DRAG DROP (Drag and Drop is not supported)You have an SAP Fiori single sign-on (SSO)-enabled subscription.You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com.You need to configure SSO authentication between SAP Fiori and contoso.com.Which five actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Answer(s): A
Step 1: Add an enterprise application from the gallery.Microsoft Entra single sign-on (SSO) integration with SAP Fiori Adding SAP Fiori from the galleryTo configure the integration of SAP Fiori into Microsoft Entra ID, you need to add SAP Fiori from the gallery to your list of managed SaaS apps.1. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator. *-> 2. Browse to Identity > Applications > Enterprise applications > New application.3. In the Add from the gallery section, type SAP Fiori in the search box.4. Select SAP Fiori from results panel and then add the app. Wait a few seconds while the app is added to your tenant.Step 2: Select SAML as the SSO method.See step 11 below.Configure Microsoft Entra SSOFollow these steps to enable Microsoft Entra SSO.1. Open a new web browser window and sign in to your SAP Fiori company site as an administrator.2. Make sure that http and https services are active and that the relevant ports are assigned to transaction code SMICM.3. Sign in to SAP Business Client for SAP system T01, where single sign-on is required. Then, activate HTTP Security Session Management.* Some steps omitted*7. Select Local Provider tab > Metadata.8. In the SAML 2.0 Metadata dialog box, download the generated metadata XML file and save it on your computer.9. Sign in to the Microsoft Entra admin center as at least a Cloud Application Administrator.10. Browse to Identity > Applications > Enterprise applications > SAP Fiori > Single sign-on.11. On the Select a single sign-on method page, select SAML. [Step 2]12. On the Set up single sign-on with SAML page, click the pencil icon for Basic SAML Configuration to edit the settings.Incorrect:* Select linked as the SSO method.Step 3: Upload the metadata file and provide the sign-in URL.13. On the Basic SAML Configuration section, if you have Service Provider metadata file, perform the following steps:13.a Click Upload metadata file. [Step 3]13b. Click on folder logo to select the metadata file and click Upload.13c. When the metadata file is successfully uploaded, the Identifier and Reply URL values are automatically populated in the Basic SAML Configuration pane. In the Sign on URL box, enter a URL that has the following pattern: https://<your company instance of SAP Fiori>. [Step 3]Step 4: Update the user claims14. The SAP Fiori application expects the SAML assertions to be in a specific format. Configure the following claims for this application. To manage these attribute values, in the Set up Single Sign-On with SAML pane, select Edit.15. In the User Attributes & Claims pane, configure the SAML token attributes as shown in the preceding image. Then, complete the following steps: [Step 4]Select Edit to open the Manage user claims pane.In the Transformation list, select ExtractMailPrefix().In the Parameter 1 list, select user.userprincipalname.Select Save.Step 5: Download the Federation Metadata file.16. On the Set up single sign-on with SAML page, in the SAML Signing Certificate section, find FederationMetadata XML and select Download to download the certificate and save it on your computer.17. On the Set up SAP Fiori section, copy the appropriate URL(s) based on your requirement.
HOTSPOT (Drag and Drop is not supported)You have an on-premises datacenter.You have an Azure subscription named Sub1 that contains a virtual network named VNet1.The datacenter is connected to VNet1 by using an ExpressRoute circuit.You have an SAP RISE managed workload.You need to integrate Sub1 with the managed workload. The solution must meet the following requirements:Minimize latency between the managed workload and the datacenter. Restrict the network ports that can be used between the managed workload and VNet1.Minimize costs.What should you use to connect VNet1 and the managed workload, and what should you use to secure the connection? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Virtual network peeringConnect VNet1 and managed workloadFor SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Primary benefits are:* Minimized network latency and maximum throughput between SAP RISE landscape and own applications and services running in Azure.* No extra complexity and cost with a dedicated on-premises communication path for SAP RISE workload. Instead using on-premises communication path of the existing Azure network hub(s).Box 2: A network security group (NSG)Secure the connectionBoth the SAP and customer virtual network(s) are protected with network security groups (NSG), permitting communication on SAP and database ports through the peering. Communication between the peered virtual networks is secured through these NSGs, limiting communication to and from customer's SAP environment.
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription.You need to deploy an instance of SAP HANA that will use Azure NetApp Files to host data. The solution must use proximity placement groups.Which protocol and feature should you configure for the deployment? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: NFSv4.1ProtocolNFS v4.1 volumes on Azure NetApp Files for SAP HANAAzure NetApp Files provides native NFS shares that can be used for /hana/shared, /hana/data, and /hana/log volumes. Using ANF-based NFS shares for the /hana/data and /hana/log volumes requires the usage of the v4.1 NFS protocol. The NFS protocol v3 isn't supported for the usage of /hana/data and /hana/log volumes when basing the shares on ANF.Box 2: application volume groupFeatureApplication volume group and proximity placement group are related.Incorrect:* Access-based enumerationAccess-based enumeration is now generally available (GA)In environments with Azure NetApp Files volumes shared among multiple departments, projects, and users, many users can see the existence of other files and folders in directory listings even if they don't have permissions to access those items. Enabling Access-based enumeration (ABE) on Azure NetApp Files volumes ensures users only see those files and folders in directory listings that they have permission to access. If a user doesn't have read or equivalent permissions for a folder, the Windows client hides the folder from the user's view. This capability provides an additional layer of security by only displaying files and folders a user has access to, and conversely hiding file and folder information a user has no access. You can enable ABE on Azure NetApp Files SMB volume and dual-protocol volume with NTFS security style.
You have an on-premises server named Server1 that runs Windows Server and has the DNS Server role installed. Server1 contains a DNS domain named contoso.com.You have an Azure subscription.You have an SAP RISE managed workload that contains a DNS server named Server2.You need to ensure that DNS name resolution works across the on-premises, Azure, and SAP environments.What should you do first?
DNS integration with SAP RISE/ECS managed workloadsIntegration of customer owned networks with cloud based infrastructure and providing a seamless name resolution concept is a vital part of a successful project implementation. This diagram describes one of the common integration scenarios of SAP owned subscriptions, virtual networks and DNS infrastructure with customer's local network and DNS services. In such setup, Azure hub or on-premises DNS servers are holding all DNS entries. The DNS infrastructure is capable to resolve DNS requests coming from all sources (on- premises clients, customer's Azure services and SAP managed environments).Design description and specifics:* Custom DNS configuration for SAP-owned virtual networks* Two VMs inside the RISE/PCE Azure virtual network host DNS servers *-> Customers must provide and delegate to SAP a subdomain/zone (for example, example ecs.contoso.com) to assign names and create forward and reverse DNS entries for the virtual machines that run SAP managed environment. SAP DNS servers are holding a master DNS role for the delegated zone* DNS zone transfer from SAP DNS server to customer's DNS servers is the primary method to replicate DNS entries from RISE/PCE environment.* Etc.
You have an SAP production landscape in Azure in the West Europe Azure region. The landscape contains anAzure load balancer named LB1. The DNS records for LB1 are stored in an Azure Private DNS zone.You plan to replicate the SAP application server pool, SAP Central Services (SCS), and SAP Web Dispatcher to the North Europe Azure region by using Azure Site Recovery.You need to ensure that the DNS records for LB1 are updated automatically when a failover is initiated. The solution must minimize administrative effort.What should you configure?
Answer(s): D
Azure Private DNS zone resiliencyDNS private zones are resilient to regional outages because zone data is globally available. Resource records in a private zone are automatically replicated across regions.Note: The Azure DNS private zones autoregistration feature manages DNS records for virtual machines deployed in a virtual network. When you link a virtual network with a private DNS zone with this setting enabled, a DNS record gets created for each virtual machine deployed in the virtual network.For each virtual machine, an address (A) record is created. DNS records for newly deployed virtual machines are also automatically created in the linked private DNS zone. When a virtual machine gets deleted or stopped, the autoregistered DNS records associated with this virtual machine are removed from the private DNS zone.
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.