Free Microsoft Azure Architect Design Questions and Answers — Questions and Answers
Question 1: Your business offers customer support for various Azure subscriptions as well as outside hosting companies. You are creating a system for central monitoring. The following needs to be addressed by the solution: <br> ‥ Collect log and diagnostic data from all the third-party hosting providers into a centralized repository. <br> ‥ Collect log and diagnostic data from all the subscriptions into a centralized repository. <br> ‥ Automatically analyze log data and detect threats. <br> ‥ Provide automatic responses to known events. <br> What Azure service ought to be incorporated into the solution?
- Azure Application Insights
- Azure Sentinel
- Azure Log Analytics
- Azure Monitor (Correct answer)
Correct answer: Azure Monitor
Azure Monitor is a comprehensive monitoring solution that collects telemetry from Azure resources, on-premises environments, and even other cloud providers. It can ingest logs and metrics, provide insights, and integrate with other services like Azure Sentinel for threat detection and Azure Logic Apps for automated responses. This makes it the foundational service for a centralized monitoring system with the specified requirements, including collecting data, detecting threats, and providing automatic responses.
Question 2: You are creating an Azure resource deployment using templates from Azure Resource Manager. Secrets will be kept in Azure Key Vault during deployment. <br> You must suggest a solution that satisfies the following criteria: <br> ‥ Prevent the IT personnel handling the deployment from immediately obtaining the secrets from Key Vault. <br> ‥ Apply the least privilege principle. <br> Which two steps would you suggest? Each right response offers a piece of the answer.
- From Access policies in Key Vault, enable access to the Azure Resource Manager for template deployment. Most Voted (Correct answer)
- Assign the IT staff a custom role that includes the Microsoft.KeyVault/Vaults/Deploy/Action permission. Most Voted (Correct answer)
- Assign the Key Vault Contributor role to the IT staff.
- Create a Key Vault access policy that allows all list key permissions, list secret permissions, and list certificate permissions.
Correct answer: From Access policies in Key Vault, enable access to the Azure Resource Manager for template deployment. Most Voted
Enabling 'Azure Resource Manager for template deployment' in Key Vault access policies allows Azure Resource Manager to retrieve secrets from the Key Vault during the deployment process. This is crucial because it enables the ARM template to access the secrets needed for resource configuration without directly exposing those secrets to the IT personnel initiating the deployment, thus preventing them from immediately obtaining the secrets. This mechanism adheres to the principle of least privilege by granting access only to the deployment service, not the individual.
Question 3: You have three Azure regions' worth of web apps in your Azure subscription. <br> The following requirements must be fulfilled by the implementation of Azure Key Vault: <br> ‥ All keys must be readable in the case of a local outage. <br> ‥ Key Vault access is required for any subscription-based web apps. <br> ‥ The least amount of Key Vault resources need to be deployed and managed. <br> How many Key Vault instances should you set up?
- 6
- 3
- 2
- 1 (Correct answer)
Correct answer: 1
Azure Key Vault is a global service, meaning its data is replicated across multiple Azure regions within a geographical area. This inherent redundancy ensures high availability and resilience, so even if one region experiences an outage, the Key Vault remains accessible. Therefore, a single Key Vault instance is sufficient to meet the requirements of web apps across three regions, ensuring keys are readable during a local outage and minimizing administrative overhead.
Question 4: Your Azure Active Directory (Azure AD) tenancy already exists. <br> Using Azure Storage, you want to give users access to shared files. Depending on their user account or group membership, the users will receive varying degrees of access to various Azure file shares. <br> Which additional Azure services should be leveraged to support the proposed rollout must be suggested. <br> What should the recommendation contain?
- Azure Information Protection
- an Azure AD Domain Services (Azure AD DS) instance (Correct answer)
- an Azure Front Door instance
- an Azure AD enterprise application
Correct answer: an Azure AD Domain Services (Azure AD DS) instance
To provide file share access to Azure Storage based on Azure AD user and group identities, and leverage traditional Windows ACLs for varying access levels, Azure AD Domain Services (Azure AD DS) is required. Azure AD DS provides managed domain services, including domain join, group policy, and LDAP, enabling Azure file shares to be joined to a domain and support identity-based authentication for SMB access using Azure AD credentials.
Question 5: You want to set up five Azure virtual machines for the App1 application, which will be deployed. To run App1, more virtual machines will be introduced later. <br> You must suggest a method to satisfy each of the conditions for the virtual machines that will run App1: <br> ‥ Check that the virtual machines can access an Azure key vault, instances of Azure Logic Apps, and an Azure SQL database by authenticating to Azure Active Directory (Azure AD). <br> ‥ When you deploy more virtual machines, avoid giving them new roles and permissions for Azure services. <br> ‥ Prevent keeping certificates and secrets on the virtual machines. <br> ‥ Reduce the administrative work required to manage identities. <br> Which identification type ought to be mentioned in the recommendation?
- a user-assigned managed identity (Correct answer)
- a system-assigned managed identity
- a service principal that is configured to use a certificate
- a service principal that is configured to use a client secret
Correct answer: a user-assigned managed identity
A user-assigned managed identity is the ideal solution here because it is a standalone Azure resource that can be assigned to multiple Azure VMs. This allows you to grant permissions to the identity once, and any VM assigned that identity will inherit those permissions, eliminating the need to configure new roles or store secrets on each VM. This approach significantly reduces administrative overhead and adheres to security best practices for identity management across multiple instances.
Question 6: You are creating an architecture for a set of microservices that will run on an Azure Kubernetes Service (AKS) cluster, be consumed by apps running on Azure virtual machines, and share a virtual network with the AKS cluster. <br> You must create a solution that complies with the following criteria in order to expose the microservices to the consumer apps: <br> ‥ Mutual TLS authentication must be used to safeguard ingress access to the microservices, which must be limited to a single private IP address. <br> ‥ Incoming microservice calls must be rate-limited in terms of quantity. <br> ‥ Costs must be kept to a minimum. <br> <br> What should the solution contain?
- Azure Front Door with Azure Web Application Firewall (WAF)
- Azure App Gateway with Azure Web Application Firewall (WAF)
- Azure API Management Premium tier with virtual network connection (Correct answer)
- Azure API Management Standard tier with a service endpoint
Correct answer: Azure API Management Premium tier with virtual network connection
Azure API Management (APIM) Premium tier supports virtual network integration, allowing it to expose microservices privately within the shared VNet. It also offers advanced features like mutual TLS authentication for secure ingress and robust rate-limiting capabilities. While the Premium tier has a higher cost, it is the only option that fully satisfies all the complex security and networking requirements for this scenario, especially the private IP and mutual TLS, making it the correct solution.
Question 7: You have a tenant called contoso.com in Azure Active Directory (Azure AD). Group1 is one of the tenants' groups. All of the administrative user accounts are in Group1. <br> You find many attempts to enter into the Azure portal coming from nations where administrative users are NOT employed. <br> You must make sure that Azure Multi-Factor Authentication (MFA) is required for all attempts to enter into the Azure portal from certain nations. <br> Solution: Construct a Group1 Access Review. <br> <br> Is the goal achieved by this solution?
- Yes
- No (Correct answer)
- Maybe
Correct answer: No
An Azure AD Access Review is used to manage group membership and ensure only authorized users have access to resources, not to enforce Multi-Factor Authentication (MFA) based on location. To require MFA for sign-ins from specific nations, you would need to implement Azure AD Conditional Access policies. Conditional Access allows you to define conditions (like user location) and grant controls (like requiring MFA) for access to cloud apps.
Free Microsoft Azure Architect Design Questions and Answers
Your business offers customer support for various Azure subscriptions as well as outside hosting companies.
You are creating a system for central monitoring.
The following needs to be addressed by the solution:
‥ Collect log and diagnostic data from all the third-party hosting providers into a centralized repository.
‥ Collect log and diagnostic data from all the subscriptions into a centralized repository.
‥ Automatically analyze log data and detect threats.
‥ Provide automatic responses to known events.
What Azure service ought to be incorporated into the solution?