Revision Part 3 - Azure Management and Governance

___________________________________ can calculate cost savings due to reduced electricity consumption as a result of migrating on-premise Microsoft SQL servers to Azure.

• The Azure Migrate: Server Assessment tool

• The Azure Total Cost of Ownership (TCO) calculator

• The Database Migration Assistant

• Microsoft Trust CenterThe pricing calculator in Azure

Answer explanation

Explanation:

The Azure Total Cost of Ownership (TCO) calculator helps organizations estimate the potential cost savings of migrating their on-premises infrastructure (including Microsoft SQL Server) to Azure. It specifically takes into account factors like reduced electricity consumption, hardware costs, and maintenance costs that would be incurred when moving to the cloud. The TCO calculator provides insights into cost savings from not having to manage physical hardware and from the efficiencies gained by using cloud resources.

Why the other options are incorrect:

• A. The Azure Migrate: Server Assessment tool: The Azure Migrate tool is designed to assess the readiness of on-premises servers for migration to Azure. It evaluates factors such as performance and compatibility, but it does not specifically calculate the cost savings from reduced electricity consumption.

• C. The Database Migration Assistant: The Database Migration Assistant (DMA) is a tool for migrating databases from on-premises SQL Server to Azure SQL Database or SQL Managed Instance. It helps assess compatibility and supports migration but does not calculate cost savings related to electricity consumption or infrastructure.

• D. The pricing calculator in Azure: The Azure Pricing Calculator is a useful tool to estimate the cost of running specific Azure services based on selected configurations. However, it focuses on estimating the cost of running services in Azure rather than the cost savings of migrating from on-premises to Azure.

Your company's Active Directory forest includes thousands of user accounts. You have been informed that all network resources will be migrated to Azure. Thereafter, the on-premises data center will be retired. You are required to employ a strategy that reduces the effect on users, once the planned migration has been completed.
Solution: You plan to sync all the Active Directory user accounts to Azure Active Directory (Azure AD).
Does the solution meet the goal?

• Yes

• No

Answer explanation

Syncing your on-premises Active Directory (AD) user accounts to Azure Active Directory (Azure AD) is a valid solution for reducing the impact on users during and after the migration to Azure. This approach is commonly referred to as hybrid identity or Azure AD Connect.

Here's why this solution works:

1. User Identity Continuity: By syncing your on-premises Active Directory accounts to Azure AD, you ensure that user identities are preserved. The users can continue to use their existing usernames and passwords for accessing resources in both the on-premises and Azure environments. This reduces the impact on users because they don't need to change their login credentials or learn a new login process after migration.

2. Single Sign-On (SSO): If configured with features like Azure AD Join or SSO, users can continue accessing applications without needing to manage separate accounts or passwords for on-premises and cloud resources.

3. Seamless Transition: The sync process ensures that once the on-premises data center is retired, users can seamlessly transition to using cloud-based resources with minimal disruption.
   
   Key Components of the Solution:

   • Azure AD Connect: This tool is typically used to sync identities between on-premises Active Directory and Azure AD. It allows hybrid identity configurations, such as password hash synchronization or pass-through authentication, depending on your chosen configuration.

   • Azure AD Sync: This keeps both environments in sync, ensuring that user data, groups, and permissions are replicated to Azure AD, reducing administrative overhead and user disruption.

Your company's infrastructure includes a number of business units that each need a large number of various Azure resources for everyday operation. The resources required by each business unit are identical. You are required to sanction a strategy to create Azure resources automatically.
Solution: You recommend that management groups be included in the strategy.
Does the solution meet the goal?

• Yes

• No

Answer explanation

Explanation:

Management groups in Azure are used to organize and manage multiple Azure subscriptions. They help apply governance policies and manage access across multiple subscriptions. However, management groups are not designed to automate the creation of Azure resources, which is the specific requirement in your scenario.

The goal is to create Azure resources automatically for each business unit, and management groups do not provide a mechanism for this. Instead, to automatically deploy resources, you would typically use:

Correct Solution: Azure Resource Manager (ARM) Templates or Azure Blueprints

• ARM Templates: ARM templates allow you to define the infrastructure and resources required in a declarative JSON format. Once defined, these templates can be used to automate the deployment of resources consistently across multiple business units.

• Azure Blueprints: Azure Blueprints provide a way to define a repeatable set of Azure resources and policies. Blueprints can be used to automate the deployment of environments, including resource groups, resource policies, role assignments, and more.

Both ARM Templates and Azure Blueprints provide a way to automate resource deployment across business units and can be used to deploy identical resources to each business unit, meeting the goal of automation.

You have been informed by your superiors of the company's intentions to automate server deployment to Azure. There is, however, some concern that administrative credentials could be uncovered during this process. You are required to make sure that during the deployment, the administrative credentials are encrypted using a suitable Azure solution.
Solution: You recommend the use of Azure Multi-Factor Authentication (MFA).
Does the solution meet the goal?

• Yes

• No

Answer explanation

Azure Multi-Factor Authentication (MFA) does not address the encryption or secure handling of credentials during automated server deployment. The concern in your scenario is about ensuring that administrative credentials used during server deployment are encrypted and not exposed during the process. MFA is primarily designed for securing access to Azure services during login, but it doesn't address credential storage or encryption during automated deployments. To meet the requirement of encrypting administrative credentials during deployment, the recommended solution is Azure Key Vault. Therefore, the answer is No.

The company would like to develop a cloud solution by making use of Azure Government. Azure Government can only be used by certain types of clients to develop cloud solutions. Which of the following are the types of customers that can make use of Azure Government in this situation?

A. A government contractor from any country
B. A government entity from any country
C. A European government contractor
D. A European government entity
E. A United States government contractor
F. A United States government entity

Answer explanation

Explanation:

Azure Government is a version of Azure that is specifically designed to meet the regulatory and compliance requirements of government organizations in the United States. It is a dedicated instance of Azure built with special compliance controls, and it is only available to U.S. government entities and U.S. government contractors that work with these entities.

Azure Government eligibility:

• United States government entities (such as federal, state, local, and tribal governments in the U.S.) are eligible to use Azure Government.

• U.S. government contractors (companies that are working directly with U.S. government agencies and have appropriate clearances and compliance requirements) are also eligible to use Azure Government.

Why the other options are incorrect:

• A. A government contractor from any country: Azure Government is specifically for U.S. government contractors, not contractors from other countries.

• B. A government entity from any country: Azure Government is restricted to U.S. government entities. It is not available to foreign governments or their entities.

• C. A European government contractor: European government contractors are not eligible for Azure Government. The service is restricted to contractors working with U.S. government entities.

• D. A European government entity: European government entities are not eligible for Azure Government. Azure Government is specifically designed for U.S. government entities, not foreign government entities.

Your company has an Azure Active Directory (Azure AD) environment. Users occasionally connect to Azure AD via the Internet. You have been tasked with making sure that users who connect to Azure AD via the internet from an unidentified IP address, are automatically encouraged to change passwords.
Solution: You configure the use of Azure AD Identity Protection.
Does the solution meet the goal?

• Yes

• No

Answer explanation

Explanation:

Azure AD Identity Protection is a service that helps you manage the security of your Azure AD environment by providing risk-based conditional access policies. It includes various features, such as detecting suspicious activities and responding to security risks based on signals like location, device, and IP address.

In this specific case, you want users who connect from an unidentified IP address (i.e., one that is not recognized as safe or is considered risky) to be encouraged to change their passwords. Azure AD Identity Protection can meet this goal using risk-based policies.

How Azure AD Identity Protection can meet the goal:

1. Risky Sign-ins: Identity Protection detects risky sign-ins based on factors such as:

   • Unfamiliar or untrusted IP addresses.

   • Impossible travel or suspicious activity.

   • Sign-ins from anonymous IP addresses or known malicious IPs.

2. Password Change as a Response: You can configure a risk-based policy to trigger a password change when a sign-in is deemed risky. For example, when a user signs in from an unfamiliar IP address or one that is flagged as suspicious, Azure AD Identity Protection can enforce a policy that forces the user to change their password as a mitigation action.

3. Automated User Risk Policy: You can configure policies to automatically handle risky behaviors, such as requiring users to change their passwords or enforce other actions like multi-factor authentication (MFA).

What is the first stage in the Microsoft Cloud Adoption Framework for Azure?

• Adopt the cloud.

• Make a plan.

• Ready your organization.

• Define your strategy.

Answer explanation

Overview of the stages in the Microsoft Cloud Adoption Framework:

1. Define your strategy: The initial phase, where you determine the overall business goals and reasons for adopting the cloud. You align cloud adoption with business drivers and map out the benefits expected from cloud services.

2. Make a plan: Once the strategy is defined, this stage involves creating a detailed plan for cloud adoption, including a roadmap, migration plans, and a governance strategy.

3. Ready your organization: In this stage, the organization prepares its people, processes, and technology for cloud adoption. This includes ensuring the necessary skills, culture, and support are in place.

4. Adopt the cloud: This is the stage where actual migration and implementation happen. Resources are moved to the cloud, and the organization begins to deploy cloud solutions based on the strategy and plan.

Yes or No

1. An Azure subscription can be associated to multiple Azure Active Directory (Azure AD) tenants.
2. You can change the Azure Active Directory (Azure AD) tenant to which an Azure subscription is associated
3. When an Azure subscription expires, the associated Azure Active Directory (Azure AD) tenant is deleted automatically

• 1. Yes

  2. No

  3. Yes

• 1. No

  2. Yes

  3. No

• 1. No

  2. Yes

  3. Yes

• 1. Yes

  2. Yes

  3. No

• 1. No

  2. No

  3. No

Answer explanation

• No — An Azure subscription can only be associated with one Azure Active Directory (Azure AD) tenant at a time. While a tenant can manage multiple subscriptions, each subscription can only belong to a single Azure AD tenant.

• Yes — You can change the Azure Active Directory (Azure AD) tenant to which an Azure subscription is associated, but only under specific conditions. This process involves transferring the subscription from one Azure AD tenant to another, and it requires the proper permissions and may involve some limitations or considerations related to resources.

• No — When an Azure subscription expires, the Azure AD tenant is not automatically deleted. The subscription's expiration does not directly affect the Azure AD tenant, which can continue to exist and manage other resources or subscriptions. To delete a tenant, you would need to manually delete it, and only if there are no resources or active subscriptions remaining.

"Resource groups" provide organizations with the ability to manage the compliance of Azure resources across multiple subscriptions.
Instructions: Review the text in "quotes". If it makes the statement correct, select `No change is needed`. If the statement is incorrect, select the answer choice that makes the statement correct.

• No change is needed

• Management groups

• Azure policies

• Azure App Service plans

Answer explanation

Azure policies: While Azure Policies are used to enforce compliance and governance rules, they operate within the scope of a single subscription or resource group. They are not used directly to manage compliance across multiple subscriptions without being combined with management groups.

Your company plans to migrate to Azure. The company has several departments. All the Azure resources used by each department will be managed by a department administrator. What are two possible techniques to segment Azure for the departments?
Each correct answer presents a complete solution.

• multiple subscriptions

• multiple Azure Active Directory (Azure AD) directories

• multiple regions

• multiple resource groups

Answer explanation

Explanation:

When planning to segment Azure resources for different departments, there are several techniques you can use to isolate resources and manage them effectively. Two valid options are:

A. Multiple subscriptions

• Multiple subscriptions allow you to segment Azure resources at the highest level. Each department can have its own subscription, which makes it easier to apply specific policies, manage access, and track billing independently for each department. Subscriptions can be managed separately, and different department administrators can have full control over their respective subscriptions.

• This approach is particularly useful when departments need complete isolation for security, compliance, or billing purposes.

D. Multiple resource groups

• Resource groups are a way to organize Azure resources within a single subscription. By creating multiple resource groups, you can isolate resources by department. Each department's resources can be grouped into their own resource group, and administrators can be assigned control over specific resource groups.

• This is a more granular way to manage resources within a subscription, and it allows for role-based access control (RBAC) to be applied at the resource group level.

Why the other options are incorrect:

• B. Multiple Azure Active Directory (Azure AD) directories: Using multiple Azure AD directories would involve having separate directories for each department. While this might provide some level of isolation, it's typically unnecessary and more complex than using multiple subscriptions or resource groups. Managing multiple directories might complicate identity and access management across the organization.

• C. Multiple regions: Regions in Azure refer to the physical locations where resources are deployed. Multiple regions are used for high availability and disaster recovery, not for segmenting departments. While you can deploy resources in different regions, regions don't provide the same level of administrative segmentation or isolation as subscriptions or resource groups.