Review Mode Set 2 Dojo Flashcards
Which Azure service can you use to send alerts when the CPU utilization of a virtual machine reaches 80%?
Microsoft Defender for Cloud Azure Bastion Azure Monitor Azure Service Health
Azure Monitor
Explanation:
Azure Monitor helps you maximize the availability and performance of your applications and services. It delivers a comprehensive solution for collecting, analyzing, and acting on telemetry from your cloud and on-premises environments. This information helps you understand how your applications are performing and proactively identify issues affecting them and the resources they depend on.
With Azure Monitor, you can:
– Detect and diagnose issues across applications and dependencies with Application Insights.
– Correlate infrastructure issues with VM insights and Container insights.
– Drill into your monitoring data with Log Analytics for troubleshooting and deep diagnostics.
– Support operations at scale with smart alerts and automated actions.
– Create visualizations with Azure dashboards and workbooks.
– Collect data from monitored resources using Azure Monitor Metrics.
Metric alerts in Azure Monitor work on top of multi-dimensional metrics. These metrics could be platform metrics, custom metrics, popular logs from Azure Monitor converted to metrics, and Application Insights metrics.
Metric alerts evaluate at regular intervals to check if conditions on one or more metric time series are true and notify you when the evaluations are met. Metric alerts are stateful by default, that is, they only send out notifications when the state changes (fired, resolved).
You can alert on metrics and logs, as described in monitoring data sources. Signals include but aren’t limited to: Metric values
– Log search queries
– Activity log events
– Health of the underlying Azure platform
– Tests for website availability
Hence, the correct answer is: Azure Monitor.
Azure Bastion is incorrect because this is only a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.
Microsoft Defender for Cloud is incorrect because this service is simply a unified infrastructure security management system that strengthens the security posture of your data centers and provides advanced threat protection across your hybrid workloads in the cloud. It is not designed for sending alerts when certain VM metrics have been breached.
Azure Service Health is incorrect because this service is just a personalized dashboard in the Azure portal for receiving notifications, guidance, and technical support when Azure service issues, updates, or planned maintenance affect your Azure resources.
For each of the following items, choose Yes if the statement is true or choose No if the statement is false. Take note that each correct item is worth one point.
Questions Yes No 1. Azure network security groups can encrypt all the network traffic between your Azure resources and on-premises network via the public Internet.
- You can set up a Point-to-Site VPN connection that uses Internet Protocol Security (IPsec) to connect to your Azure virtual network using your home computer via the public Internet.
- Azure Firewall uses Internet Protocol Security (IPsec) to encrypt all the network traffic between your Azure resources and on-premises network via the public Internet.
- No
- Yes
- No
Explanation:
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It’s a fully stateful firewall-as-a-service with built-in high availability and unrestricted cloud scalability.
You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network. The service is fully integrated with Azure Monitor for logging and analytics.
You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.
A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet.
Hence, this statement is true: You can set up a Point-to-Site VPN connection that uses Internet Protocol Security (IPsec) to connect to your Azure virtual network using your home computer via the public Internet.
The statement that says: Azure Firewall uses Internet Protocol Security (IPsec) to encrypt all the network traffic between your Azure resources and on-premises network via the public Internet is incorrect because Azure Firewall doesn’t use IPSec and can’t be used to connect Azure resources and your on-premises network. It is just a fully stateful firewall-as-a-service that allows you to centrally create, enforce, and log application and network connectivity policies across subscriptions and Azure virtual networks.
The statement that says: Azure network security groups can encrypt all the network traffic between your Azure resources and on-premises network via the public Internet is incorrect because a network security group is primarily used to filter network traffic to and from Azure resources in an Azure virtual network. You have to establish a VPN connection if you need to connect between the Azure virtual network and your home computer via IPSec.
A company has several Azure resources across different regions. The support engineers need to manage the Azure cloud environments of the company using the Azure CLI.
Which tools below can the engineers use to install and run the Azure CLI? (Select TWO.)
Microsoft Entra Seamless SSO Azure Storage Explorer Azure Resource Explorer Windows PowerShell Windows Command Prompt (CMD)
Windows PowerShell
Windows Command Prompt (CMD)
Explanation:
The Azure command-line interface (Azure CLI) is a set of commands used to create and manage Azure resources. The Azure CLI is available across Azure services and is designed to get you working quickly with Azure, with an emphasis on automation.
Azure CLI capabilities make it easy to work with different programming languages and software environments. For example, Azure CLI:
– Is available to install in Windows, macOS, and Linux environments.
– Can also be run in Docker and Azure Cloud Shell.
– Offers command-line flexibility when managing an Azure solution.
– Supports long-running operations.
– Has the ability to use one subscription for all commands or vary subscriptions per command.
– Allows for querying of command-line results with query output returned in your format of choice.
– Has the flexibility to work with multiple clouds.
– Provides configurable settings for logging, data collection, and default argument values.
– Is deployed with Resource Manager deployment templates.
For Windows, the Azure CLI is installed via an MSI, which gives you access to the CLI through the Windows Command Prompt (CMD) or PowerShell. The packages are also available for your Linux distribution if you are using Windows Subsystem for Linux (WSL).
Hence, the correct answers are:
– Windows Command Prompt (CMD)
– Windows PowerShell
Microsoft Entra Seamless SSO is incorrect because you can’t use this service to run Azure CLI. It’s just an identity service that automatically signs users in when they are on their corporate devices connected to their corporate network.
Azure Storage Explorer is incorrect because this is simply a cross-platform, standalone application that you can use to manage your Azure cloud storage resources. It’s not capable of installing or running the Azure CLI.
Azure Resource Explorer is incorrect because this is primarily used to view the available Azure Resource Management APIs and make actual API calls directly to your own Azure subscriptions.
For security reasons, you need to recommend a solution that will automatically block new network security group security rules that contains port 22, 80 and 3389.
What should you include in your recommendation?
Azure Monitor Azure Service Trust Portal Azure Resource Manager Azure Policy
Azure Policy
Explanation:
Azure Policy helps to enforce organizational standards and to assess compliance at scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.
Policy evaluates resources in Azure by comparing the properties of resources to the business rules. These business rules, described in JSON format, are known as policy definitions. To simplify management, several business rules can be grouped together to form a policy initiative.
Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources. The assignment applies to all resources within the Resource Manager scope of that assignment. Subscopes can be excluded if necessary.
Hence, the correct answer is: Azure Policy.
Azure Monitor is incorrect because it just helps you understand how your applications are performing and proactively identifies issues affecting them and the resources they depend on. You cannot use this to block new security rules.
Azure Service Trust Portal is incorrect because this is simply Microsoft’s public site for publishing audit reports and other compliance-related information associated with Microsoft’s cloud services.
Azure Resource Manager is incorrect because it is used for the deployment and management service for Azure. It provides a management layer that enables you to create, update, and delete resources in your Azure account. You use management features, like access control, locks, and tags, to secure and organize your resources after deployment.
What is the customer responsible for when using a software as a service (SaaS) solution?
Installing its custom applications Configuring and using the provided cloud-based application Ensuring high availability of its applications. Ensuring the scalability of its cloud-based applications
Configuring and using the provided cloud-based application
Explanation:
Your company stores its media assets in a storage account located in the Singapore region.
You need to recommend a solution to ensure that if the Singapore region fails, the data can still be accessed. The solution should also be cost-effective.
Solution: Configure your storage account to use zone-redundant storage (ZRS) option.
Does this meet the goal?
No Yes
No
Explanation:
An Azure storage account contains all of your Azure Storage data objects: blobs, files, queues, tables, and disks. The storage account provides a unique namespace for your Azure Storage data that is accessible from anywhere in the world over HTTP or HTTPS. Data in your Azure storage account is durable and highly available, secure, and massively scalable.
Data in an Azure Storage account is always replicated three times in the primary region.
Geo-zone-redundant storage (GZRS) copies your data synchronously across three Azure availability zones in the primary region using ZRS. It then copies your data asynchronously to a single physical location in the secondary region.
The primary difference between GRS and GZRS is how data is replicated in the primary region. Within the secondary region, data is always replicated synchronously three times using LRS. LRS in the secondary region protects your data against hardware failures.
Take note, the requirements state that you need the media assets must be accessible if the Singapore region fails and that the solution must also be cost-effective. Although Geo-zone-redundant storage satisfies the requirement of data availability, it does not satisfy the requirement of cost-effectiveness because geo-zone-redundant storage is costlier than geo-redundant storage.
Hence, the correct answer is: No.
Your company stores its media assets in a storage account located in the Singapore region.
You need to recommend a solution to ensure that if the Singapore region fails, the data can still be accessed. The solution should also be cost-effective.
Solution: Configure your storage account to use geo-redundant storage (GRS) option.
Does this meet the goal?
Yes No
Yes
Explanation:
An Azure storage account contains all of your Azure Storage data objects: blobs, files, queues, tables, and disks. The storage account provides a unique namespace for your Azure Storage data that is accessible from anywhere in the world over HTTP or HTTPS. Data in your Azure storage account is durable and highly available, secure, and massively scalable.
Data in an Azure Storage account is always replicated three times in the primary region.
Geo-redundant storage (GRS) copies your data synchronously three times within a single physical location in the primary region using LRS. It then copies your data asynchronously to a single physical location in a secondary region that is hundreds of miles away from the primary region.
Take note, the requirements state that you need the media assets must be accessible if the Singapore region fails. With Geo-redundant storage, your media assets are stored in multiple availability zones and a secondary region. Remember, you can only use the secondary region when you initiate a failover. After the failover has been completed, the secondary region becomes the primary region, and you can again read and write data.
Hence, the correct answer is: Yes.
Which Azure service lets you provision Windows desktops that can host desktop applications in just a few minutes, scale easily and allow users to connect with any device over the internet?
Azure Batch Azure Dedicated Host Azure Virtual Desktop Azure Functions
Azure Virtual Desktop
Explanation:
Windows Virtual Desktop on Azure is a desktop and application virtualization service that runs on the cloud. It enables your users to use a cloud-hosted version of Windows from any location. Windows Virtual Desktop works across devices like Windows, Mac, iOS, Android, and Linux. It works with apps that you can use to access remote desktops and apps. You can also use most modern browsers to access Windows Virtual Desktop-hosted experiences.
Here’s what you can do when you run Windows Virtual Desktop on Azure:
– Set up a multi-session Windows 10 deployment that delivers a full Windows 10 with scalability
– Virtualize Microsoft 365 Apps for enterprise and optimize it to run in multi-user virtual scenarios
– Provide Windows 7 virtual desktops with free Extended Security Updates
– Bring your existing Remote Desktop Services (RDS) and Windows Server desktops and apps to any computer
– Virtualize both desktops and apps
– Manage Windows 10, Windows Server, and Windows 7 desktops and apps with a unified management experience
Users have the freedom to connect to Windows Virtual Desktop with any device over the Internet. They use a Windows Virtual Desktop client to connect to their published Windows desktop and applications. This client could either be a native application on the device or the Windows Virtual Desktop HTML5 web client.
You can provide individual ownership through personal (persistent) desktops. For example, you might want to provide personal remote desktops for members of an engineering team. Then they can add or remove programs without impacting other users on that remote desktop.
You can also quickly virtualize and deploy modern and legacy desktop applications to the cloud in minutes with unified management in the Azure portal.
Hence, the correct answer is: Azure Virtual Desktop.
Azure Functions is incorrect because this is just an event-driven, compute-on-demand service that extends the existing Azure application platform with capabilities to implement code triggered by events occurring in Azure or third-party service as well as on-premises systems.
Azure Dedicated Host is incorrect because this service simply provides physical servers that are able to host one or more virtual machines dedicated to a single customer.
Azure Batch is incorrect because this service only creates and manages a pool of compute nodes (virtual machines), installs the applications you want to run, and schedules jobs to run on the nodes.
You have an Azure subscription that contains multiple virtual machines.
You have been tasked with connecting your virtual network containing the virtual machines to your on-premises data center. Traffic must not pass through the public internet.
Solution: Create a virtual network peering.
No Yes
No
Explanation:
Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the Internet, and on-premises networks. VNet is similar to a traditional network that you’d operate in your own datacenter but brings with it additional benefits of Azure’s infrastructure such as scale, availability, and isolation.
ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Office 365.
Connectivity can be from an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a co-location facility. ExpressRoute connections do not go over the public Internet. This allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet.
Virtual network peering allows you to connect virtual networks to each other only. You won’t be able to connect your on-premises datacenter to Azure.
Hence, the correct answer is: No.
What service enables you to evaluate regulatory compliance as well as improve the compliance posture of your Azure environment?
Azure Blueprints Azure Advisor Microsoft Defender for Cloud Azure Policy
Microsoft Defender for Cloud
Explanation:
Microsoft Defender for Cloud is a tool for security posture management and threat protection. It strengthens the security posture of your cloud resources, and with its integrated Microsoft Defender plans, Defender for Cloud protects workloads running in Azure, hybrid, and other cloud platforms.
Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyberattacks, and streamline security management. Because it’s natively integrated, deployment of Defender for Cloud is easy, providing you with simple auto-provisioning to secure your resources by default.
With Microsoft Defender for Cloud, you can do the following:
– Evaluate your regulatory compliance using the Regulatory compliance dashboard
– Improve your compliance posture by taking action on recommendations
Microsoft Defender for Cloud helps streamline the process for meeting regulatory compliance requirements using the regulatory compliance dashboard. In the dashboard, Defender for Cloud provides insights into your compliance posture based on continuous assessments of your Azure environment. Defender for Cloud analyzes risk factors in your hybrid cloud environment according to security best practices.
Hence, the correct answer is: Microsoft Defender for Cloud.
Azure Advisor is incorrect because this service just analyzes your configurations and usage telemetry and offers personalized, actionable recommendations to help you optimize your Azure resources for reliability, security, operational excellence, performance, and cost.
Azure Blueprints is incorrect because this simply defines a repeatable set of Azure resources that implement and adhere to your organization’s standards, patterns, and requirements and rapidly build new environments with a set of built-in components to speed up development and delivery.
Azure Policy is incorrect because this service is primarily used to manage and prevent IT issues with policy definitions that enforce rules and effects for your resources.
You need to configure a network security group in your Azure subscription that restricts Remote Desktop Protocol access to your virtual machines.
Which resources can be attached to your network security group? (Select TWO.)
Subnet Route Table Virtual Network Network interface DNS servers
Subnet Network interface
Explanation:
Azure Network Security Group is used to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.
Network Security Groups can be attached to subnets and/or network interfaces. Unless you have a specific reason to, it is recommended that you associate a network security group to a subnet or a network interface, but not both. Since rules in a network security group associated with a subnet can conflict with rules in a network security group associated with a network interface, you can have unexpected communication problems that require troubleshooting.
It’s important to note that security rules in an NSG associated with a subnet can affect connectivity between virtual machines within it. For example, if a rule is added to NSG1 which denies all inbound and outbound traffic, VM1 and VM2 will no longer be able to communicate with each other. Another rule would have to be added specifically to allow this.
Hence, the correct answers are:
– Subnet
– Network Interface
Virtual Network, Route Table, and DNS Server are incorrect because you will not be able to attach these resources to a network security group. You can only attach a subnet and/or a network interface to your network security group.
A company has hundreds of virtual machines that are dispersedly hosted across multiple virtual networks and subscriptions. You are tasked to limit the amount of outbound HTTPS traffic to a specified list of fully qualified domain names (FQDN) as well as limit the inbound traffic to the virtual networks.
What must be done to satisfy the above requirement?
Integrate Azure Firewall to your network architecture. Integrate Azure virtual network TAP (Terminal Access Point) to your network architecture. Launch a single Azure ExpressRoute connection. Launch a single network security group.
Integrate Azure Firewall to your network architecture.
Explanation:
Azure Firewall is a managed, cloud-based network security service that protects your Azure Virtual Network resources. It’s a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
You can centrally create, enforce, and log application and network connectivity policies across subscriptions and virtual networks. Azure Firewall uses a static public IP address for your virtual network resources allowing outside firewalls to identify traffic originating from your virtual network. The service is fully integrated with Azure Monitor for logging and analytics.
The Azure Firewall service complements network security group functionality. Together, they provide better “defense-in-depth” network security. Network security groups provide distributed network layer traffic filtering to limit traffic to resources within virtual networks in each subscription. Azure Firewall is a fully stateful, centralized network firewall as-a-service, which provides network- and application-level protection across different subscriptions and virtual networks.
Hence, the correct answer is: Integrate Azure Firewall to your network architecture.
The option that says: Integrate Azure virtual network TAP (Terminal Access Point) to your network architecture is incorrect because this just allows you to continuously stream your virtual machine network traffic to a network packet collector or analytics tool.
The option that says: Launch a single Azure ExpressRoute connection is incorrect because this service is primarily used to create private connections between Azure and your on-premises network or in a colocation environment.
The option that says: Launch a single network security group is incorrect because a network security group simply provides a distributed network layer traffic filtering to limit traffic to resources within virtual networks in each subscription. Remember that it’s mentioned in the scenario that the virtual machines are dispersedly hosted across multiple virtual networks and subscriptions.
You were tasked to look for a document sharing solution that you can map or mount in your on-premises Windows servers. What Azure service should you use?
Azure Blob Azure Cosmos DB Azure Managed Disks Azure Files
Azure Files
Explanation:
Azure Files enables you to set up highly available network file shares that can be accessed by using the standard Server Message Block (SMB) protocol. That means that multiple VMs can share the same files with both read and write access. You can also read the files using the REST interface or the storage client libraries.
One thing that distinguishes Azure Files from files on a corporate file share is that you can access the files from anywhere in the world using a URL that points to the file and includes a shared access signature (SAS) token. You can generate SAS tokens; they allow specific access to a private asset for a specific amount of time.
File shares can be used for many common scenarios:
- Many on-premises applications use file shares. This feature makes it easier to migrate those applications that share data to Azure. If you mount the file share to the same drive letter that the on-premises application uses, the part of your application that accesses the file share should work with minimal, if any, changes.
- Configuration files can be stored on a file share and accessed from multiple VMs. Tools and utilities used by multiple developers in a group can be stored on a file share, ensuring that everybody can find them and that they use the same version.
- Resource logs, metrics, and crash dumps are just three examples of data that can be written to a file share and processed or analyzed later.
About Azure file share backup - Azure Backup | Microsoft Docs
The correct answer is: Azure Files.
Azure Cosmos DB is incorrect because this service is Microsoft’s globally distributed, multi-model database service for mission-critical applications.
Azure Managed Disks is incorrect because these are block-level storage volumes that are managed by Azure and used with Azure Virtual Machines. Managed disks are like a physical disk in an on-premises server but virtualized. However, this can’t be mounted to your on-premises servers, unlike Azure Files.
Azure Blob storage is incorrect because this service is an object storage solution for the cloud. Blob storage is optimized for storing massive amounts of unstructured data, such as text or binary data. Objects in Blob storage can be accessed from anywhere in the world via HTTP or HTTPS. You cannot mount this to your on-premises servers
Which Azure service provides recommendations on how you can optimize and improve the efficiency of your workloads by identifying idle and underutilized resources?
Azure Portal Azure Blueprints Azure Cost Management + Billing Azure Monitor
Azure Cost Management + Billing
Explanation:
Azure Cost Management + Billing is a suite of tools provided by Microsoft that help you analyze, manage, and optimize the costs of your workloads. Using the suite helps ensure that your organization is taking advantage of the benefits provided by the cloud.
With Azure products and services, you only pay for what you use. As you create and use Azure resources, you’re charged for the resources. Because of the deployment ease for new resources, the costs of your workloads can jump significantly without proper analysis and monitoring. You use Azure Cost Management + Billing features to:
– Conduct billing administrative tasks such as paying your bill
– Manage billing access to costs
– Download cost and usage data that was used to generate your monthly invoice
– Proactively apply data analysis to your costs
– Set spending thresholds
– Identify opportunities for workload changes that can optimize your spending
The ways that Cost Management helps you plan for and control your costs include:
– You use cost analysis to explore and analyze your organizational costs.
– Budgets help you plan for and meet financial accountability in your organization.
– Recommendations show how you can optimize and improve efficiency by identifying idle and underutilized resources.
Hence, the correct answer is: Azure Cost Management + Billing.
Azure Blueprints is incorrect because this only enables cloud architects and central information technology groups to define a repeatable set of Azure resources that implements and adheres to an organization’s standards, patterns, and requirements. It is not capable of analyzing your Azure spending, unlike Azure Cost Management + Billing.
Azure Portal is incorrect because this is simply a web-based, unified console that provides an alternative to command-line tools that you can use to access Azure Cost Management + Billing service.
Azure Monitor is incorrect because this service primarily helps you understand how your applications are performing and proactively identifies issues affecting them and the resources they depend on. You cannot use this to show recommendations on how to optimize your Azure spending.
Your on-premises Active Directory forest currently has 3000 users.
You plan to decommission the on-premises server that hosts the Active directory. You need to recommend a solution to migrate the users the quickest way to Microsoft Entra ID with minimal impact on users.
What should you recommend?
Implement Azure Multi-Factor Authentication. Manually create the users in Microsoft Entra ID. Migrate the on-premises Active Directory server to Azure virtual machines. Sync the on-premises Active Directory to Microsoft Entra ID using Microsoft Entra connect.
Sync the on-premises Active Directory to Microsoft Entra ID using Microsoft Entra connect.
Explanation:
Microsoft Entra ID is Microsoft’s cloud-based identity and access management service, which helps your employees sign in and access resources in:
– External resources, such as Microsoft Office 365, the Azure portal, and thousands of other SaaS applications.
– Internal resources, such as apps on your corporate network and intranet, along with any cloud apps developed by your own organization.
Microsoft Online business services, such as Office 365 or Microsoft Azure, require Microsoft Entra ID for sign-in and to help with identity protection. If you subscribe to any Microsoft Online business service, you automatically get Microsoft Entra ID with access to all the free features.
Microsoft Entra ID Connect installs an on-premises service that orchestrates synchronization between your on-premises Active Directory and Microsoft Entra ID. The Microsoft Entra ID Sync synchronization service (ADSync) runs on a server in your on-premises environment. The credentials for the service are set by default in the Express installations but may be customized to meet your organizational security requirements. These credentials are not used to connect to your on-premises forests or Microsoft Entra ID.
Hence, the correct answer is: Sync the on-premises Active Directory to Microsoft Entra ID using Microsoft Entra connect.
Manually creating the users in Microsoft Entra ID is incorrect because this will be a time-consuming process. Take note that the scenario is looking for a solution that will allow the company to migrate its Active Directory to Azure the quickest way.
Implementing Azure Multi-Factor Authentication is incorrect because this is just a process where a user is prompted during the sign-in process for an additional form of identification, such as to enter a code on their cellphone or to provide a fingerprint scan. It is not capable of syncing on-premises Active Directory to Microsoft Entra ID.
Migrating the on-premises Active Directory server to Azure virtual machines is incorrect because the scenario states that the users must be migrated to Microsoft Entra ID and not to Azure virtual machines. Migrating the on-premises active directory to the Azure virtual machine will not meet the scenario’s requirements.
