You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
A. Azure SQL Database Basic
B. Azure SQL Managed Instance General Purpose
C. Azure SQL Database Business Critical
D. Azure SQL Managed Instance Business Critical
Show Answer
Correct Answer: C
Explanation: Azure SQL Database Business Critical uses locally deployed synchronous replicas, enabling automatic failover with zero data loss (RPO=0), and supports zone-redundant configuration to remain available during an availability zone outage. Basic does not provide these capabilities. Managed Instance General Purpose does not satisfy the zone redundancy requirement. Managed Instance Business Critical also meets the technical requirements but is typically more expensive than a single Azure SQL Database Business Critical deployment, so it does not best satisfy the cost minimization requirement.
Question 119
You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping.
You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages.
What should you include in the recommendation?
A. Azure Service Bus
B. Azure Data Lake
C. Azure Traffic Manager
D. Azure Blob Storage
Show Answer
Correct Answer: A
Explanation: Azure Service Bus is the appropriate Azure messaging service for asynchronous communication between distributed cloud services. It supports reliable message queues and topics/subscriptions for decoupled components, and message payloads can be XML. Azure Data Lake is for analytics storage, Traffic Manager is for DNS-based traffic routing, and Blob Storage is object storage rather than a messaging service.
Question 120
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
A. Azure SQL Database Hyperscale
B. Azure SQL Database Premium
C. Azure SQL Database Basic
D. Azure SQL Database Standard
Show Answer
Correct Answer: B
Explanation: Premium supports zone-redundant high availability with synchronous replicas (RPO=0, no data loss on failover) and availability across Availability Zones. Basic and Standard do not support zone redundancy. While Hyperscale also offers high availability, the question emphasizes minimizing cost among suitable options, and Premium is the expected choice compared with Hyperscale.
Question 121
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure a Conditional Access policy.
B. Use Azure AD entitlement management to govern external users.
C. Configure the Azure AD provisioning service.
D. Configure Azure AD Identity Protection.
Show Answer
Correct Answer: B
Explanation: Because the app is configured for single-tenant Microsoft Entra ID (Azure AD) authentication, users from another tenant need to be brought in as B2B guests (or otherwise represented in the resource tenant). Among the provided options, Microsoft Entra entitlement management is the feature that governs onboarding and lifecycle of external B2B users so they can access resources such as the app. Conditional Access and Identity Protection do not enable cross-tenant authentication, and the provisioning service is for user/app provisioning rather than enabling external tenant sign-in.
Question 123
You are developing an app that will read activity logs for an Azure subscription by using Azure Functions.
You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort.
What should you include in the recommendation?
A. an enterprise application in Azure AD
B. system-assigned managed identities
C. shared access signatures (SAS)
D. application registration in Azure AD
Show Answer
Correct Answer: B
Explanation: System-assigned managed identities are the recommended authentication mechanism for Azure Functions accessing Azure resources because Azure manages the identity lifecycle and credentials automatically. This eliminates the need to manage client secrets or certificates, minimizing administrative effort. Azure Activity Logs can be accessed by granting the managed identity appropriate Azure RBAC permissions. Enterprise applications and app registrations require additional identity and credential management, while SAS is not used for Azure Activity Log authentication.
Question 124
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure Azure AD join.
B. Configure Azure AD Identity Protection.
C. Use Azure AD entitlement management to govern external users.
D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
Show Answer
Correct Answer: C
Explanation: To allow users from another Microsoft Entra ID (Azure AD) tenant to access a single-tenant application, they must be brought in as external (B2B) users and governed appropriately. Azure AD Entitlement Management provides access packages and lifecycle governance for external users, enabling users from the fabrikam.com tenant to authenticate to the app after being invited. Azure AD Join, Identity Protection, and PIM do not enable cross-tenant authentication for a single-tenant application.
Question 125
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure Azure AD join.
B. Use Azure AD entitlement management to govern external users.
C. Enable Azure AD pass-through authentication and update the sign-in endpoint.
D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
Show Answer
Correct Answer: B
Explanation: To allow users from another Microsoft Entra ID (Azure AD) tenant to access a single-tenant application, you need to onboard them as external users (B2B) and govern their access. Azure AD Entitlement Management is designed to manage and govern external user access. Azure AD Join, pass-through authentication, and PIM do not enable cross-tenant authentication for a single-tenant web app.
Question 126
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1.
You plan to migrate DB1 to an Azure SQL managed instance.
You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength.
Which type of encryption algorithm and key length should you use for the TDE protector?
A. RSA 3072
B. AES 256
C. RSA 4096
D. RSA 2048
Show Answer
Correct Answer: A
Explanation: For Azure SQL Managed Instance with customer-managed Transparent Data Encryption (TDE), the TDE protector must be an asymmetric RSA key stored in Azure Key Vault or Managed HSM. Supported key sizes are RSA 2048 and RSA 3072; RSA 4096 is not supported for the TDE protector. Since the requirement is to maximize encryption strength, choose the largest supported key size: RSA 3072.
Question 127
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Regulatory compliance dashboard in Microsoft Defender for Cloud assesses and reports compliance against regulatory standards but does not enforce where Azure resources can be deployed. To restrict deployments to specific Azure regions and ensure App Service resources are created only in approved locations, Azure Policy with an allowed locations policy should be used. Therefore, the proposed solution does not meet the requirement.
Question 128
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You plan to deploy multiple instances of an Azure web app across several Azure regions.
You need to design an access solution for the app. The solution must meet the following replication requirements:
✑ Support rate limiting.
✑ Balance requests between all instances.
✑ Ensure that users can access the app in the event of a regional outage.
Solution: You use Azure Application Gateway to provide access to the app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Azure Application Gateway is a regional Layer 7 load balancer and does not provide global traffic distribution across multiple Azure regions. The requirements include balancing requests across all regional instances, surviving a regional outage, and supporting rate limiting. Azure Front Door with WAF is the appropriate global service for these requirements, whereas Application Gateway alone does not meet them.
$19
Get all 271 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.