Your company has offices in North America and Europe.
You plan to migrate to Azure.
You need to recommend a networking solution for the new Azure infrastructure. The solution must meet the following requirements:
• The Point-to-Site (P2S) VPN connections of mobile users must connect automatically to the closest Azure region.
• The offices in each region must connect to their local Azure region by using an ExpressRoute circuit.
• Transitive routing between virtual networks and on-premises networks must be supported.
• The network traffic between virtual networks must be filtered by using FQDNs.
What should you include in the recommendation?
A. Azure Virtual WAN with a secured virtual hub
B. virtual network peering and application security groups
C. virtual network gateways and network security groups (NSGs)
D. Azure Route Server and Azure Network Function Manager
Show Answer
Correct Answer: A
Explanation: Azure Virtual WAN with a secured virtual hub satisfies all listed requirements: P2S users can connect to the nearest Azure region, ExpressRoute can terminate in regional Virtual WAN hubs, Virtual WAN provides transitive routing across VNets and on-premises connectivity, and a secured virtual hub uses Azure Firewall to provide FQDN-based traffic filtering. The other options lack one or more key capabilities, particularly transitive routing, automatic regional P2S connectivity, or FQDN filtering.
Question 116
You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping.
You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages.
What should you include in the recommendation?
A. Azure Service Fabric
B. Azure Data Lake
C. Azure Service Bus
D. Azure Application Gateway
Show Answer
Correct Answer: C
Explanation: Azure Service Bus is the Azure messaging service designed for reliable asynchronous communication between distributed applications and services. It supports queues and topics for decoupling components and can carry XML messages as message payloads. Azure Service Fabric is for microservices hosting, Azure Data Lake is for analytics storage, and Azure Application Gateway is a web traffic load balancer.
Question 117
You have an Azure subscription.
You need to deploy an Azure Kubernetes Service (AKS) solution that will use Windows Server 2019 nodes. The solution must meet the following requirements:
• Minimize the time it takes to provision compute resources during scale-out operations.
• Support autoscaling of Windows Server containers.
Which scaling option should you recommend?
A. horizontal pod autoscaler
B. Virtual nodes
C. Kubernetes version 1.20.2 or newer
D. cluster autoscaler
Show Answer
Correct Answer: D
Explanation: Cluster autoscaler is the appropriate choice for AKS with Windows Server 2019 node pools. It automatically adds or removes VM nodes to support pending Windows pods, enabling autoscaling of Windows containers. Virtual nodes are intended for Azure Container Instances and historically support Linux workloads rather than Windows node pools. Horizontal Pod Autoscaler scales pod replicas but does not provision compute resources. A specific Kubernetes version alone is not a scaling option.
Question 118
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
A. Azure SQL Database Basic
B. Azure SQL Managed Instance General Purpose
C. Azure SQL Database Business Critical
D. Azure SQL Managed Instance Business Critical
Show Answer
Correct Answer: C
Explanation: Azure SQL Database Business Critical uses locally deployed synchronous replicas, enabling automatic failover with zero data loss (RPO=0), and supports zone-redundant configuration to remain available during an availability zone outage. Basic does not provide these capabilities. Managed Instance General Purpose does not satisfy the zone redundancy requirement. Managed Instance Business Critical also meets the technical requirements but is typically more expensive than a single Azure SQL Database Business Critical deployment, so it does not best satisfy the cost minimization requirement.
Question 119
You are developing a sales application that will contain several Azure cloud services and handle different components of a transaction. Different cloud services will process customer orders, billing, payment, inventory, and shipping.
You need to recommend a solution to enable the cloud services to asynchronously communicate transaction information by using XML messages.
What should you include in the recommendation?
A. Azure Service Bus
B. Azure Data Lake
C. Azure Traffic Manager
D. Azure Blob Storage
Show Answer
Correct Answer: A
Explanation: Azure Service Bus is the appropriate Azure messaging service for asynchronous communication between distributed cloud services. It supports reliable message queues and topics/subscriptions for decoupled components, and message payloads can be XML. Azure Data Lake is for analytics storage, Traffic Manager is for DNS-based traffic routing, and Blob Storage is object storage rather than a messaging service.
Question 120
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
A. Azure SQL Database Hyperscale
B. Azure SQL Database Premium
C. Azure SQL Database Basic
D. Azure SQL Database Standard
Show Answer
Correct Answer: B
Explanation: Premium supports zone-redundant high availability with synchronous replicas (RPO=0, no data loss on failover) and availability across Availability Zones. Basic and Standard do not support zone redundancy. While Hyperscale also offers high availability, the question emphasizes minimizing cost among suitable options, and Premium is the expected choice compared with Hyperscale.
Question 123
You are developing an app that will read activity logs for an Azure subscription by using Azure Functions.
You need to recommend an authentication solution for Azure Functions. The solution must minimize administrative effort.
What should you include in the recommendation?
A. an enterprise application in Azure AD
B. system-assigned managed identities
C. shared access signatures (SAS)
D. application registration in Azure AD
Show Answer
Correct Answer: B
Explanation: System-assigned managed identities are the recommended authentication mechanism for Azure Functions accessing Azure resources because Azure manages the identity lifecycle and credentials automatically. This eliminates the need to manage client secrets or certificates, minimizing administrative effort. Azure Activity Logs can be accessed by granting the managed identity appropriate Azure RBAC permissions. Enterprise applications and app registrations require additional identity and credential management, while SAS is not used for Azure Activity Log authentication.
Question 126
You have an app named App1 that uses an on-premises Microsoft SQL Server database named DB1.
You plan to migrate DB1 to an Azure SQL managed instance.
You need to enable customer managed Transparent Data Encryption (TDE) for the instance. The solution must maximize encryption strength.
Which type of encryption algorithm and key length should you use for the TDE protector?
A. RSA 3072
B. AES 256
C. RSA 4096
D. RSA 2048
Show Answer
Correct Answer: A
Explanation: For Azure SQL Managed Instance with customer-managed Transparent Data Encryption (TDE), the TDE protector must be an asymmetric RSA key stored in Azure Key Vault or Managed HSM. Supported key sizes are RSA 2048 and RSA 3072; RSA 4096 is not supported for the TDE protector. Since the requirement is to maximize encryption strength, choose the largest supported key size: RSA 3072.
Question 127
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using the Regulatory compliance dashboard in Microsoft Defender for Cloud.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Regulatory compliance dashboard in Microsoft Defender for Cloud assesses and reports compliance against regulatory standards but does not enforce where Azure resources can be deployed. To restrict deployments to specific Azure regions and ensure App Service resources are created only in approved locations, Azure Policy with an allowed locations policy should be used. Therefore, the proposed solution does not meet the requirement.
Question 128
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You plan to deploy multiple instances of an Azure web app across several Azure regions.
You need to design an access solution for the app. The solution must meet the following replication requirements:
✑ Support rate limiting.
✑ Balance requests between all instances.
✑ Ensure that users can access the app in the event of a regional outage.
Solution: You use Azure Application Gateway to provide access to the app.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Azure Application Gateway is a regional Layer 7 load balancer and does not provide global traffic distribution across multiple Azure regions. The requirements include balancing requests across all regional instances, surviving a regional outage, and supporting rate limiting. Azure Front Door with WAF is the appropriate global service for these requirements, whereas Application Gateway alone does not meet them.
$19
Get all 272 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.