Algemeen

Question 1

Azure access reviews

Answer 1

User’s access can be reviewed regularly to make sure only the right people have continued access. Can be used to manage group memberships, access to enterprise applications, and role assignments.
If access is not granted within the timeframe of the review, the user can be automatically denied access.

Question 2

Microsoft AD Application Proxy

Answer 2

Application Proxy is a feature of Microsoft Entra ID that enables users to access on-premises web applications from a remote client. Application Proxy includes both the Application Proxy service which runs in the cloud, and the Application Proxy connector which is a lightweight agent that runs on an on-premises server.

1. After the user has accessed the application through an endpoint, the user is directed to the Microsoft Entra sign-in page. Users can reach applications while outside of your network by accessing an external URL.
2. After a successful sign-in, Microsoft Entra ID sends a token to the user’s client device.
3. The client sends the token to the Application Proxy service, which retrieves the user principal name (UPN) and security principal name (SPN) from the token.
4. Application Proxy then sends the request to the Application Proxy connector. The connector only uses outbound connections.
5. If you have configured single sign-on, the connector performs any additional authentication required on behalf of the user, against the on-premise AD.
6. The connector sends the request to the on-premises application.
7. The response is sent through the connector and Application Proxy service to the user.

Adding the on-premise web as an Azure AD enterprise application to enables Azure AD to provide SSO authentication and authorization for the app.

Question 3

Azure AD App registration

Answer 3

Azure AD app registration allows you to integrate your application with Azure AD. By doing this, you can leverage Azure AD’s authentication mechanisms, including SSO. Once the app is registered in Azure AD and configured for SSO, users who are already signed in to their Azure AD account can access the application without being prompted for authentication again.

Question 4

Azure Network Watcher

Answer 4

Azure Network Watcher provides a suite of tools to monitor, diagnose, view metrics, and enable or disable logs for Azure IaaS (Infrastructure-as-a-Service) resources. Network Watcher enables you to monitor and repair the network health of IaaS products. Network Watcher isn’t designed or intended for PaaS monitoring or Web analytics.

When you create or update a virtual network in your subscription, Network Watcher is automatically enabled in your virtual network’s region.

Network Watcher consists of three major sets of tools and capabilities:
1. Monitoring
2. Network diagnostic tools
3. Traffic

NSG flow logging requires the Microsoft.Insights provider, the flow logs are stored in a storage account.

Specific tools:

• IP flow verify checks if a packet is allowed or denied to or from a virtual machine, so it works at a VM level. The information consists of direction, protocol, local IP, remote IP, local port, and a remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned.
• NSG Flow logs enable you to log 5-tuple flow information about your Azure IP traffic that passes through a network security group or Azure virtual network. This data can be used by Traffic Analytics to analyze network traffic in your environment.
• Connection Troubleshoot. The connection troubleshoot feature of Network Watcher provides the capability for a one-time check a direct TCP connection from a virtual machine to a virtual machine (VM), fully qualified domain name (FQDN), URI, or IPv4 address.
• The connection monitor capability monitors communication at a regular interval and informs you of reachability, latency, and network topology changes between the VM and the endpoint over a period of time. You can select only the source VMs that are created in the region of the connection monitor.
• Variable packet capture allows you to create packet capture sessions to track traffic to and from a virtual machine or a scale set.
• Network Performance Monitor - for latency and network issues in hybrid, on-premises, across environments setups.

Question 5

Azure Policy

Answer 5

Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules, policy definitions. To simplify management, several business rules can be grouped together to form a policy initiative

Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.

Can be assigned to Mg, Sub, Rg, resource, not to tenant. Inherits down and subscopes can be excluded.

Question 6

Azure Event Grid

Answer 6

Event Grid follows the Publisher-Subscriber pattern. When event sources trigger events, they’re published to Event Grid topics. Consumers of those events create Event Grid subscriptions by specifying event types and event handler that will process the events. If there are no subscribers, the events are discarded. Each event can have multiple subscriptions. Event Grid propagates messages to the subscribers in a push model.

Question 7

Event Hub

Answer 7

When you’re working with an event stream, Azure Event Hubs is the recommended message broker. Essentially, it’s a large buffer that’s capable of receiving large volumes of data with low latency. The received data can be read quickly through concurrent operations. You can transform the received data by using any real-time analytics provider. Event Hubs also provides the capability to store events in a storage account. Event Hubs is capable of ingesting millions of events per second. The events are only appended to the stream and are ordered by time.

Uses pull not push for subscribers.

Question 8

Azure API Management

Answer 8

Azure API Management is a hybrid, multicloud management platform for APIs across all environments. As a platform-as-a-service, API Management supports the complete API lifecycle.
It supports features such as rate limiting, integration of OAuth2 authentication providers for access control to the API.

Question 9

Log Analytics Workspace

Answer 9

A Log Analytics workspace is a unique environment for log data from Azure Monitor and other Azure services, such as Microsoft Sentinel and Microsoft Defender for Cloud. Each workspace has its own data repository and configuration but might combine data from multiple services.

Question 10

Azure Monitor Agent

Answer 10

Azure Monitor Agent (AMA) collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor for use by features, insights, and other services, such as Microsoft Sentinel and Microsoft Defender for Cloud. Azure Monitor Agent replaces all of Azure Monitor’s legacy monitoring agents.

Question 11

Azure Blueprints

Answer 11

Blueprints are a declarative way to orchestrate the deployment of various resource templates and other artifacts such as:
Role Assignments
Policy Assignments
Azure Resource Manager templates (ARM templates)
Resource Groups

The blueprint definitions are saved to a subscription or management group, and it can then be assigned to that subscription or subs contained in the mg. Assignmemt to a mg is possible, but then only the metadata is saved at the mg level, the assignment must still be to a specific sub.

Question 12

Azure Policy effect for tags

Answer 12

Append is intended for use with non-tag properties. While Append can add tags to a resource during a create or update request, it’s recommended to use the Modify effect for tags instead.

Policy assignments with effect set as Modify require a managed identity to do remediation.

Question 13

Protecting Azure App Service settings

Answer 13

Key Vault references can be used as values for Application Settings, allowing you to keep secrets in Key Vault instead of the site config. Application Settings are securely encrypted at rest, but if you need secret management capabilities, they should go into Key Vault. To use a Key Vault reference for an app setting, set the reference as the value of the setting. Your app can reference the secret through its key as normal. No code changes are required.

Application managed identity requires get permission on secrets to read them.

Question 14

Analyzing Cosmos DB data with Azure Synapse Analytics

Answer 14

Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure Synapse Analytics. It enables customers to run near real-time analytics over their operational data with full performance isolation from their transactional workloads and without an ETL pipeline.

Question 15

Role assignments and nested groups

Answer 15

Members in the nested group inherit roles granted the parent group.

Question 16

Azure Policy on-demand scan

Answer 16

Cannot be started from the portal, only from CLI, Powershell, REST,…

Question 17

Azure storage authorization options

Answer 17

Search ‘authorize access to storage data’

Question 18

Access methods to storage data

Answer 18

1. Shared key, using the storage account key
2. SAS, two types: user delegation SAS (only for BLOB), or service SAS (for one of the storage services), account SAS (for one or more of the storage services, or service level ops). SAS can be ad-hoc woth access constraints specified in the SAS URI, or associated with a stored access policy (only for service SAS), which is defined at the blob container or file share level and provides constraints.
3. Azure AD account. MS recommended.

Question 19

Azure Batch

Answer 19

Use Azure Batch to run large-scale parallel and high-performance computing (HPC) batch jobs efficiently in Azure.

Question 20

Immutable storage

Answer 20

Configured in the container access policy. Immutable storage for Azure Blob Storage enables users to store business-critical data in a WORM (Write Once, Read Many) state. While in a WORM state, data cannot be modified or deleted for a user-specified interval.

Time-based retention policies or legal hold policies are available.

Question 21

SQL Server Auditing

Answer 21

Auditing an instance of SQL Server or a SQL Server database involves tracking and logging events that occur on the system. The SQL Server Audit object collects a single instance of server- or database-level actions and groups of actions to monitor. The audit is at the SQL Server instance level. You can have multiple audits per SQL Server instance. The Server Audit Specification object belongs to an audit.

V1 storage accounts are not supported.

Question 22

Azure Data Factory

Answer 22

Azure Data Factory is a cloud-based data integration service that allows you to create, schedule, and manage data pipelines.

Question 23

Azure SQL Database and Azure SQL Managed Instance TDE max. key strength

Answer 23

RSA 3072

Question 24

Data analysis services

Answer 24

Azure Data Lake Storage v2 for all raw data, offers Hadoop Distributed File System (HDFS)-compatible access.
Use HDInsights services for all kinds of open source data processing tools, or Databricks, which is built on Spark. Spark offers full functionality in creating, updating and querying a Delta Lake on top of a Data Lake. A Delta Lake is a software layer over a data lake that gives additional features.
Store transformed data in Data Warehouse/Synapse Dedicated SQL Pool, which supports scale up/scale down.
Synapse Serverless Pool offers ad-hoc querying against data storage, with resources completely managed by Microsoft. It does not store data.
Use Data factory to manage the entire LETL pipeline.
Azure Analysis Services provides a fully managed platform-as-a-service (PaaS) solution for online analytical processing (OLAP) and data modeling. It is suitable for serving analytical models to thousands of end users.

Use Synapse Analysis Services to manage the entire LETL+reporting/analysis pipeline.

Question 25

Dedicated SQL Pool

Answer 25

There is a central control node, the compute power and storage are decoupled. Each Dedicated SQL Pool is stored as 60 distributions. Those distributions are evenly distributed to the compute nodes. Increasing the compute nodes, will decrease the number of distributions per compute node.

Question 26

Azure Front Door

Answer 26

Azure Front Door is Microsoft’s modern cloud Content Delivery Network (CDN) that delivers your content using Microsoft’s global edge network with hundreds of global and local points of presence (PoPs) distributed around the world. It is not a regional but a global service.

It will cache publicly available objects loaded from Azure blob storage, a web application, virtual machine, any publicly accessible web server.

Azure Front Door also includes several security features, such as SSL offloading, WAF, and DDoS protection.

Question 27

MySQL Flexible Server Compute levels

Answer 27

You can create an Azure Database for MySQL flexible server instance in one of three different service tiers: Burstable, General Purpose, and Business Critical. The service tiers are differentiated by the underlying VM SKU used B-series, D-series, and E-series. The choice of compute tier and size determines the memory and vCores available on the server. The same storage technology is used across all service tiers.

Burstable compute tier is designed to provide a cost-effective solution for workloads that don’t require continuous full CPU continuously. This tier is ideal for nonproduction workloads, such as development, staging, or testing environments. The unique feature of the burstable compute tier is its ability to “burst”, that is, to utilize more than its baseline CPU performance using up to 100% of the vCPU when the workload requires it. This is made possible by a CPU credit model, which allows B-series instances to accumulate “CPU credits” during periods of low CPU usage. These credits can then be spent during periods of high CPU usage, allowing the instance to burst above its base CPU performance.
However, it’s important to note that once a burstable instance exhausts its CPU credits, it operates at its base CPU performance.
Note that the Burstable tier doesn’t support functionality of creating Read Replicas and High availability feature.

Question 28

Event Hubs Capture

Answer 28

Azure Event Hubs enables you to automatically capture the streaming data in Event Hubs in an Azure Blob storage or Azure Data Lake Storage Gen 1 or Gen 2 account of your choice, with the added flexibility of specifying a time or size interval.

The destination storage (Azure Storage or Azure Data Lake Storage) account must be in the same subscription as the event hub.

Event Hubs doesn’t support capturing events in a premium storage account.
Event Hubs capture supports any non-premium Azure storage account with support for block blobs.

Writes output in Avro by default, Parquet also supported through the no-code editor.

Question 29

Azure Synapse Link for Cosmos DB

Answer 29

Azure Synapse Link for Azure Cosmos DB creates a tight integration between Azure Cosmos DB and Azure Synapse Analytics, allowing you to run near real-time analytics over operational data in Azure Cosmos DB. It creates a “no-ETL” (Extract, Transform, Load) environment that allows you to analyze data directly without affecting the performance of the transactional workload.

Question 30

SQL Server data protection

Answer 30

Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal effect on the application layer.

Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users.

Question 31

Blob point in time restore

Answer 31

Only block blobs in a standard general-purpose v2 storage account can be restored as part of a point-in-time restore operation. Append blobs, page blobs, and premium block blobs aren’t restored. Only data in the hot and cool access tiers can be restored with point-in-time restore.

Enabling the change feed, soft delete and blib versioning is required.

Question 32

Azure Data Share

Answer 32

Azure Data Share enables organizations to securely share data with multiple customers and partners. Data providers are always in control of the data that they’ve shared and Azure Data Share makes it simple to manage and monitor what data was shared, when and by whom.

Question 33

Azure Data Box Gateway

Answer 33

Data Box Gateway is a virtual device based on a virtual machine provisioned in your virtualized environment or hypervisor. The virtual device resides in your premises and you write data to it using the NFS and SMB protocols. The device then transfers your data to Azure block blob, page blob, or Azure Files.

Data Box Gateway can be leveraged for transferring data to the cloud such as cloud archival, disaster recovery, or if there is a need to process your data at cloud scale.

Question 34

Key Vault fault tolerance

Answer 34

server in the paired region
The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets. During failover, your key vault is in read-only mode.

Question 35

Azure Site Recovery

Answer 35

Site Recovery helps ensure business continuity by keeping business apps and workloads running during outages. Site Recovery replicates workloads running on physical and virtual machines (VMs) from a primary site to a secondary location. The locations can be in Azure or on premises.

When an outage occurs at your primary site, you fail over to a secondary location, and access apps from there. After the primary location is running again, you can fail back to it.

Question 36

Azure SQL / MI / Serverless HA/DR

Answer 36

Within a region: HA. All models/tiers/service offerings have RPO 0, RTO 60 sec.

• Standard, Basic, General Purpose: remote storage, relies on the high availability and reliability of the remote storage tier.
• Premium, Business critical: local storage, relies on the fact that there is always a quorum of available database engine nodes. Quicker failover. Up to three secondary read-only replica’s, read operations can be serviced by them (‘read scale-out’).
• Hyperscale: hyperscale model, distributed system of highly available components.

Zone redundancy:
- Standard and Basic: no
- General Purpose (only for Gen5 hw, public preview for MI), Premium, Business critical and Hyperscale: yes

Over regions: DR, RPO several seconds, RTO 60 seconds. Two options:
- Automatic failover group. One replica in other region, will fail over automatically after 60 mins or manually. At server level, individual dbs can be selected. Failover groups provide read-write and read-only listener end-points that remain unchanged during geo-failovers. For Azure SQL DB and MI.
- geo-replication. At db level, up to four read-only copies in the region possible. Manual fail-over only. Only Azure SQL DB.

Question 37

Azure SQL SKUs

Answer 37

DTU - Basic, Standard, Premium
vCore - General Purpose, Business Critical, Hyperscale

MI is available in GP and BC

Serverless is available in GP and Hyperscale, only for vCore.

Question 38

Azure SQL encryption

Answer 38

Always Encrypted - not visible to DBA’s. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. An Always Encrypted-enabled driver installed on the client computer achieves this by automatically encrypting and decrypting sensitive data in the client application. The driver encrypts the data in sensitive columns before passing the data to the Database Engine, and automatically rewrites queries so that the semantics to the application are preserved. Similarly, the driver transparently decrypts data, stored in encrypted database columns, contained in query results.

TDE - Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics against the threat of malicious offline activity by encrypting data at rest. It performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application. By default, TDE is enabled for all newly deployed Azure SQL Databases

Question 39

The Microsoft Azure Recovery Services (MARS) agent

Answer 39

The MARS agent is a free and easy-to-use agent that can be installed on Windows servers to back up files and folders to Azure.

Question 40

Virtual WAN SKUs

Answer 40

BASIC supports only SITE to SITE VPN. STANDARD supports below configs, ExpressRoute User VPN (P2S) VPN (site-to-site) Inter-hub and VNet-to-VNet transiting through the virtual hub Azure Firewall NVA in a virtual WAN

Question 41

Azure functions Premium vs Consumption

Answer 41

Consumption plan cannot access Virtual Network Integration features. Virtual network integration allows your function app to access resources inside a virtual network.

Question 42

Connecting to
On-premises data sources from logic apps

Answer 42

Sometimes your workflow must connect to an on-premises data source and can use only connectors that provide this access through an on-premises data gateway. To set up this on-premises data gateway, you have to complete the following tasks: install the local on-premises data gateway and create an on-premises data gateway resource in Azure for the local data gateway.

Question 43

Azure API Gateway

Answer 43

Azure API Management is a hybrid, multicloud management platform for APIs across all environments. Azure API Management is made up of an API gateway, a management plane, and a developer portal. These components are Azure-hosted and fully managed by default.

All requests from client applications first reach the API gateway, which then forwards them to respective backend services. The API gateway acts as a facade to the backend services, allowing consistent configuration of routing, security, throttling, caching, and observability. It performs authorization, rate limiting, caching, logging, mocking responses, transformation of requests, etc. APIs are published in products.

API providers interact with the service through the management plane, which provides full access to the API Management service capabilities.

The developer portal is an automatically generated, fully customizable website with the documentation of your APIs.

Tiers: Consumption/Developer/Basic/Standard/Premium. Search ‘azure api management tiers’ on learn.

Question 44

Azure Firewall Policies

Answer 44

Policies created with non-empty parent policies inherit all rule collections from the parent policy. The parent policy and the child policy must be in the same region. A firewall policy can be associated with firewalls across regions regardless where they are stored.

Question 45

Azure CycleCloud

Answer 45

Azure CycleCloud is an enterprise-friendly tool for orchestrating and managing High Performance Computing (HPC) environments on Azure.

Question 46

Max. Object size Azure Storage

Answer 46

Search azure files scalability targets in learn:

• gpv2: 4 TB files / 190 TB block and append / 8 TB page
• premium file: 4 TB
• premium blob: 190 TB block and append / 8 TB page

Premium blob optimized for applications that use smaller, kilobyte-range objects. It’s ideal for applications that require high transaction rates or consistent low-latency storage.

Question 47

Azure storage redundancy

Answer 47

Search azure storage redundancy on learn

Question 48

Blob types and characteristics

Answer 48

Once the blob has been created, its type cannot be changed, and it can be updated only by using operations appropriate for that blob type, i.e., writing a block or list of blocks to a block blob, appending blocks to an append blob, and writing pages to a page blob.

Block blobs are optimized for uploading large amounts of data efficiently.

Page blobs are a collection of 512-byte pages optimized for random read and write operations.

An append blob is composed of blocks and is optimized for append operations.

Question 49

AKS scaling

Answer 49

• The cluster autoscaler watches for pods that can’t be scheduled on nodes because of resource constraints. The cluster then automatically increases the number of nodes.
• The horizontal pod autoscaler uses the Metrics Server in a Kubernetes cluster to monitor the resource demand of pods. If an application needs more resources, the number of pods is automatically increased to meet the demand.
• With virtual nodes, you have quick provisioning of pods, and only pay per second for their execution time. You don’t need to wait for Kubernetes cluster autoscaler to deploy VM compute nodes to run more pods. Virtual nodes are only supported with Linux pods and nodes. The virtual nodes add on for AKS is based on the open source project Virtual Kubelet

Question 50

Copy data to or from a file system by using Azure Data Factory or Azure Synapse Analytics

Answer 50

Use the Copy activity with a file system connector.

If your data store is located inside an on-premises network, an Azure virtual network, or Amazon Virtual Private Cloud, you need to configure a self-hosted integration runtime to connect to it.
If your data store is a managed cloud data service, you can use the Azure Integration Runtime. If the access is restricted to IPs that are approved in the firewall rules, you can add Azure Integration Runtime IPs to the allow list.

Question 51

Run Microsoft SQL Server Integration Services (SSIS) packages in the cloud

Answer 51

SQL Server Integration Services is a platform for building enterprise-level data integration and data transformations solutions.

Azure-SSIS Integration Runtime (IR) in Azure Data Factory (ADF) supports running SSIS packages.

Question 52

Azure Blueprints vs ARM templates

Answer 52

The main difference between using Azure Blueprints and Azure Resource Manager (ARM) templates is that Azure Blueprints remain connected to the deployed resources, enabling you to track and audit the compliance of those resources with the original blueprint definition. Azure Blueprints allow you to manage and monitor the deployed resources over time, whereas ARM templates are a one-time deployment tool that does not maintain a connection to the resources after deployment.

Question 53

Azure resource mover vs Azure Migrate

Answer 53

Azure Resource Mover, for moving resources between subscriptions, regions, resource groups. Azure migrate for moving on-premises resources to a resource group.

Question 54

SQL Server Always On group on Azure VMs

Answer 54

• place vms in availability set or in
  availability zones. Availability set offers proximity placement group.
• If you deploy your SQL Server VMs to a single subnet, you can configure a virtual network name (VNN) and an Azure Load Balancer, or a distributed network name (DNN) to route traffic to your availability group listener. DNN means quicker failover.

Question 55

SQL Server Always On group on Azure VMs

Answer 55

• place vms in availability set or in
  availability zones. Availability set offers proximity placement group.
• If you deploy your SQL Server VMs to a single subnet, you can configure a virtual network name (VNN) and an Azure Load Balancer, or a distributed network name (DNN) to route traffic to your availability group listener. DNN means quicker failover.

Question 56

Azure Storage Queues and Service Bus FIFO

Answer 56

Storage Queues do not support the FIFO model, Service Bus does through sessions, and within one partition when using partitions.

Question 57

SQL migration

Answer 57

• Azure Migrate. Azure Migrate is a service that helps you assess and migrate applications, infrastructure, and data, but it doesn’t specifically cater to SQL Server migrations.
• Data Migration Assistant (DMA). The Data Migration Assistant (DMA) tool can be used beforehand to assess your SQL Server databases for any feature parity and compatibility issues that could impact the database functionality in Azure SQL Managed Instance.
• Azure Database Migration Service. Provides offline migration option to SQL Server MI.
• SQL Server Migration Assistant (SSMA). SQL Server Migration Assistant (SSMA) is more suited for migrations to Azure SQL Database and does not support Azure SQL Managed Instance.
• Azure Data Studio. The Azure SQL migration extension for Azure Data Studio supports both online and offline database migrations to Azure SQL Managed Instance.

Question 58

Mutual TLS API gateway with AKS

Answer 58

Use Ingress Controller