You have an Azure subscription that contains virtual machines and an Azure Policy named Policy1.Policy1 is configured to automatically install Azure VM extension for SAP solutions to newly deployed virtual machines.You need to modify Policy1 to ensure that the policy also applies to the existing virtual machines.What should you create first?
Answer(s): D
Deploy Azure VM extension for SAP solutions using Azure Policy Use Azure Automation: Automate deployment and configuration of VM extensions with runbooks. These can be scheduled or triggered as needed.
You have an Azure subscription that contains a virtual network named VNet1.An SAP landscape in Azure is deployed to VNet1.You need to integrate the SAP landscape with SAP RISE. The solution must minimize costs.Which type of connection should you use?
Answer(s): C
SAP on Azure, Connectivity with SAP RISEVirtual network peering with SAP RISE/ECSA virtual network (vnet) peering is the most performant way to connect securely between two virtual networks, all in a private network address space. The peered networks appear as one for connectivity purposes, allowing applications to talk to each other. Applications running in different virtual networks, subscriptions, Azure tenants or regions can communicate directly. Like network traffic on a single virtual network, peering traffic remains in a private address space and doesn't traverse the internet. Virtual network peering charges apply.For SAP RISE/ECS deployments, virtual peering is the preferred way to establish connectivity with customer's existing Azure environment. Primary benefits are:* Minimized network latency and maximum throughput between SAP RISE landscape and own applications and services running in Azure.* No extra complexity and cost with a dedicated on-premises communication path for SAP RISE workload.Instead using on-premises communication path of the existing Azure network hub(s).
https://learn.microsoft.com/en-us/azure/sap/workloads/rise-integration
You plan to deploy six Azure virtual machines that will host SAP application servers. The virtual machines will be distributed evenly across three availability zones in a single Azure region.You need to ensure that the pair of virtual machines in each zone are deployed to different physical racks in a datacenter.Which two actions should you perform in each zone? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.
Answer(s): A,C
A: Need subnets to put the VMs in different racks.C: Availability options for Azure Virtual MachinesAvailability zonesAvailability zones expands the level of control you have to maintain the availability of the applications and data on your VMs. An Availability Zone is a physically separate zone, within an Azure region. There are three Availability Zones per supported Azure region.Each Availability Zone has a distinct power source, network, and cooling. By designing your solutions to use replicated VMs in zones, you can protect your apps and data from the loss of a data center. If one zone is compromised, then replicated apps and data are instantly available in another zone.Availability setsAn availability set is a logical grouping of VMs that allows Azure to understand how your application is built to provide for redundancy and availability. We recommended that two or more VMs are created within an availability set to provide for a highly available application and to meet the 99.95% Azure SLA. There is no cost for the Availability Set itself, you only pay for each VM instance that you create.Incorrect:Not E: A proximity placement group is a logical grouping used to make sure that Azure compute resources are physically located close to each other. Proximity placement groups are useful for workloads where low latency is a requirement. Note. Proximity placement groups cannot be used with dedicated hosts.
HOTSPOT (Drag and Drop is not supported)You have three on-premises datacenters in North America, Europe, and Asia.You plan to deploy an Azure subscription named Sub1 that will contain virtual machines hosted across three Azure regions.You have an SAP RISE managed workload that will be integrated with Sub1.You need to recommend a networking solution that meets the following requirements:Ensures connectivity from the datacenters to Sub1 by using ExpressRoute circuits Restricts traffic between the managed workload, the virtual machines, and the datacenters Provides Point-to-Site (P2S) VPN connections for clientsMinimizes administrative effortWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Azure Virtual WANFor connectivityTransit connectivity between P2S VPN and Azure Express Route is generally not supported. However, it can be done via virtual WAN.Virtual WAN allows transit connectivity between VPN and ExpressRoute. This implies that VPN-connected sites or remote users can communicate with ExpressRoute-connected sites. There is also an implicit assumption that the Branch-to-branch flag is enabled and BGP is supported in VPN and ExpressRoute connections. This flag can be located in the Azure Virtual WAN settings in Azure portal. All route management is provided by the virtual hub router, which also enables transit connectivity between virtual networks.Box 2: A secured virtual hubFor securityWhat is a secured virtual hub?A virtual hub is a Microsoft-managed virtual network that enables connectivity from other resources. When a virtual hub is created from a Virtual WAN in the Azure portal, a virtual hub VNet and gateways (optional) are created as its components.A secured virtual hub is an Azure Virtual WAN Hub with associated security and routing policies configured by Azure Firewall Manager. Use secured virtual hubs to easily create hub-and-spoke and transitive architectures with native security services for traffic governance and protection. Multiple secured hubs can be deployed within the same region or across regions part of the same Virtual WAN resource. Use Firewall Manager in the Azure portal to add more secured hubs.
HOTSPOT (Drag and Drop is not supported)You plan to deploy an SAP landscape in Azure.You need to configure storage for the virtual machines that will host SAP Digital Boardroom. The solution must meet the following requirements:Encrypt all data by using a key generated by Azure Key Vault Managed HSM.Support a single disk size of 50 TB and 65,000 IOPS.Minimize costs.Which disk type and encryption method should you use? To answer, select the appropriate options in the answer area.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: Premium SSD v2Disk type: Support a single disk size of 50 TB and 65,000 IOPSDisk type comparisonThe following table provides a comparison of the five disk types to help you decide which to use.Incorrect:* Premium SSD - not fast enough* Standard SSD - not fast enough* Ultra disk - more costlyBox 2: Customer-managed keyEncryption method: Use Azure Key Vault Managed HSMYou can use your own encryption key to protect the data in your storage account. When you specify a customer-managed key, that key is used to protect and control access to the key that encrypts your data. Customer-managed keys offer greater flexibility to manage access controls.You must use one of the following Azure key stores to store your customer-managed keys:* Azure Key Vault*-> Azure Key Vault Managed Hardware Security Module (HSM)Note: Azure Key Vault Managed HSM (Hardware Security Module) is a fully managed, highly available, single- tenant, standards-compliant cloud service that enables you to safeguard cryptographic keys for your cloud applications, using FIPS 140-2 Level 3 validated HSMsIntegrated with Azure and Microsoft PaaS/SaaS servicesGenerate (or import using BYOK) keys and use them to encrypt your data at rest in Azure services such as Azure Storage, Azure SQL, Azure Information Protection, and Customer Key for Microsoft 365.Azure Key Vault Managed HSM supports importing keys generated in your on-premises hardware security module (HSM); the keys will never leave the HSM protection boundary. This scenario often is referred to as bring your own key (BYOK).You generate and transfer your key to the Managed HSM.Incorrect:* Azure Disk Encryption* Encryption at host* Platform-managed key
Post your Comments and Discuss Microsoft AZ-120 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-120 content, but please register or login to continue.