AZ900 Practice set 2 Part 2

Emma is responsible for ensuring her company's compliance with Azure cloud services. Please select an option to fill in the blank below.   

__________ can be used to track the company's compliance activities related to Azure cloud services.

• Azure Cloud Shell

• Microsoft Cloud Partner Portal

• Compliance manager

• Microsoft Trust Center

Answer explanation

Overall explanation

Option 3 is the correct answer. Compliance Manager allows you to track, assign, and verify your organization's regulatory compliance activities related to Microsoft cloud services. It is designed to help you meet complex compliance obligations such as GDPR, ISO 27001, ISO 27018, NIST 800-53, and supports your compliance efforts.

 

Option 1 is incorrect. Azure Cloud Shell is a web browser shell for managing Azure resources and is irrelevant to this question.  

Option 2 is incorrect. The Microsoft Cloud Partner Portal is a collection of common inquiries and response documents and is not relevant to this question.  

Option 4 is incorrect. The Microsoft Trust Center is a webpage that contains information and details about security, privacy, compliance, and transparency from Microsoft across all Microsoft cloud products and services and is not relevant to this question.

 

[Reference]

Use Compliance Manager to manage improvement actions | Microsoft Learn

Domain

Describe Azure management and governance

Ava and Liam are launching multiple Azure virtual machines on Azure and they want to deny access from a specific IP address to these virtual machines.

 

Please select the two best solutions from the following options:

• Change the DDoS Protection plan

• Configure Azure Firewall

• Change the Azure Traffic Manager Profile to US Government

• Change the network security group setting

• Azure Key Vault

Answer explanation

Overall explanation

Option 2 is the correct answer. By setting network security groups for Azure resources, you can set communication rules between the Internet and Azure resources and the communication rules between Azure resources.

For example, in network security groups, you can set the protocols that are permitted when communicating with Azure resources, the range of access source IP addresses, and more.

Network traffic to and from Azure resources within an Azure virtual network are filtered using Azure Network Security Groups.  Network security groups can allow or deny inbound and outbound network traffic based on IP addresses. 

Option 4 is the correct answer. Azure Firewall is a network firewall service that provides threat protection for cloud workloads running in Azure. This allows you to configure settings to perform actions like rejecting communications from specific IP addresses.

Option 1 is incorrect. DDoS Protection is a service to prevent DDoS attacks. It has nothing to do with access control to VMs.   

Option 3 is incorrect. Traffic Manager profile is primarily a DNS-based load balancer used to distribute traffic between regions and has nothing to do with controlling access to VMs.

 

[Reference] 

Network security group - how it works | Microsoft Learn

What is Azure Firewall? | Microsoft Learn

Domain

Describe Azure architecture and services

Select "Yes" if the following statement is true, otherwise select "No".    

Grace can download a regulatory compliance report from Microsoft Defender for Cloud.

• Maybe

• No

• Yes

• Sometimes

Answer explanation

Overall explanation

The correct answer is yes.

A compliance dashboard is available in Microsoft Defender for Cloud. This compliance dashboard continuously monitors your Azure environment for your specific compliance requirements and provides security assessments and recommendations as needed. The dashboard also provides actionable information on steps to reduce risk factors in your Azure environment and improve your overall compliance posture.    

The information generated by the dashboard is compiled into compliance reports that can be provided to internal and external auditors. You can easily generate and download compliance reports directly from your compliance dashboard.

 

  [Reference]

The regulatory compliance dashboard in Microsoft Defender for Cloud | Microsoft Learn

Domain

Describe Azure management and governance

Aarav's company has infrastructure in an on-premises environment, including 100 servers. He is required to configure additional servers in a flexible manner. Migration and capital costs must be minimized.

How should the infrastructure be configured?

• Conduct a complete migration to the public cloud.

• Utilize the hybrid cloud model with Azure and on-premise environment.

• Add new server to your Data Center

• Conduct a full migration to a private cloud.

Answer explanation

Overall explanation

Option 2 is the correct answer. In this scenario, you already have 100+ servers in your on-premises environment and want to configure an additional server in a flexible manner. To keep migration costs and capital costs, a hybrid cloud is the best solution.  By configuring additional servers on the cloud while utilizing the servers in the on-premises environment at the same time, it is possible to add server resources while still avoiding the investment costs that physical servers would require.

 

Option 1 is incorrect. A full migration to the public cloud entails significant migration costs.   

Option 3 is incorrect. Adding servers to a data center requires physical server investment, which can be quite costly. 

Option 4 is incorrect. The cost to set up a private cloud is high, and maintenance costs are high.

Domain

Describe cloud concepts

Avery and Lucas are working on a project. Please select an option to fill in the blank below. 

Their project consists of an Azure Web App with a Service Level Agreement (SLA) of 99.95 percent and an Azure SQL Database with an SLA of 99.99 percent.

 

The SLA for this project is ______

• The product of both SLAs, which is 99.94 percent.

• The lowest SLA for any component of the project, 99.95 percent.

• The highest SLA for any project component, 99.99 percent.

• The difference between the SLAs of the two Azure services, which is 0.05 percent,

Answer explanation

Overall explanation

Option 1 is the correct answer.

An SLA that combines services is called a composite SLA. A composite SLA is an SLA that applies to a single application composed of multiple services with different availability levels. In this scenario, the application consists of an Azure Web App and an Azure SQL Database. Since the individual SLAs are 99.95% and 99.99%, the composite SLA is calculated as follows: 

 

99.95% × 99.99% = 99.94% 

 

To calculate a composite SLA for an application like this, we need to obtain the product of the individual SLAs.

 

[Reference]

Business Metrics - Microsoft Azure Well-Architected Framework | Microsoft Learn

Service Level Agreements Summary | Microsoft Azure

Domain

Describe Azure management and governance

Select "Yes" if the following statement is true, otherwise select "No".  

 

Rohan's company can extend their internal network by adding their own physical servers to the public cloud.

• Yes

• No

• Sometimes

• May be

Answer explanation

Overall explanation

The correct answer is no.

Following Azure's shared responsibility model, physical servers are hosted and maintained by the cloud service provider (Azure in this case). Companies can extend their internal network to the public cloud, but they cannot add "physical servers" to the public cloud. Decommissioning of physical servers is also the responsibility of the cloud service provider.

 

[Reference]

Shared responsibility in the cloud - Microsoft Azure | Microsoft Learn

Domain

Describe Azure management and governance

As a cloud engineer, Charlotte manages each of her company's Azure services. She needs to find a list of planned maintenance related events across her Azure resources.

Which feature of the Azure Portal should she use?

• Azure Advisor

• Security center

• Help and support

• Cost management and billing

Answer explanation

Overall explanation

Option 3 is the correct answer. In the Help and Support section of the Azure portal, you can find more information about planned maintenance events. The Service Health page provides planned maintenance information.

 

Option 1 is incorrect. Azure Advisor is a feature that provides recommendations for cost, security, performance, operational excellence and high availability.      

Option 2 is incorrect. Security Center is a feature that provides details about policies and compliance, threat protection, and more.   

Option 4 is incorrect. Cost Management and Billing is a feature that provides details about your Azure billing and costs.

 

[Reference]

How to create an Azure support request - Azure supportability | Microsoft Learn

Domain

Describe Azure management and governance

William has created an Azure account and is preparing to deploy Azure services. Which element should he create first?

• Virtual network

• Free account

• Subscription

• Microsoft Entra

Answer explanation

Overall explanation

Option 3 is the correct answer. The first thing to create after creating an Azure account is a subscription. The user(s) will then configure resource groups etc. in the subscription. Multiple subscriptions can be set up for one account.

 

Option 1 is incorrect. A default virtual network is automatically generated when an Azure account is created, so it can be used without any user setup.

Option 2 is incorrect. When you create an Azure account, the first account you register will be a free account, so you don't need to set up a free account again.

Option 4 is incorrect. Microsoft Online business services such as Microsoft 365 and Microsoft Azure require Microsoft Entra for sign-in and identity protection. When you subscribe to Microsoft Online Business Services, you automatically get Microsoft Entra and get access to all of the free features.

Domain

Describe Azure management and governance

Select "Yes" if the following statement is true, otherwise select "No".  

 

When using SaaS for William's project, it is the responsibility for the user to implement a highly available configuration.

• No

• Yes

• Maybe

• Sometimes

Answer explanation

The correct answer is "No".

 

Software as a Service (SaaS) is a type of software solution that users purchase from a cloud service provider as a ready-made software over the Internet. For example, a SaaS type solution is one that is already completed and ready for use via the Internet, such as Office365. Therefore, high availability configuration is to be managed by the service's provider themselves, not the user.

Domain

Describe cloud concepts

Select "Yes" if the following statement is true, otherwise select "No".  

 

When using a cloud-based learning platform, it is Mira's responsibility to ensure scalability.

• No

• Always

• Maybe

• Yes

Answer explanation

Overall explanation

The correct answer is "No".

Software as a Service (SaaS) is a type of software solution that users purchase from a cloud service provider, who provides ready-made software over the Internet. A SaaS type solution is one that uses already completed software via the Internet , like Office365 . For this reason, ensuring scalability is a matter that should be managed by the service provider.

Domain

Describe cloud concepts