DRAG DROP (Drag and Drop is not supported)Your on-premises network contains an Active Directory Domain Services (AD DS) domain that syncs with a Microsoft Entra tenant by using Microsoft Entra Connect.You plan to deploy an on-premises instance of SAP NetWeaver that will integrate with SAP Cloud Identity Services.You need to configure an authentication solution for the deployment. The solution must meet the following requirements:Ensure that users can authenticate to NetWeaver and SAP Cloud Identity Services by using their AD DS domain credentials.Enforce multi-factor authentication (MFA).Minimize administrative efforts.What should you include in the solution? To answer, drag the appropriate components to the correct platforms. Each component may be used once, more than once, or not at all. You may need to drag the split bar betweenpanes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: An Enterprise Application (EA) in Microsoft Entra IDFor SAP Cloud Identity ServicesUsing Microsoft Entra ID to secure access to SAP platforms and applications In Microsoft Entra ID, you can assign Microsoft Entra users and groups to the Enterprise Application representing your SAP IAS (Cloud Identity Services) instance in Microsoft Entra ID.Box 2: KerberosFor NetWeaverExample: A hybrid identity setup that requires managing the user lifecycle across Microsoft Active Directory, Microsoft Entra, SAP BTP, SAP CIS, and an SAP system on-premiseFor SSO, the Kerberos principal for the Windows user must be mapped to the SAP user in the backend.Note: Configuring the Entra ID tenant to provision users into the SAP CIS tenant requires to add "SAP Cloud Identity Services" from the Microsoft Entra application gallery to the Entra ID tenant's list of enterprise applications. This enterprise application is scoped to provision only users from the "SAP User" group, and has access to the credentials (username and password) of a system administrator with the name "Entra tenant bestruncorp" created in the SAP CIS tenant. This system administrator account has the required authorization in the SAP CIS tenant to execute the provisioning operations in the scenario. For applications listed in the gallery like "SAP Cloud Identity Services", provisioning follows the SCIM standard to ensure cross-domain interoperability. The *enterprise application* centrally controls all required identity attribute mapping and transformation logic in the scenario, such as the SAP login name derived from the Windows user name, and construction of the SNC mapping following the format "p:<Windows user name>@<Kerberos realm name>". For transferring both values to CIS, the custom attributes defined in SAP's SCIM user schema extension "urn:sap:cloud:scim:schemas:extension:custom:2.0:User" are used.
You have an Azure subscription.You plan to deploy SAP on Azure.You need to recommend a disk encryption solution for virtual machines. The solution must meet the following requirements:Support the encryption of operating system, data, and temp disks.Support the encryption of data at rest and data in transit.Minimize CPU overhead on the virtual machines.What should you include in the recommendation?
Answer(s): D
Encryption at host - End-to-end encryption for your VM dataWhen you enable encryption at host, that encryption starts on the VM host itself, the Azure server that your VM is allocated to. The data for your temporary disk and OS/data disk caches are stored on that VM host. After enabling encryption at host, all this data is encrypted at rest and flows encrypted to the Storage service, where it's persisted. Essentially, encryption at host encrypts your data from end-to-end. Encryption at host doesn't use your VM's CPU and doesn't impact your VM's performance.Incorrect:Not B:Server-side encryption of Azure Disk StorageMost Azure managed disks are encrypted with Azure Storage encryption, which uses server-side encryption (SSE) to protect your data and to help you meet your organizational security and compliance commitments.Azure Storage encryption automatically encrypts your data stored on Azure managed disks (OS and data disks) at rest by default when persisting it to the cloud. Disks with encryption at host enabled, however, aren't encrypted through Azure Storage. For disks with encryption at host enabled, the server hosting your VM provides the encryption for your data, and that encrypted data flows into Azure Storage.
You have an on-premises network and an Azure subscription.You plan to migrate on-premises SAP workloads to Azure virtual machines. You will use an NFS account in Azure NetApp Files as the storage platform.You need to ensure that data transferred between the NFS account on the virtual machines and the Azure NetApp Files shares is encrypted.What should you create first?
Answer(s): C
Use an Azure key vault to store the customer-managed encryption keys needed for the encryption of files during the transfer.Note: Security FAQs for Azure NetApp FilesCan the network traffic between the Azure VM and the storage be encrypted? Azure NetApp Files data traffic is inherently secure by design, as it doesn't provide a public endpoint, and data traffic stays within customer-owned VNet. Data-in-flight isn't encrypted by default. However, data traffic from an Azure VM (running an NFS or SMB client) to Azure NetApp Files is as secure as any other Azure-VM-to-VM traffic.NFSv3 protocol doesn't provide support for encryption, so this data-in-flight can't be encrypted. However, NFSv4.1 and SMB3 data-in-flight encryption can optionally be enabled. Data traffic between NFSv4.1 clients and Azure NetApp Files volumes can be encrypted using Kerberos with AES-256 encryption.How are encryption keys managed?By default key management for Azure NetApp Files is handled by the service, using platform-managed keys. A unique XTS-AES-256 data encryption key is generated for each volume. An encryption key hierarchy is used to encrypt and protect all volume keys. These encryption keys are never displayed or reported in an unencryptedformat. When you delete a volume, Azure NetApp Files immediately deletes the volume's encryption keys.*-> Alternatively, customer-managed keys for Azure NetApp Files volume encryption can be used where keys are stored in Azure Key Vault. With customer-managed keys, you can fully manage the relationship between a key's life cycle, key usage permissions, and auditing operations on keys. The feature is generally available (GA) in supported regions. Azure NetApp Files volume encryption with customer-managed keys with the managed Hardware Security Module is an extension to this feature, allowing you to store your encryption keys in a more secure FIPS 140-2 Level 3 HSM instead of the FIPS 140-2 Level 1 or Level 2 service used by Azure Key Vault.
You have an SAP production landscape in Azure.You plan to migrate the landscape to an SAP RISE managed workload.Which task will be the sole responsibility of the SAP vendor after the migration?
Integrating Azure with SAP RISE managed workloadsSAP Landscape management is the responsibility of the SAP vendor.Note: It's important to distinguish the responsibility between SAP and customer when enabling certain Azure scenarios. The following diagram illustrates most common situations.Incorrect:Not A: Customer handles SIEM/Sentintel.Not B: Setup of SSO is the sole responsibility of the customer.Not D: Set up networking peering is Shared.
DRAG DROP (Drag and Drop is not supported)You have an SAP HANA subscription that is single sign-on (SSO)-enabled.You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com.You perform the following actions:Deploy HANA to Azure virtual machines.Configure contoso.com to support SSO for HANA.You need to configure HANA to support SSO authentication to contoso.com.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Sign in to the HANA XSA Web Console.Microsoft Entra single sign-on (SSO) integration with SAP HANAConfigure SAP HANA SSO1. To configure single sign-on on the SAP HANA side, sign in to your HANA XSA Web Console by going to the respective HTTPS endpoint. [Step 1]Step 2: Add an Identity Provider2. In the XSA Web Interface, go to SAML Identity Provider. From there, select the + button on the bottom of the screen to display the Add Identity Provider Info pane. Then take the following steps: [Step 2]Step 3: Paste the FederationMetada.xml file.2a. In the Add Identity Provider Info pane, paste the contents of the Metadata XML (which you downloaded) into the Metadata box.2b. If the contents of the XML document are valid, the parsing process extracts the information that's required for the Subject, Entity ID, and Issuer fields in the General data screen area. It also extracts the information that's necessary for the URL fields in the Destination screen area, for example, the Base URL and SingleSignOn URL (*) fields.2. In the Name box of the General Data screen area, enter a name for the new SAML SSO identity provider.3. Select Save to save the details of the SAML identity provider and to add the new SAML IDP to the list of known SAML IDPs.
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.