You have an SAP production landscape in Azure and an Azure Firewall instance named FW1.You are migrating the landscape to an SAP RISE managed workload.You need to configure FW1 to allow traffic between the landscape and the managed workload. The solution must minimize the number of open ports on FW1.Which protocols should you allow?
Answer(s): C
Network communication ports with SAP RISEAny Azure service with access to the customer virtual network can communicate with the SAP landscape running within the SAP RISE/ECS subscription via the available ports.Your SAP system in SAP RISE can be accessed through the open network ports, as configured and opened by SAP for your use. https, RFC and JDBC/ODBC protocols can be used through private network address ranges.
You have an Azure subscription that contains a virtual machine named VM1.You plan to use VM1 as part of an SAP HANA deployment.You need to ensure that VM1 can run HANA.What should you use?
Answer(s): A
Not A: The SAP HANA hardware and cloud measurement tool allows customers and partners to collect information on the infrastructure intended for SAP HANA deployment. The tool measures whether the planned hardware or cloud system complies with the requirements defined by SAP. Furthermore, it gauges whether the system planned for SAP HANA deployment can achieve satisfactory base performance by meeting the minimum requirements defined as well as satisfactory overall performance given the intended SAP HANA usage. The measurement results are saved into a single file, which can be uploaded to the SAP HANA hardware and cloud measurement analysis for further analysis and reporting.Incorrect:Not C: The SAP HANA cockpit provides aggregate, system and database administration features, for example, database monitoring, user management, and data backup. Administrators can use the SAP HANA cockpit to start and stop services, to monitor the system, to configure system settings, and to manage users and authorizations.Not D: SAP's Migration Cockpit is a user-friendly tool designed to simplify the data migration process. It allows businesses to migrate their data from various sources into SAP S/4HANA or other SAP systems.9
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription named Sub1 that contains multiple virtual machines.You have an SAP RISE managed workload.For Sub1, you are designing a hub-and-spoke architecture that will provide the following:Connectivity from the virtual machines to the managed workload Connectivity from the virtual machines to the SAP Business Technology Platform (BTP)You need to recommend a connectivity solution that minimizes network latency and maximizes throughput.What should you include in the recommendation? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Virtual network peeingFor SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Primary benefits are:Minimized network latency and maximum throughput between SAP RISE landscape and own applications and services running in Azure.No extra complexity and cost with a dedicated on-premises communication path for SAP RISE workload.Instead using on-premises communication path of the existing Azure network hub(s). Connectivity from the virtual machines to the RISE managed workloadIncorrect:* The VNet-to-Vnet Connection typeVPN vnet-to-vnetAs an alternative to virtual network peering, virtual private network (VPN) connection can be established between VPN gateways, deployed both in the SAP RISE/ECS subscription and customers own. You can establish a vnet-to-vnet connection between these two VPN gateways, enabling fast communication between the two separate virtual networks. The respective networks and gateways can reside in different Azure regions.* SAP Private Link service for AzureBox 2: SAP Private Link service for AzureConnectivity from the virtual machines to the SAP Business Technology Platform (BTP)"SAP Private Link and Azure Private Link" in the Context of SAP Enterprise Cloud Services SAP Private Link service on BTP has been available for quite some time.SAP Private Link service sets up a private HTTPS connectivity between SAP BTP and Azure to enable some SAP BTP extensions or applications to consume certain Azure native Services via a "Private Azure Backbone Network connectivity", here the data transfer between SAP BTP and Azure is through Private Network Connections.Incorrect:* SAP Cloud Connector* SAPRouter
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains an Azure NetApp Files account named account1 and an SAP HANA deployment.In account1, you create a capacity pool named pool1 that has the following configurations:Quality of Service (QoS) type: AutoService level: PremiumSize: 4 TBIn account1, you create a volume named volume1 that has the following configurations:Network features: StandardProtocol: Dual-protocolQuota: 500 GBYou need configure pool1 and volume1 to support an application volume group for the HANA deployment.What should you modify? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: QoS typeFor pool1: Change the QoS type to Manual.Note:SAP on Azure NetApp Files Sizing Best PracticesANF storage hierarchy and capacity poolsThere are two QoS settings available: auto QoS and manual QoS.Manual QoS capacity pools have become the de-facto standard for SAP deployments, and the remainder of this article focuses on that QoS type. In addition, some advanced features of ANF, e.g. application volume group (AVG) for SAP HANA (Understand Azure NetApp Files application volume group for SAP HANA), require the usage of manual QoS pools.Box 2: ProtocolFor volume1:Protocol: Configured as Dual protocolChanged it to NFS.Incorrect:* Network features: Configured as StandardApplication volume group for SAP HANA extension 1 enables you to select Standard network features and availability zone volume placement without using volume pinningApplication volume group for SAP HANA extension one offers support for:- Availability zone volume placement- Standard network featuresApplication volume group for SAP HANA now supports selecting Standard network features for all volumes in the volume group.* Quota: Configured as 500 GBThis is fine.
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains an SAP on Azure landscape.You need to configure SAP HANA Studio to use Microsoft Entra ID for user authentication. The solution must ensure that users complete multifactor authentication (MFA) and are on a compliant device before they are granted access to HANA Studio.From the Microsoft Entra admin center, which type of policy should you create, and which type of resource should you configure? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Conditional AccessPolicyTo configure SAP HANA Studio to use Microsoft Entra ID for user authentication with MFA, you'll need to first integrate SAP HANA with Microsoft Entra ID, then configure MFA policies for the users who will access SAP HANA Studio. This involves adding SAP HANA as a SaaS app in the Microsoft Entra admin center, assigning users to the app, and then setting up Conditional Access policies to enforce MFA.Box 2: Enterprise applicationsResourceSteps for Configuration:1. Add SAP HANA to Microsoft Entra ID:Sign in to the Microsoft Entra admin center as a Cloud Application Administrator. Navigate to Entra ID > Enterprise applications > New application. In the "Add from the gallery" section, search for "SAP HANA" and add the app.2. Assign Users and Configure Provisioning:3. Enable MFA for SAP HANA Users:In the Microsoft Entra admin center, navigate to Entra ID > Conditional Access > New policy.Create a new Conditional Access policy. [Box 1]Assign the policy to the users who access SAP HANA Studio, including the SAP HANA application. Under "Access controls," select "Grant" and choose "Require multifactor authentication".Enable the policy and test it with a test user.
https://learn.microsoft.com/en-us/entra/identity/saas-apps/saphana-tutorial
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.