HOTSPOT
-
Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1. Server1 contains an app named App1 that uses AD DS authentication. Remote users access App1 by using a VPN connection to the on-premises network.
You have an Azure AD tenant that syncs with the AD DS domain by using Azure AD Connect.
You need to ensure that the remote users can access App1 without using a VPN. The solution must meet the following requirements:
• Ensure that the users authenticate by using Azure Multi-Factor Authentication (MFA).
• Minimize administrative effort.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: In Azure AD: An enterprise application
On-premises: A server that runs Windows Server and has the Azure AD Application Proxy connector installed
Explanation: Publish the on-premises AD-authenticated app with Microsoft Entra Application Proxy. This creates/configures an enterprise application for Azure AD pre-authentication, enabling Conditional Access and Azure MFA, while the Application Proxy connector provides secure access without a VPN and minimizes administrative effort.
Question 22
HOTSPOT
-
You need to recommend a solution to integrate Azure Cosmos DB and Azure Synapse. The solution must meet the following requirements:
• Traffic from an Azure Synapse workspace to the Azure Cosmos DB account must be sent via the Microsoft backbone network.
• Traffic from the Azure Synapse workspace to the Azure Cosmos DB account must NOT be routed over the internet.
• Implementation effort must be minimized.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: A Synapse managed virtual network is required to use managed private endpoints. Managed private endpoints (Azure Private Link) provide private connectivity from Synapse to Azure Cosmos DB over the Microsoft backbone, avoiding internet routing with minimal implementation effort.
Question 23
You have an Azure subscription that contains an Azure Kubernetes Service (AKS) instance named AKS1. AKS1 hosts microservice-based APIs that are configured to listen on non-default HTTP ports.
You plan to deploy a Standard tier Azure API Management instance named APIM1 that will make the APIs available to external users.
You need to ensure that the AKS1 APIs are accessible to APIM1. The solution must meet the following requirements:
• Implement MTLS authentication between APIM1 and AKS1.
• Minimize development effort.
• Minimize costs.
What should you do?
A. Implement an external load balancer on AKS1.
B. Redeploy APIM1 to the virtual network that contains AKS1.
C. Implement an ExternalName service on AKS1.
D. Deploy an ingress controller to AKS1.
Show Answer
Correct Answer: D
Explanation: Deploying an ingress controller (such as NGINX Ingress or AGIC) provides a standard entry point for AKS services, supports mutual TLS termination/authentication with Azure API Management, and avoids modifying each microservice. This minimizes development effort and is more cost-effective than exposing services individually or redeploying API Management into a virtual network solely for connectivity. An external load balancer does not by itself provide the required mTLS integration, and an ExternalName service is only for DNS aliasing within Kubernetes.
Question 25
HOTSPOT
-
You have 10 on-premises servers that run Windows Server.
You need to perform daily backups of the servers to a Recovery Services vault. The solution must meet the following requirements:
• Back up all the files and folders on the servers.
• Maintain three copies of the backups in Azure.
• Minimize costs.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: On the servers: The Microsoft Azure Recovery Services (MARS) agent
For the storage: Locally-redundant storage (LRS)
Explanation: MARS is the Azure Backup agent used to back up Windows Server files and folders to a Recovery Services vault. LRS maintains three copies of the data within a single Azure region and is the lowest-cost option that satisfies the three-copy requirement.
Question 26
HOTSPOT
-
You are designing a data pipeline that will integrate large amounts of data from multiple on-premises Microsoft SQL Server databases into an analytics platform in Azure. The pipeline will include the following actions:
• Database updates will be exported periodically into a staging area in Azure Blob storage.
• Data from the blob storage will be cleansed and transformed by using a highly parallelized load process.
• The transformed data will be loaded to a data warehouse.
• Each batch of updates will be used to refresh an online analytical processing (OLAP) model in a managed serving layer.
• The managed serving layer will be used by thousands of end users.
You need to implement the data warehouse and serving layers.
What should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Data warehouse: An Azure Synapse Analytics dedicated SQL pool
Serving layer: Azure Analysis Services
Explanation: A dedicated SQL pool is the MPP data warehouse designed for large-scale analytical storage and querying. Azure Analysis Services provides the managed OLAP semantic model and serves thousands of users efficiently.
Question 27
Your on-premises datacenter contains a server that runs Linux and hosts a Java app named App1. App1 has the following characteristics:
• App1 is an interactive app that users access by using HTTPS connections.
• The number of connections to App1 changes significantly throughout the day.
• App1 runs multiple concurrent instances.
• App1 requires major changes to run in a container.
You plan to migrate App1 to Azure.
You need to recommend a compute solution for App1. The solution must meet the following requirements:
• The solution must run multiple instances of App1.
• The number of instances must be managed automatically depending on the load.
• Administrative effort must be minimized.
What should you include in the recommendation?
A. Azure Batch
B. Azure App Service
C. Azure Kubernetes Service (AKS)
D. Azure Virtual Machine Scale Sets
Show Answer
Correct Answer: B
Explanation: Azure App Service is the best fit because it supports Java web applications on Linux without requiring containerization, provides built-in HTTPS hosting, can run multiple instances, and supports automatic horizontal autoscaling based on load. It is a fully managed PaaS offering, minimizing administrative effort compared to Virtual Machine Scale Sets. Azure Kubernetes Service is unsuitable because the application would require major changes to run in containers, and Azure Batch is intended for batch processing rather than interactive web applications.
Question 28
HOTSPOT
-
You plan to deploy a containerized web-app that will be hosted in five Azure Kubernetes Service (AKS) clusters. Each cluster will be hosted in a different Azure region.
You need to provide access to the app from the internet. The solution must meet the following requirements:
• Incoming HTTPS requests must be routed to the cluster that has the lowest network latency.
• HTTPS traffic to individual pods must be routed via an ingress controller.
• In the event of an AKS cluster outage, failover time must be minimized.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Global load balancing: Azure Front Door
Ingress controller: Azure Application Gateway
Explanation: Azure Front Door provides global HTTP(S) load balancing with latency-based routing and rapid failover. Azure Application Gateway with the Application Gateway Ingress Controller (AGIC) provides Layer 7 ingress routing to AKS pods.
Question 29
HOTSPOT
-
You have the Azure subscriptions shown in the following table.
Contoso.onmicrosft.com contains a user named User1.
You need to deploy a solution to protect against ransomware attacks. The solution must meet the following requirements:
• Ensure that all the resources in Sub1 are backed up by using Azure Backup.
• Require that User1 first be assigned a role for Sub2 before the user can make major changes to the backup configuration.
What should you create in each subscription? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Sub1: A Recovery Services vault
Sub2: A Resource Guard
Explanation: A Recovery Services vault is required to protect resources with Azure Backup. Resource Guard provides Multi-User Authorization (MUA), requiring a separate authorization (role assignment in the Resource Guard subscription/tenant) before performing critical backup configuration changes, helping protect against ransomware.
Question 30
HOTSPOT
-
Your company, named Contoso, Ltd., has an Azure subscription that contains the following resources:
• An Azure Synapse Analytics workspace named contosoworkspace1
• An Azure Data Lake Storage account named contosolake1
• An Azure SQL database named contososql1
The product data of Contoso is copied from contososql1 to contosolake1.
Contoso has a partner company named Fabrikam Inc. Fabrikam has an Azure subscription that contains the following resources:
• A virtual machine named FabrikamVM1 that runs Microsoft SQL Server 2019
• An Azure Storage account named fabrikamsa1
Contoso plans to upload the research data on FabrikamVM1 to contosolake1. During the upload, the research data must be transformed to the data formats used by Contoso.
The data in contosolake1 will be analyzed by using contosoworkspace1.
You need to recommend a solution that meets the following requirements:
• Upload and transform the FabrikamVM1 research data.
• Provide Fabrikam with restricted access to snapshots of the data in contosoworkspace1.
What should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Upload and transform the data: Azure Synapse pipelines
Provide restricted access: Azure Data Share
Explanation: Azure Synapse pipelines (built on Azure Data Factory) support data movement and transformation from SQL Server to Azure Data Lake Storage. Azure Data Share supports secure, snapshot-based sharing of data with external organizations while maintaining restricted access.
Question 31
HOTSPOT
-
You have an Azure subscription.
You need to deploy a solution that will provide point-in-time restore for blobs in storage accounts that have blob versioning and blob soft delete enabled.
Which type of blob should you create, and what should you enable for the accounts? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Blob type: Block
Enable: The change feed
Explanation: Point-in-time restore for Azure Blob Storage supports only standard GPv2 block blobs. Prerequisites include blob versioning, blob soft delete, and enabling the change feed.
$19
Get all 271 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.