You have an Azure subscription that contains 10 virtual machines.You plan to deploy an SAP landscape on Azure that will run SAP HANA.You need to ensure that the virtual machines meet the performance requirements of HANA.What should you use?
Answer(s): D
SAP Quick SizerThe SAP Quick Sizer is a web-based tool that is provided by SAP; it is available to all customers and business partners of SAP. Sizing information is input directly into the tool. The tool sizes SAP HANA or SAP NetWeaver servers.Incorrect:Not C: Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, Reliability (formerly called High availability), and security of your Azure resources.With Advisor, you can:Get proactive, actionable, and personalized best practices recommendations.Improve the performance, security, and reliability of your resources, as you identify opportunities to reduce your overall Azure spend.Get recommendations with proposed actions inline.
https://cloud.ibm.com/docs/sap?topic=sap-sizing
HOTSPOT (Drag and Drop is not supported)You have an on-premises SAP landscape.You plan to deploy SAP HANA on Azure (Large Instances) to the landscape.You need to recommend a networking solution that meets the following requirements:Ensures low latency between HANA Large Instances and SAP applicationsSupports using SAP Solution Manager on-premisesHow should you recommend configuring the network? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: ExpressRoute FastPathConnect HANA large instancesEnsures low latency between HANA Large Instances and SAP applications.ExpressRoute FastPathIn May 2019, we released ExpressRoute FastPath. FastPath lowers the latency between HANA Large Instances and Azure virtual networks that host the SAP application VMs. With FastPath, the data flows between VMs and HANA Large Instances aren't routed through the ExpressRoute gateway.Box 2: Proximity placement groupProximity Placement GroupsProximity placement groups enable the grouping of different VM types under a single network spine, ensuring optimal low network latency between them. When the first VM is deployed in proximity placement group, that VM gets bound to a specific network spine. As all the other VMs that are going to be deployed into the same proximity placement group, those VMs get grouped under the same network spine.Box 3: Azure FirewallTransitive routing:Direct Routing to HANA Large InstancesBy default, the transitive routing doesn't work in these scenarios:Between HANA Large Instance units and an on-premises deployment.Between HANA Large Instance units deployed in different regions.There are three ways to enable transitive routing in those scenarios:A reverse-proxy to route data, to and from.Using IPTables rules in a Linux VM to enable routing between on-premises locations and HANA Large Instance units, or between HANA Large Instance units in different regions. *-> Azure Firewall would be another solution to enable direct traffic between on-premises and HANA Large instance units.
HOTSPOT (Drag and Drop is not supported)You plan to deploy an SAP Web Dispatcher named SAP2 by using an Azure Resource Manager template.You need to configure the template to support the deployment.How should you complete the template? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: concatNeed to concat the strings.Note 1: concatconcat(arg1, arg2, arg3, ...)Combines multiple string values and returns the concatenated string, or combines multiple arrays and returns the concatenated array.Note 2: Network Interface IP Configurations - ListExample of ipconfig:{"value": [{"name": "ipconfig1","id": "/subscriptions/subid/resourceGroups/testrg/providers/Microsoft.Network/networkInterfaces/nic1/ ipConfigurations/ipconfig1","etag": "W/\\\"00000000-0000-0000-0000-000000000000\\\"","properties": {"provisioningState": "Succeeded","privateIPAddress": "10.0.0.4","privateIPAllocationMethod": "Dynamic","subnet": {*--> "id": "/subscriptions/subid/resourceGroups/testrg/providers/Microsoft.Network/virtualNetworks/ vnet12/subnets/subnet12"},"primary": true,"privateIPAddressVersion": "IPv4"}}]}Box 2: copyIndexMicrosoft.Compute disks, ImageDiskReference* lunIf the disk is created from an image's data disk, this is an index that indicates which of the data disks in the image to use. For OS disks, this field is null.* etc.Notice that the name of each resource includes the copyIndex() function, which returns the current iteration in the loop. copyIndex() is zero-based. So, the following example:JSON"name": "[concat('storage', copyIndex())]",Creates these names:storage0storage1storage2To offset the index value, you can pass a value in the copyIndex() function. The number of iterations is still specified in the copy element, but the value of copyIndex is offset by the specified value. So, the following example:JSON"name": "[concat('storage', copyIndex(1))]",Creates these names:storage1storage2storage3The copy operation is helpful when working with arrays because you can iterate through each element in the array. Use the length function on the array to specify the count for iterations, and copyIndex to retrieve the current index in the array.The following example creates one storage account for each name provided in the parameter.JSON{"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#","contentVersion": "1.0.0.0","parameters": {"storageNames": {"type": "array","defaultValue": ["contoso","fabrikam","coho"]},"location": {"type": "string","defaultValue": "[resourceGroup().location]"}},"resources": [{"copy": {"name": "storagecopy","count": "[length(parameters('storageNames'))]"},"type": "Microsoft.Storage/storageAccounts","apiVersion": "2022-09-01","name": "[format('{0}{1}', parameters('storageNames')[copyIndex()], uniqueString(resourceGroup().id))]", "location": "[parameters('location')]","sku": {"name": "Standard_LRS"},"kind": "Storage","properties": {}}]}Incorrect:* lengthlength(string)Returns the number of characters in a string, elements in an array, or root-level properties in an object.
HOTSPOT (Drag and Drop is not supported)You are building an SAP on Azure production landscape that will contain an Azure virtual machine named VM1.VM1 will host the SAPRouter service.You plan to inspect all the network traffic between the SAP external network and the SAPRouter service on VM1 by using Azure Firewall.You need to ensure that the SAPRouter service on VM1 can communicate with the SAP external network by using Azure Firewall.What should you do? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Private IP address of Azure FirewallSabrouttab file:Example of SAPRouttab file# SNC connection to and from SAPKT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" 194.39.131.34 * KT "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <firewall load balancer IP 1> 3299 # SNC connection to local systems# * is optional, the rule can be further restrcited by using specific ports value & IP address of VM hosting SAPapplicationKP "p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE" <internal hosts (SAP Server) IP> * # Access from the local Network to SAP# deny all other connectionsD * * 1.65535Box 2: A DNAT RuleAzure Firewall:Azure Firewall Configuration1. Create/Review Azure Firewall2. Create/Review Public I.P Assignment3. Update NAT in on Azure FirewallGo to Firewall Manager and select the Azure Policy or select it from Overview page4. Etc.Note: Reference Network ArchitectureScenario#1 with single SAP Router to manage the connectivity between SAP(side)Router & Customer SAPRouterKey components of the ArchitectureSAP Router:SAProuter is an SAP program that acts as an intermediate station (proxy) in a network connection between SAP systems, or between SAP systems and external networks to protect your SAP network against unauthorised access.Azure Firewall:Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It's a fully stateful firewall service with built-in high availability and unrestricted cloud scalability.
You plan to deploy a highly available SAP HANA deployment on Azure that will be hosted on a Pacemaker cluster.You need to configure the security principal of the Azure fence agent for the cluster. The solution must minimize administrative effort.What should you use?
Answer(s): C
A Use an Azure fence agentYou can set up fencing by using an Azure fence agent. Azure fence agent requires managed identities for the cluster VMs or a service principal that manages restarting failed nodes via Azure APIs. Azure fence agent doesn't require the deployment of additional virtual machines.Managed Identity is suitable for scenarios where a single resource needs to access another Azure resource, while Service Principal is suitable for more complex scenarios where multiple resources need to access multiple Azure resources.Note:Using managed identityTo create a managed identity (MSI), create a system-assigned managed identity for each VM in the cluster.Should a system-assigned managed identity already exist, it will be used. User assigned managed identities shouldn't be used with Pacemaker at this time. Azure fence agent, based on managed identity is supported for SLES 12 SP5 and SLES 15 SP1 and above.Using service principalTo create a service principal, do the following:1. In the Azure portal, select Azure Active Directory > Properties, and then write down the Directory ID. This is the tenant ID.2. Select App registrations.3. Select New registration.4. Enter a name for the registration, and then select Accounts in this organization directory only.5. For Application type, select Web, enter a sign-on URL (for example, http://localhost), and then select Add.6. The sign-on URL isn't used and can be any valid URL.7. Select Certificates and secrets, and then select New client secret.8. Enter a description for a new key, select Never expires, and then select Add.9. Write down the value, which you'll use as the password for the service principal.10. Select Overview, and then write down the application ID, which you'll use as the username of the service principal.Note:[1] Create a custom role for the fence agentBy default, neither managed identity nor service principal has permissions to access your Azure resources. You need to give the managed identity or service principal permissions to start and stop (deallocate) all virtual machines in the cluster.[A] Assign the custom roleUsing Managed IdentityAssign the custom role "Linux Fence Agent Role" that was created in the last chapter to each managed identity of the cluster VMs. Each VM system-assigned managed identity needs the role assigned for every cluster VM's resource.Using Service PrincipalAssign the custom role Linux fence agent Role that you already created to the service principal.
https://learn.microsoft.com/en-us/azure/sap/workloads/high-availability-guide-suse-pacemaker
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.