DRAG DROP (Drag and Drop is not supported)You have an on-premises network and an Azure subscription.You plan to deploy a standard three-tier SAP architecture to a new Azure virtual network.You need to configure network isolation for the virtual network. The solution must meet the following requirements:Allow client access from the on-premises network to the presentation servers.Only allow the application servers to communicate with the database servers.Only allow the presentation servers to access the application servers.Block all other inbound traffic.What is the minimum number of network security groups (NSGs) and subnets required? To answer, drag the appropriate number to the correct targets. Each number may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: 3NSGs:Allow client access from the on-premises network to the presentation servers. Only allow the application servers to communicate with the database servers. Only allow the presentation servers to access the application servers.Block all other inbound traffic.One NSG for the presentation servers.One NSG for the database servers.One NSG for the application servers.Note: You can use an Azure network security group to filter network traffic between Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.Box 2: 1Subnets:Application servers - 1 subnetDatabase servers - same subnet as the application servers (to minimize the number of subnets) Presentation servers - same subnet as the application servers (to minimize the number of subnets)Note:SAP application and database VMs run in the same virtual network, within the same or different subnets of a single virtual network. Use different subnets for application and database VMs. Alternatively, use dedicated application and DBMS ASGs to group rules that are applicable to each workload type within the same subnet.
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview https://learn.microsoft.com/en-us/azure/sap/workloads/planning-guide
You have an SAP landscape on Azure that contains the virtual machines shown in the following table.You need to ensure that the Application Server role is available if a single Azure datacenter fails.What should you include in the solution?
Answer(s): C
For this question these are the correct answers:* Azure Application Gateway v2Application Gateway is available under a Standard_v2 SKU. Web Application Firewall (WAF) is available under a WAF_v2 SKU. The v2 SKU offers performance enhancements and adds support for critical new features like autoscaling, zone redundancy, and support for static VIPs.Zone redundancy: An Application Gateway or WAF deployment can span multiple Availability Zones, removing the need to provision separate Application Gateway instances in each zone with a Traffic Manager. You can choose a single zone or multiple zones where Application Gateway instances are deployed, which makes it more resilient to zone failure. The backend pool for applications can be similarly distributed across availability zones.Zone redundancy is available only where Azure Zones are available.* Azure Load Balancer StandardFor the load balancers of the failover clusters of SAP Central Services and the DBMS layer, you need to use the Standard SKU Azure Load Balancer. The Basic Load Balancer won't work across zones.For this question these are the incorrect answers:* a local network gateway* Azure Active Directory (Azure AD) Application Proxy* Azure AD Application ProxyApplication Proxy is recommended for giving remote users access to internal resources. Application Proxy replaces the need for a VPN or reverse proxy for these remote access use cases.* Azure Application Gateway v1* Azure Basic Load BalancerThe Basic Load Balancer won't work across zones.* Azure Private Link* Azure Virtual WANAzure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface.Note:The DBMS also is a single point of contact in an SAP system. You need to protect it by using a high-availabilitysolution. The following figure shows a SQL Server AlwaysOn high-availability solution in Azure, with Windows Server Failover Clustering and the Azure internal load balancer.
https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/sap-high-availability-architecture- scenarios
DRAG DROP (Drag and Drop is not supported)You have an SAP ERP Central Component (SAP ECC) deployment on Azure virtual machines. The virtual machines run Windows Server 2022 and are members of an Active Directory domain named contoso.com.You install SAP GUI on an Azure virtual machine named VM1 that runs Windows 10.You need to ensure that contoso.com users can sign in to SAP ECC via SAP GUI on VM1 by using their domain credentials.What should you do? To answer, drag the appropriate components to the correct tasks. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.NOTE: Each correct selection is worth one point.Select and Place:
Box 1: VM1Modify the instance profile:Digital Client Signature (SSF)The Secure Login Client can use X.509 certificates for digital signatures in an SAP environment. The supported interface is Secure Store and Forward (SSF). This option is part of the default installation. The prerequisite for using SSF is that SSF is configured in the SAP instance profile.Box 2: ABAP Central Services (ASCS)Run the SNC Kerberos Configuration for SAP GUI on:SNC Kerberos ConfigurationConfiguring SNC for Kerberos includes the creation of an X.509 PSE and of setting the relevant profile parameters.ContextYou want to protect, for example, internal and external server-to-server communication with SNC. This topic describes how you create the relevant PSE and how you configure the SNC parameters for Kerberos in an AS ABAP.Procedure1. Log on to the Application Server ABAP using SAP GUI or SAP GUI for HTML.2. Start transaction STRUST (trust manager)3. (For SAP NetWeaver 7.4 SP05 or higher) Choose the Change button.4.Select the SNC SAPCryptolib PSE.5.Choose Create.6.Set the relevant parameters and choose Continue (Enter).7.Save your changes.8.Use the SAP Single Sign-On wizard for SNC and SPNego (transaction SNCWIZARD) to set the SNC parameters.Box 3: SAP Web DispatcherConfigure SAP Logon on:Define entry in SAP LogonFirst step is to create an endpoint for the VM that covers the SAP dispatcher port of the SAP instance running within the VM. Means it needs to be a TCP/IP endpoint. The external and internal port number should be the port number of the dispatcher of the instance which usually is 3200 + <Instance Number>.
https://learn.microsoft.com/en-us/power-platform/solution-templates/finance/sap-procurement/administer/ configure-authenticationhttps://techcommunity.microsoft.com/t5/running-sap-applications-on-the/sap-gui-connection-closed-when- connecting-to-sap-system-in-azure/ba-p/367778
You are deploying an SAP production landscape on Azure.You deploy virtual machines that have SAP Digital Boardroom and SAP HANA installed.You need to measure network latency between the virtual machines.What should you use?
Connection monitor can be used to monitor network connectivity between an Azure virtual machine and an IP address. The IP address can be assigned to another Azure resource or a resource on the Internet or on- premises.Incorrect:Not A: Network performance monitoring (NPM) is the process of measuring and monitoring the quality ofservice of a network. NPM helps network administrators gather network data, measure performance variables and identify potential issues or risks.Not B: Tools such as FIO, vdbench, and iometer have their places in determining virtual machines to storage limits, matching the parameters of the test to the actual application workload mixtures for most useful results.D: You can test network latency between Azure virtual machines (VMs) by using the publicly available tools Latte for Windows or SockPerf for Linux.
https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview
You have 100 Azure virtual machines that host SAP workloads and have the SAP Host Agent and the SAP Adaptive Extensions installed.You plan to deallocate the virtual machines during non-business hours.You need to change the managed disk type of the virtual machines when they are deallocated. The solution must minimize administrative effort.What should you use?
Answer(s): D
Azure Automation delivers a cloud-based automation, operating system updates, and configuration service that supports consistent management across your Azure and non-Azure environments. It includes process automation, configuration management, update management, shared capabilities, and heterogeneous features.Heterogeneous support (Windows and Linux)Automation is designed to work across Windows and Linux physical servers and virtual machines outside of Azure, on your corporate network, or other cloud provider. It delivers a consistent way to automate and configure deployed workloads and the operating systems that run them.Incorrect:Not A: SAP Information Lifecycle Management (SAP ILM) is a component that enhances the SAP standard delivery to manage the lifecycle of live data and archived data based on rules. SAP ILM uses ILM-specific, enhanced data archiving functions.Not B: SAP Landscape Management (or "LaMa") is an orchestration and automation solution that simplifies, automates and centralizes the management of your SAP systems running in different infrastructures (on premise, private/public cloud or hybrid).
https://learn.microsoft.com/en-us/azure/automation/overview
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.