Correct Answer: AD

Cost control is a critical component to maximizing the value of your investment in the cloud.

Budgets are commonly used as part of cost control. Budgets can be scoped in Azure. For instance, you could narrow your budget view based on subscription, resource groups, or a collection of resources.

- Create an Azure Automation Runbook to stop VMs by using webhooks.

- Create an Azure Logic App to be triggered based on the budget threshold value and call the runbook with the right parameters.

- Create an Azure Monitor Action Group that will be configured to trigger the Azure Logic App when the budget threshold is met.

- Create the Azure budget with the wanted thresholds and wire it to the action group.

Incorrect Answers:

B. Azure Monitor alerts

Alerts proactively notify you when issues are found with your infrastructure or application using your monitoring data in Azure Monitor. They allow you to identify and address issues before the users of your system notice them. It is not required to trigger the logic app.

C. the spending limit of an Azure account

The spending limit in Azure prevents spending over your credit amount. When your usage results in charges that exhaust your spending limit, the services that you deployed are disabled for the rest of that billing period.

E. Azure Log Analytics alerts

Log alerts allow users to use a Log Analytics query to evaluate resources logs every set frequency, and fire an alert based on the results.

Reference:

https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/cost-management-budget-scenario

Correct Answer: A

You can create up to three parallel connections to stream diagnostic telemetry.

Platform logs and metrics can be sent to the destinations Log Analytics workspace, Event hubs, Azure storage account Only difference Azure storage account is referred for Archiving logs and metrics.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal

Correct Answer: A

Platform logs and metrics can be sent to the destinations Log Analytics workspace, Event hubs, Azure storage account Only difference Azure storage account is referred for Archiving logs and metrics.

Note: Diagnostic settings are used to configure streaming export of platform logs and metrics for a resource to the destination of your choice. You may create up to five different diagnostic settings to send different logs and metrics to independent destinations.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal

Correct Answer: A

Sending logs to Event Hubs allows you to stream data to external systems such as third-party SIEMs and other log analytics solutions.

Note: A single diagnostic setting can define no more than one of each of the destinations. If you want to send data to more than one of a particular destination type (for example, two different Log Analytics workspaces), then create multiple settings. Each resource can have up to 5 diagnostic settings.

Note: Diagnostic settings are used to configure streaming export of platform logs and metrics for a resource to the destination of your choice. You may create up to five different diagnostic settings to send different logs and metrics to independent destinations.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostic-settings

https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal

Correct Answer: D

You can stream Azure SQL Database and Azure SQL Managed Instance metrics and resource logs into Event Hubs by using the built-in Stream to an event hub option in the Azure portal. You also can enable the Service Bus rule ID by using diagnostics settings via PowerShell cmdlets, the Azure CLI, or the Azure Monitor REST API.

After the selected data is streamed into Event Hubs, you're one step closer to enabling advanced monitoring scenarios. Event Hubs acts as the front door for an event pipeline. After data is collected into an event hub, it can be transformed and stored by using a real-time analytics provider or a storage adapter. Event Hubs decouples the production of a stream of events from the consumption of those events. In this way, event consumers can access the events on their own schedule.

By using Event Hubs, Stream Analytics, and Power BI, you can easily transform your metrics and diagnostics data into near real-time insights on your Azure services.

Incorrect Answers:

A. clear Send to Log Analytics

No need to clear log analytics.

B. clear SQLInsights

No need to clear SQLInsights.

C. select Archive to a storage account

It is used to archive logs in Azure storage accounts for a long time.

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-streaming-export-configure?tabs=azure-portal#stream-into-event-hubs

Correct Answer: C

Azure SQL Analytics is an advanced cloud monitoring solution for monitoring performance of all of your Azure SQL databases at scale and across multiple subscriptions in a single view. Azure SQL Analytics collects and visualizes key performance metrics with built-in intelligence for performance troubleshooting.

By using these collected metrics, you can create custom monitoring rules and alerts. Azure SQL Analytics helps you to identify issues at each layer of your application stack. It uses Azure Diagnostic metrics along with Azure Monitor views to present data about all your Azure SQL databases in a single Log Analytics workspace. Azure Monitor helps you to collect, correlate, and visualize structured and unstructured data.

Incorrect Answers:

A. Azure Analysis Services

Azure Analysis Services is a fully managed platform as a service (PaaS) that provides enterprise-grade data models in the cloud.

B. Azure Application Insights

Application Insights is an extensible Application Performance Management (APM) service for developers and DevOps professionals. Use it to monitor your live applications. It will automatically detect performance anomalies, and includes powerful analytics tools to help you diagnose issues and to understand what users actually do with your app.

D. Microsoft SQL Server Analysis Services (SSAS)

Analysis Services is an analytical data engine (VertiPaq) used in decision support and business analytics. It provides enterprise-grade semantic data models for business reports and client applications such as Power BI, Excel, Reporting Services reports, and other data visualization tools.

Installed as an on-premises server instance, SQL Server Analysis Services supports tabular models at all compatibility levels (depending on version), multidimensional models, data mining, and Power Pivot for SharePoint.

E. SQL Health Check

You can use the SQL Health Check solution to assess the risk and health of your server environments on a regular interval.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/insights/azure-sql

Correct Answer: D

Managed identities for Azure resources is a feature of Azure Active Directory.

User-assigned managed identity can be shared. The same user-assigned managed identity can be associated with more than one Azure resource.

There are two types of managed identities:

System-assigned Some Azure services allow you to enable a managed identity directly on a service instance. When you enable a system-assigned managed identity an identity is created in Azure AD that is tied to the lifecycle of that service instance. So when the resource is deleted, Azure automatically deletes the identity for you. By design, only that Azure resource can use this identity to request tokens from Azure AD.

User-assigned You may also create a managed identity as a standalone Azure resource. You can create a user-assigned managed identity and assign it to one or more instances of an Azure service. In the case of user-assigned managed identities, the identity is managed separately from the resources that use it.

Incorrect Answers:

A. a service principal that is configured to use a certificate

It is used to authenticate to an application registered with Azure AD.

B. a system-assigned managed identity

System-assigned managed identity cannot be shared. It can only be associated with a single Azure resource.

C. a service principal that is configured to use a client secret

It is used to authenticate to an application registered with Azure AD.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Correct Answer: ABD

Azure Policy evaluates resources in Azure by comparing the properties of those resources to business rules. Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources.

An assignment is a policy definition or initiative that has been assigned to take place within a specific scope. This scope could range from a management group to an individual resource. The term scope refers to all the resources, resource groups, subscriptions, or management groups that the definition is assigned to. Assignments are inherited by all child resources. This design means that a definition applied to a resource group is also applied to resources in that resource group. However, you can exclude a subscope from the assignment.

For example, at the subscription scope, you can assign a definition that prevents the creation of networking resources. You could exclude a resource group in that subscription that is intended for networking infrastructure. You then grant access to this networking resource group to users that you trust with creating networking resources.

Reference:

https://docs.microsoft.com/en-us/azure/governance/policy/overview

Correct Answer: B

One option is to deploy APIM (API Management) inside the cluster VNet.

The AKS cluster and the applications that consume the microservices might reside within the same VNet, hence there is no reason to expose the cluster publicly as all API traffic will remain within the VNet. For these scenarios, you can deploy API Management into the cluster VNet. API Management Premium tier supports VNet deployment.

Incorrect Answers:

A. Azure App Gateway with Azure Web Application Firewall (WAF)

App Gateway does not support rate limiting.

C. Azure API Management Standard tier with a service endpoint

The AKS cluster and the applications that consume the microservices might reside within the same VNet. API Management Premium tier supports VNet deployment and rate limiting.

D. Azure Front Door with Azure Web Application Firewall (WAF)

Azure Front Door is a load balancing solution. It provides a range of traffic-routing methods and backend health monitoring options to suit different application needs and automatic failover scenarios.

Reference:

https://docs.microsoft.com/en-us/azure/api-management/api-management-kubernetes

Correct Answer: B

IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-premises Active Directory environment in preparation for migration to Azure Active Directory. IdFix is intended for the Active Directory administrators responsible for directory synchronization with Azure Active Directory.

Incorrect Answers:

A. Azure AD Connect Health

Azure Active Directory (Azure AD) Connect Health provides robust monitoring of your on-premises identity infrastructure. It enables you to maintain a reliable connection to Microsoft 365 and Microsoft Online Services.

C. Azure Advisor

Advisor is a personalized cloud consultant that helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost effectiveness, performance, Reliability (formerly called High availability), and security of your Azure resources.

D. Password Export Server version 3.1 (PES v3.1) in Active Directory Migration Tool (ADMT)

The Password Export Server version 3.1 (PES v3.1), x64 package, enables password migrations during account migrations in an Active Directory Domain Services infrastructure.

Reference:

https://github.com/Microsoft/idfix