You have an on-premises network to which you deploy a virtual appliance. You plan to deploy several Azure virtual machines and connect the on-premises network to Azure by using a Site-to-Site connection. All network traffic that will be directed from the Azure virtual machines to a specific subnet must flow through the virtual appliance. You need to recommend solutions to manage network traffic. Which two options should you recommend? Each correct answer presents a complete solution.
Correct Answer: C,D
Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, lower latencies, and higher security than typical connections over the Internet. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm https://docs.microsoft.com/en-us/azure/expressroute/expressroute-introduction Topic 1, Fabrikam, inc Case Study A Overview: Existing Environment Fabrikam, Inc. is an engineering company that has offices throughout Europe. The company has a main office in London and three branch offices in Amsterdam Berlin, and Rome. Active Directory Environment: The network contains two Active Directory forests named corp.fabnkam.com and rd.fabrikam.com. There are no trust relationships between the forests. Corp.fabrikam.com is a production forest that contains identities used for internal user and computer authentication. Rd.fabrikam.com is used by the research and development (R&D) department only. Network Infrastructure: Each office contains at least one domain controller from the corp.fabrikam.com domain. The main office contains all the domain controllers for the rd.fabrikam.com forest. All the offices have a high-speed connection to the Internet. An existing application named WebApp1 is hosted in the data center of the London office. WebApp1 is used by customers to place and track orders. WebApp1 has a web tier that uses Microsoft Internet Information Services (IIS) and a database tier that runs Microsoft SQL Server 2016. The web tier and the database tier are deployed to virtual machines that run on Hyper-V. The IT department currently uses a separate Hyper-V environment to test updates to WebApp1. Fabrikam purchases all Microsoft licenses through a Microsoft Enterprise Agreement that includes Software Assurance. Problem Statement: The use of Web App1 is unpredictable. At peak times, users often report delays. Al other times, many resources for WebApp1 are underutilized. Requirements: Planned Changes: Fabrikam plans to move most of its production workloads to Azure during the next few years. As one of its first projects, the company plans to establish a hybrid identity model, facilitating an upcoming Microsoft Office 365 deployment All R&D operations will remain on-premises. Fabrikam plans to migrate the production and test instances of WebApp1 to Azure. Technical Requirements: Fabrikam identifies the following technical requirements: * Web site content must be easily updated from a single point. * User input must be minimized when provisioning new app instances. * Whenever possible, existing on premises licenses must be used to reduce cost. * Users must always authenticate by using their corp.fabrikam.com UPN identity. * Any new deployments to Azure must be redundant in case an Azure region fails. * Whenever possible, solutions must be deployed to Azure by using platform as a service (PaaS). * An email distribution group named IT Support must be notified of any issues relating to the directory synchronization services. * Directory synchronization between Azure Active Directory (Azure AD) and corp.fabhkam.com must not be affected by a link failure between Azure and the on premises network. Database Requirements: Fabrikam identifies the following database requirements: * Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings. * To avoid disrupting customer access, database downtime must be minimized when databases are migrated. * Database backups must be retained for a minimum of seven years to meet compliance requirement Security Requirements: Fabrikam identifies the following security requirements: *Company information including policies, templates, and data must be inaccessible to anyone outside the company *Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link fails. *Administrators must be able authenticate to the Azure portal by using their corp.fabrikam.com credentials. *All administrative access to the Azure portal must be secured by using multi-factor authentication. *The testing of WebApp1 updates must not be visible to anyone outside the company.
Question 92
You are designing an Azure Cosmos DB solution that will host multiple writable replicas in multiple Azure regions. You need to recommend the strongest database consistency level for the design. The solution must meet the following requirements: * Provide a latency-based Service Level Agreement (SLA) for writes. * Support multiple regions. Which consistency level should you recommend?
Correct Answer: A
Explanation Each level provides availability and performance tradeoffs. The following image shows the different consistency levels as a spectrum. Timeline Description automatically generated Note: The service offers comprehensive 99.99% SLAs which covers the guarantees for throughput, consistency, availability and latency for the Azure Cosmos DB Database Accounts scoped to a single Azure region configured with any of the five Consistency Levels or Database Accounts spanning multiple Azure regions, configured with any of the four relaxed Consistency Levels. Reference: https://azure.microsoft.com/en-us/support/legal/sla/cosmos-db/v1_3/ https://docs.microsoft.com/en-us/azure/cosmos-db/consistency-levels#consistency-levels-and-latency
Question 93
You are building an application that will run in a virtual machine (VM). The application will use Azure Managed Identity. The application uses Azure Key Vault, Azure SQL Database, and Azure Cosmos DB. You need to ensure the application can use secure credentials to access these services. Which authentication method should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation Note: Managed identities for Azure resources is the new name for the service formerly known as Managed Service Identity (MSI). Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview
Question 94
Your company has the infrastructure shown in the following table. The on-premises Active Directory domain syncs to Azure Active Directory (Azure AD). Server1 runs an application named Appl that uses LDAP queries to verify user identities in the on-premises Active Directory domain. You plan to migrate Server1 to a virtual machine in Subscription1. A company security policy states that the virtual machines and services deployed to Subscription! must be prevented from accessing the on-premises network. You need to recommend a solution to ensure that Appl continues to function after the migration. The solution must meet the security policy. What should you include in the recommendation?
Correct Answer: D
Explanation You can join a Windows Server virtual machine to an Azure Active Directory Domain Services managed domain. Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/join-windows-vm
Question 95
Your on-premises network contains a file server named Server1 that stores 500 GB of data. You need to use Azure Data Factory to copy the data from Server1 to Azure Storage. You add a new data factory. What should you do next? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
