You need to recommend a solution for the App1 maintenance task. The solution must minimize costs. What should you include in the recommendation?
A. an Azure logic app
B. an Azure function
C. an Azure virtual machine
D. an App Service WebJob
Every hour, you will run a maintenance task by invoking a PowerShell script that copies files from all the App1 instances. The PowerShell script will run from a central location. App1 will have six instances: three in the East US Azure region and three in the West Europe Azure region. You can create and manage workflows with Azure PowerShell in Azure Logic Apps. You can create a Consumption logic app in multi-tenant Azure Logic Apps by using the JSON file for a logic app workflow definition. You can then manage your logic app by running the cmdlets in the Az.LogicApp PowerShell module. Reference: https://docs.microsoft.com/en-us/azure/logic-apps/quickstart-logic-apps-azure-powershell
Question 242
You need to recommend a solution that meets the application development requirements. What should you include in the recommendation?
A. the Azure App Configuration service
B. an Azure Container Registry instance
C. deployment slots
D. Continuous Integration/Continuous Deployment (CI/CD) sources
When you deploy your web app, web app on Linux, mobile back end, or API app to Azure App Service, you can use a separate deployment slot instead of the default production slot when you're running in the Standard, Premium, or Isolated App Service plan tier. Deployment slots are live apps with their own host names. App content and configurations elements can be swapped between two deployment slots, including the production slot. Deploying your application to a non-production slot has the following benefits: * You can validate app changes in a staging deployment slot before swapping it with the production slot. * Deploying an app to a slot first and swapping it into production makes sure that all instances of the slot are warmed up before being swapped into production. This eliminates downtime when you deploy your app. * After a swap, the slot with previously staged app now has the previous production app. If the changes swapped into the production slot aren't as you expect, you can perform the same swap immediately to get your "last known good site" back. Note: Application Development Requirements Application developers will constantly develop new versions of App1 and App2. The development process must meet the following requirements: * A staging instance of a new application version must be deployed to the application host before the new version is used in production. * After testing the new version, the staging version of the application will replace the production version. * The switch to the new application version from staging to production must occur without any downtime of the application. Reference: https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots
Question 243
You need to recommend an App Service architecture that meets the requirements for App1. The solution must minimize costs. What should you recommend?
A. one App Service Environment (ASE) per availability zone
B. one App Service Environment (ASE) per region
C. one App Service plan per region
D. one App Service plan per availability zone
App1 has the following data requirements: Each instance will write data to a data store in the same availability zone as the instance. Data written by any App1 instance must be visible to all App1 instances. Note: The Azure App Service Environment v2 is an Azure App Service feature that provides a fully isolated and dedicated environment for securely running App Service apps at high scale. Customers can create multiple ASEs within a single Azure region or across multiple Azure regions. This flexibility makes ASEs ideal for horizontally scaling stateless application tiers in support of high requests per second (RPS) workloads. Reference: https://docs.microsoft.com/en-us/azure/app-service/environment/intro
Question 244
HOTSPOT - You need to recommend a solution to ensure that App1 can access the third-party credentials and access strings. The solution must meet the security requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
Scenario: Security Requirement - All secrets used by Azure services must be stored in Azure Key Vault. Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services. Box 1: A system-assigned managed identity No one knows the credentials of managed identities. Managed Identities exist in two formats: * System assigned: in this scenario, the identity is linked to a single Azure Resource, eg a Virtual Machine, a Logic App, a Storage Account, Web App, Function,... so almost anything. Next, they also "live" with the Azure Resource, which means they get deleted when the Azure Resource gets deleted. * User Assigned Managed Identity (incorrect for this question), which means that you first have to create it as a stand-alone Azure resource by itself, after which it can be linked to multiple Azure Resources. Box 2: An access policy - Set up an access policy for the system-assigned managed identity. Note: Grant access - The managed identity needs to be granted access to read the secret that we'll store in the Key Vault. 1. Navigate to your newly created Key Vault 2. Select Access Policy from the menu on the left side. 3. Select Add Access Policy 4. Etc. Reference: https://devblogs.microsoft.com/devops/demystifying-service-principals-managed-identities/ https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad
Question 245
HOTSPOT - What should you implement to meet the identity requirements? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
Requirements: Identity Requirements Contoso identifies the following requirements for managing Fabrikam access to resources: - Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests. - The solution must minimize development effort. Box 1: The Azure AD Privileged Identity Management (PIM) When should you use access reviews? Too many users in privileged roles: It's a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that have not been removed after being assigned to do an administrative task. You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management (PIM) experience. Box 2: Access reviews - Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access. Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview
Question 246
HOTSPOT - You are evaluating the components of the migration to Azure that require you to provision an Azure Storage account. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:
Box 1: No - Online migration will work fine. It does not require an Azure Storage account. Box 2: No - Data for the web site can migrated to Azure app service. Box 3: Yes - Scenario: Database metrics for the production instance of WebApp1 must be available for analysis so that database administrators can optimize the performance settings. Reference: https://azure.microsoft.com/en-au/services/sql-server-stretch-database/
Question 247
What should you include in the identity management strategy to support the planned changes?
A. Deploy domain controllers for corp.fabrikam.com to virtual networks in Azure.
B. Move all the domain controllers from corp.fabrikam.com to virtual networks in Azure.
C. Deploy a new Azure AD tenant for the authentication of new R&D projects.
D. Deploy domain controllers for the rd.fabrikam.com forest to virtual networks in Azure.
Directory synchronization between Azure Active Directory (Azure AD) and corp.fabrikam.com must not be affected by a link failure between Azure and the on- premises network. (This requires domain controllers in Azure). Users on the on-premises network must be able to authenticate to corp.fabrikam.com if an Internet link fails. (This requires domain controllers on-premises).
Question 248
HOTSPOT - You plan to migrate App1 to Azure. You need to recommend a high-availability solution for App1. The solution must meet the resiliency requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
Box 1: 3 - Need three host groups to meet the third scenario requirement below. Scenario: App1 must meet the following requirements: Be hosted in an Azure region that supports availability zones. Be hosted on Azure virtual machines that support automatic scaling. Maintain availability if two availability zones in the local Azure region fail. Box 2: 3 - The availability setting of your host group should match your scale set. * The host group and the scale set must be using the same availability zone. * The fault domain count for the host group level should match the fault domain count for your scale set. Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/dedicated-hosts
Question 249
DRAG DROP - You need to recommend a solution that meets the file storage requirements for App2. What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:
Box 1: Azure Files - Scenario: App2 has the following file storage requirements: - Save files to an Azure Storage account. - Replicate files to an on-premises location. - Ensure that on-premises clients can read the files over the LAN by using the SMB protocol. Box 2: Azure File Sync - Use Azure File Sync to centralize your organization's file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your Azure file share. You can use any protocol that's available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world. Reference: https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide
Question 250
You need to recommend a solution that meets the data requirements for App1. What should you recommend deploying to each availability zone that contains an instance of App1?
A. an Azure Cosmos DB that uses multi-region writes
B. an Azure Data Lake store that uses geo-zone-redundant storage (GZRS)
C. an Azure SQL database that uses active geo-replication
D. an Azure Storage account that uses geo-zone-redundant storage (GZRS)
Scenario: App1 has the following data requirements: - Each instance will write data to a data store in the same availability zone as the instance. - Data written by any App1 instance must be visible to all App1 instances. Azure Cosmos DB: Each partition across all the regions is replicated. Each region contains all the data partitions of an Azure Cosmos container and can serve reads as well as serve writes when multi-region writes is enabled. Incorrect Answers: B, D: GZRS protects against failures. Geo-redundant storage (with GRS or GZRS) replicates your data to another physical location in the secondary region to protect against regional outages. However, that data is available to be read only if the customer or Microsoft initiates a failover from the primary to secondary region. C: Active geo-replication is designed as a business continuity solution that lets you perform quick disaster recovery of individual databases in case of a regional disaster or a large scale outage. Once geo-replication is set up, you can initiate a geo-failover to a geo-secondary in a different Azure region. The geo-failover is initiated programmatically by the application or manually by the user. Reference: https://docs.microsoft.com/en-us/azure/cosmos-db/high-availability
