You are planning an SAP on Azure deployment.You need to recommend a storage access solution that meets the following requirements:Provides a common file share that will be accessed by virtual machines that run either Red Hat Enterprise Linux (RHEL) or Windows Server 2022.Ensures that each virtual machine uses its native sharing protocol to access the common file share.Which type of storage should you include in the recommendation?
Answer(s): A
Network File System (NFS)NFS is primarily used with Linux/UNIX based clients such as Red Hat, SUSE, Ubuntu, AIX, Solaris, and Apple OS. Azure NetApp Files supports any NFS client that operates in the RFC standards. Windows can also use NFS for access, but it doesn't operate using Request for Comments (RFC) standards.NFSv4.xNFSv4.x refers to all NFS versions or minor versions that are under NFSv4, including NFSv4.0, NFSv4.1, and NFSv4.2. Azure NetApp Files currently supports NFSv4.1 only.
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription. The subscription contains two virtual machines named SQL1 and SQL2 that host a Microsoft SQL Server 2019 Always On availability group named AOG1.You plan to deploy an SAP NetWeaver system that will have a database tier hosted on AOG1.You need to encrypt the Azure virtual machine disks and the SQL Server database. The solution must meet the following requirements:The operating system disk, data disk, and the temporary disk of the virtual machines must be encrypted.SQL Server encryption keys must be stored on-premises.Which type of encryption should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct select ion is worth one point.Hot Area:
Box 1: Encryption at hostThe operating system disk, data disk, and the temporary disk of the virtual machines must be encrypted.Encryption at hostEncryption at host is a Virtual Machine option that enhances Azure Disk Storage Server-Side Encryption to ensure that all temp disks and disk caches are encrypted at rest and flow encrypted to the Storage clusters.When you enable encryption at host, data stored on the VM host is encrypted at rest and flows encrypted to the Storage service.Temporary disks and ephemeral OS disks are encrypted at rest with either customer-managed or platform- managed keys, depending on what you select as the disk encryption type for the OS disk. The OS and data disk caches are encrypted at rest with either customer-managed or platform-managed keys, depending on what you select as the disk encryption type.Incorrect:* Azure Disk EncryptionAzure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. ADE encrypts the OS and data disks of Azure virtual machines (VMs) inside your VMs.* Encryption at restEncryption at rest provides data protection for stored data (at rest). Attacks against data at-rest include attempts to obtain physical access to the hardware on which the data is stored, and then compromise the contained data. In such an attack, a server's hard drive may have been mishandled during maintenance allowing an attacker to remove the hard drive. Later the attacker would put the hard drive into a computer under their control to attempt to access the data.Box 2: Transparent Data Encryption (TDE)SQL Server encryption keys must be stored on-premises.You can enable TDE for SQL Server Always On Availability Groups.To configure Always Encrypted in your database, follow these steps:Note: Provision cryptographic keys to protect your data. Always Encrypted uses two types of keys:Column encryption keys.Column master keys.A column encryption key is used to encrypt the data within an encrypted column. A column master key is a key- protecting key that encrypts one or more column encryption keys.You need to store column master keys in a trusted key store outside of the database system, such as Azure Key Vault, Windows certificate store, or a hardware security module. After this, you should provision column encryption keys and encrypt each with a column master key.Incorrect:* Always Encrypted* Always Encrypted with secure enclaves
HOTSPOT (Drag and Drop is not supported)You plan to deploy an SAP workload to an Azure virtual machine that has the following types of storage:An SAPMNT file share hosted in Azure premium filesApplication files stored on Azure Premium managed disksDuring testing, you use the E20ds v4 virtual machine SKU.You discover that the bandwidth of the connection to the SAPMNT share is too low, and the disk space available for the paging file is insufficient.You need to increase the available bandwidth and disk space. The solution must minimize costs.What should you do? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Attach an extra network adapter to the virtual machine For SAPMNT: An SAPMNT file share hosted in Azure premium filesA VM can only have as many network interfaces attached to it as the VM size supports. To learn more about how many network interfaces each VM size supports, see Sizes for virtual machines in Azure. All sizes support at least two network interfaces.Incorrect:* Scale up the virtual machine to a SKU in the same familyMemory Optimized Azure Dedicated Host SKUsAzure Dedicated Host SKUs are the combination of a VM family and a certain hardware specification. You can only deploy VMs of the VM series that the Dedicated Host SKU specifies. For example, on the Dsv3-Type3, you can only provision Dsv3-series VMs.* Use a virtual machine SKU that supports Write AcceleratorBox 2: Increase the size of the managed disks.For the paging file: Application files stored on Azure Premium managed disks
You have an SAP workload on an Azure virtual machine.You have a built-in role-based access control (RBAC) role definition in the JSON format.You plan to change the built-in role definition to a custom role definition.Which property value in the built-in role definition must you change?
Answer(s): D
Azure custom rolesIf the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.Steps to create a custom roleHere are the basic steps to create a custom role.*-> 1. Determine the permissions you need.When you create a custom role, you need to know the actions that are available to define your permissions.Typically, you start with an existing built-in role and then modify it for your needs. You will add the actions to the Actions or NotActions properties of the role definition. If you have data actions, you will add those to the DataActions or NotDataActions properties.2. Decide how you want to create the custom role.You can create custom roles using Azure portal, Azure PowerShell, Azure CLI, or the REST API.3. Create the custom role.The easiest way is to use the Azure portal. For steps on how to create a custom role using the Azure portal, see Create or update Azure custom roles using the Azure portal.4. Test the custom role.Once you have your custom role, you have to test it to verify that it works as you expect. If you need to make adjustments later, you can update the custom role.Example:Custom role exampleThe following shows what a custom role looks like as displayed using Azure PowerShell in JSON format. This custom role can be used for monitoring and restarting virtual machines.{"Name": "Virtual Machine Operator","Id": "88888888-8888-8888-8888-888888888888","IsCustom": true,"Description": "Can monitor and restart virtual machines.","Actions": ["Microsoft.Storage/*/read","Microsoft.Network/*/read","Microsoft.Compute/*/read","Microsoft.Compute/virtualMachines/start/action","Microsoft.Compute/virtualMachines/restart/action","Microsoft.Authorization/*/read","Microsoft.ResourceHealth/availabilityStatuses/read","Microsoft.Resources/subscriptions/resourceGroups/read","Microsoft.Insights/alertRules/*","Microsoft.Insights/diagnosticSettings/*","Microsoft.Support/*"],"NotActions": [],"DataActions": [],"NotDataActions": [],"AssignableScopes": ["/subscriptions/{subscriptionId1}","/subscriptions/{subscriptionId2}","/providers/Microsoft.Management/managementGroups/{groupId1}" ]}
You have an Azure subscription named Sub1 that contains an Azure logic app named App1.You have an SAP RISE managed workload that is integrated with Sub1.You need to ensure that App1 can access data stored in SAP by using REST API calls.What should you deploy?
SAP on Azure, Integrating Azure services with SAP RISEYour SAP landscape running within SAP RISE can easily integrate with additional applications on Azure. With the information about available interfaces to the SAP RISE/ECS landscape, many scenarios with Azure Services are possible.On-premises data gatewayAzure Services such as Azure Logic Apps, Power Apps or Power BI communicate and exchange data with SAP systems through an on-premises data gateway where required. The on-premises data gateway is a virtual machine, running in Azure or on-premises. It provides secure data transfer between these Azure Services and your SAP systems including the option for runtime and driver support for SAP RFCs.With SAP RISE, the on-premises data gateway can connect to Azure Services running in customer's Azure subscription. This VM running the data gateway is deployed and operated by the customer. Following high-level architecture serves as overview, similar method can be used for either service.Incorrect:Not C:* an integration runtimeData integration scenarios with Azure Data Factory or Synapse Analytics require a self-hosted integration runtime or Azure Integration Runtime.
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.