside Azure
functions. Azure Functions provides serverless computing in the cloud and is useful for performing tasks
such as these examples:

Visit us athttps://www.examsboost.com/test/az-304/
Reference:
https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-azure-functions
Question: 77

You have an on-premises network that uses on IP address space of

172.16.0.0/16 You plan to deploy 25 virtual machines to a new azure subscription.
You identity the following technical requirements.
All Azure virtual machines must be placed on the same subnet subnet1.
All the Azure virtual machines must be able to communicate with all on premises severs.
The servers must be able to communicate between the on-premises network and Azure by using a site
to site VPN.
You need to recommend a subnet design that meets the technical requirements.
What should you include in the recommendation? To answer, drag the appropriate network addresses to
the correct subnet. Each network address may be used once, more than once or not at all. You may need
to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answe
r:

Question: 78
You are designing an Azure solution.
The network traffic for the solution must be securely distributed by providing the following features:
HTTPS protocol
Round robin routing
SSL offloading
You need to recommend a load balancing option.

Visit us athttps://www.examsboost.com/test/az-304/
What should you recommend?

A. Azure Load Balancer

B. Azure Traffic Manager
C. Azure Internal Load Balancer (ILB)
D. Azure Application Gateway

Answer: D
Explanation:
If you are looking for Transport Layer Security (TLS) protocol termination ("SSL offload") or per-
HTTP/HTTPS
request, application-layer processing, review Application Gateway.
Application Gateway is a layer 7 load balancer, which means it works only with web traffic (HTTP,
HTTPS, WebSocket, and HTTP/2). It supports capabilities such as SSL termination, cookie-based
session affinity, and round robin for load-balancing traffic. Load Balancer load-balances traffic at layer 4 (TCP
or UDP).
References:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq
Question: 79

Your company, named Contoso, Ltd, implements several Azure logic apps that have HTTP triggers: The
logic apps provide access to an on-premises web service.
Contoso establishes a partnership with another company named Fabrikam, Inc.
Fabrikam does not have an existing Azure Active Directory (Azure AD) tenant and uses third-party OAuth
2.0 identity management to authenticate its users.
Developers at Fabrikam plan to use a subset of the logics apps to build applications that will integrate with
the on-premises web service of Contoso.
You need to design a solution to provide the Fabrikam developers with access to the logic apps. The
solution must meet the following requirements:
Requests to the logic apps from the developers must be limited to lower rates than the requests from
the users at Contoso.
The developers must be able to rely on their existing OAuth 2.0 provider to gain access to the logic apps.
The solution must NOT require changes to the logic apps. The
solution must NOT use Azure AD guest accounts.
What should you include in the solution?

A. Azure AD business-to-business (B2B)

B. Azure Front Door
C. Azure API Management
D. Azure AD Application Proxy

Answer: C
Explanation:

Visit us athttps://www.examsboost.com/test/az-304/
API Management helps organizations publish APIs to external, partner, and internal developers to
unlock the potential of their data and services.
You can secure API Management using the OAuth 2.0 client credentials flow.
Incorrect Answers:
A: Azure Active Directory B2B uses guest users.
B: Azure Front Door is an Application Delivery Network (ADN) as a service, offering various layer 7 load-
balancing capabilities for your applications.
Azure Front Door supports HTTP, HTTPS and
HTTP/2. Applications can be authorized through
OAuth 2.0.
D: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications
from a remote client. Application Proxy includes both the Application Proxy service which runs in the
cloud, and the Application Proxy connector which runs on an on-premises server.
Application Proxy works with:
Web applications that use Integrated Windows Authentication for authentication
Web applications that use form-based or header-based access
Reference:
https://docs.microsoft.com/en-us/azure/api-management/api-management-key-concepts
Question: 80

You need to design a solution that will execute custom C# code in response to an event routed to Azure
Event Grid. The solution must meet the following requirements:
The executed code must be able to access the private IP address of a Microsoft SQL Server instance that
runs on an Azure virtual machine.
Costs must be minimized.
What should you include in the solution?

A. Azure Logic Apps in the integrated service environment

B. Azure Functions in the Dedicated plan and the Basic Azure App Service plan
C. Azure Logic Apps in the Consumption plan
D. Azure Functions in the Consumption plan

Answer: D
Explanation:
When you create a function app in Azure, you must choose a hosting plan for your app. There are three
basic hosting plans available for Azure Functions: Consumption plan, Premium plan, and Dedicated (App
Service) plan.
For the Consumption plan, you don't have to pay for idle VMs or reserve capacity in advance.
Connect to private endpoints with Azure Functions
As enterprises continue to adopt serverless (and Platform-as-a-Service, or PaaS) solutions, they often
need a way to integrate with existing resources on a virtual network. These existing resources could be
databases, file storage, message queues or event streams, or REST APIs.
Reference:
https://docs.microsoft.com/en-us/azure/azure-functions/functions-scale
https://techcommunity.microsoft.com/t5/azure-functions/connect-to-private-endpoints-with-azure-
functions/ba-p/1426615

Visit us athttps://www.examsboost.com/test/az-304/
 Question: 81

The developers at your company are building a containerized Python Django app.
You need to recommend platform to host the app. The solution must meet the following requirements:
Support autoscaling.
Support continuous deployment from an Azure Container Registry.
Provide built-in functionality to authenticate app users by using Azure Active Directory (Azure AD).
Which platform should you include in the recommendation?

A. Azure Container instances

B. an Azure App Service instance that uses containers
C. Azure Kubernetes Service (AKS)

Answer: C
Explanation:
To keep up with application demands in Azure Kubernetes Service (AKS), you may need to adjust the
number of nodes that run your workloads. The cluster autoscaler component can watch for pods in your
cluster that can't be scheduled because of resource constraints. When issues are detected, the number of
nodes in a node pool is increased to meet the application demand.
Azure Container Registry is a private registry for hosting container images. It integrates well with
orchestrators like Azure Container Service, including Docker Swarm, DC/OS, and the new Azure
Kubernetes service.
Moreover, ACR provides capabilities such as Azure Active Directory-based authentication, webhook
support, and delete operations.
Reference:
https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler
https://medium.com/velotio-perspectives/continuous-deployment-with-azure-kubernetes-service-
azurecontainer-
registry-jenkins-ca337940151b
Question: 82

You have an on-premises network to which you deploy a virtual appliance.

You plan to deploy several Azure virtual machines and connect the on-premises network to Azure by
using a Site-to-Site connection.
All network traffic that will be directed from the Azure virtual machines to a specific subnet must flow
through the virtual appliance.
You need to recommend solutions to manage network traffic.
Which two options should you recommend? Each correct answer presents a complete solution.

A. Configure Azure Traffic Manager.

B. Implement an Azure virtual network.
C. Implement Azure ExpressRoute.
D. Configure a routing table.

Visit us athttps://www.examsboost.com/test/az-304/
 Answer: CD
Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual
cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do
not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster
speeds, lower latencies, and higher security than typical connections over the Internet.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm
https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction
Question: 83

You are developing a sales application that will contain several Azure cloud services and will handle
different components of a transaction. Different cloud services will process customer orders, billing,
payment, inventory, and shipping.
You need to recommend a solution to enable the cloud services to asynchronously communicate
transaction information by using REST messages.
What should you include in the recommendation?

A. Azure Service Bus

B. Azure Blob storage
C.Azure Notification Hubs
D. Azure Application Gateway

Answer: A
Explanation:
Service Bus is a transactional message broker and ensures transactional integrity for all internal
operations against its message stores. All transfers of messages inside of Service Bus, such as moving
messages to a dead-letter queue or automatic forwarding of messages between entities, are
transactional.
Reference:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-transactions
Question: 84

You are designing a message application that will run on an on-premises Ubuntu virtual machine. The
application will use Azure Storage queues.
You need to recommend a processing solution for the application to interact with the storage queues. The
solution must meet the following requirements:
Create and delete queues daily.
Be scheduled by using a CRON job.
Upload messages every five minutes.
What should developers use to interact with the queues?

Visit us athttps://www.examsboost.com/test/az-304/
A. Azure CLI
B. AzCopy
C.Azure Data Factory
D. .NET Core

Answer: D
Reference:
https://docs.microsoft.com/en-us/azure/storage/queues/storage-tutorial-queues

Visit us athttps://www.examsboost.com/test/az-304/