Microsoft Azure Fundamentals Exam Flashcards

Question

What is a Route Based VPN type?

Answer 1

VPN type lets routing/forwarding tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface).

Answer 2

Allows you to create private connections between Azure datacenters and infrastructure on your premises or in a colocation environment. ExpressRoute connections don't go over the public internet, and they offer more reliability, faster speeds, and lower latencies than typical internet connections.

Answer 3

1. Network Virtual Appliances | 2. Network Security Groups

Answer 4

A network security group is an Azure resource that can contain multiple inbound and outbound security rules. You can define these rules to allow or block traffic, based on factors such as source and destination IP address, port, and protocol.

Answer 5

1. Name - You must provide a name for the virtual network. 2. Subscription - All resources must be associated with a valid subscription. 3. Resource Group - All resources must be associated with a resource group.

Answer 6

1. Cloud Exchange colocation 2. Point-to-point Ethernet Connection 3. Any-to-any (IPVPN) Connection 4. ExpressRoute Direct

Answer 7

You use service endpoints to connect to other Azure resource types, such as Azure SQL databases and storage accounts. This approach enables you to link multiple Azure resources to virtual networks, thereby improving security and providing optimal routing between resources.

Answer 8

A network virtual appliance is a specialized VM that can be compared to a hardened network appliance. A network virtual appliance carries out a particular network function, such as running a firewall or performing Wide Area Network (WAN) optimization.

Answer 9

Combinations of address prefixes from both networks control how traffic is encrypted and decrypted through the VPN tunnel. The source and destination of the tunneled networks are declared in the policy and don't need to be declared in routing tables.

Answer 10

Co-located providers can normally offer both Layer 2 and Layer 3 connections between your infrastructure, which might be located in the colocation facility, and the Microsoft cloud.

Answer 11

Point-to-point Ethernet providers can offer Layer 2 connections, or managed Layer 3 connections between your site and the Microsoft cloud.

Answer 12

1. Virtual network 2. Virtual network gateway 3. Public IP address - You must create a Basic-SKU dynamic public IP address if using a non-zone-aware gateway. This address provides a public-routable IP address as the target for your on-premises VPN device.

Answer 13

a platform for making predictions. It consists of tools and services that allow you to connect to data, to train and test models, to find one that would most accurately predict a future result. After you've run experiments to test the model, you can deploy and use it in real time via a web API endpoint. With Azure Machine Learning, you can build a process that defines how to obtain data, how to handle missing or bad data, how to split the data into either a training session, or test set, and deliver the data to the training process. *Azure Machine Learning requires you to bring your own data and train models over that data

Answer 14

Used to solve general problems such as analyzing text for emotional sentiment, or analyzing images to recognize objects or faces. You don't need special machine learning or data science knowledge to use the services. Developers access Azure Cognitive Services via APIs and can easily include these features in just a few lines of code. Azure Cognitive Services, for the most part, provides pre-trained models so that you can bring in your live data to get predictions on.

Answer 15

1. Language Services - process natural language with pre-built scripts. 2. Speech services - converts speech into text and text into natural sounding speech. Translate from one language to another and enables speaker verification and recognition. 3. Vision services - add recognition and identification capabilities when you're analyzing pictures, videos, and other visual content. 4. Decision services - add personalized recommendations for each user that automatically improve each time they're used. Moderate content to monitor and remove offensive or risky content.

Answer 16

Choose Azure Machine Learning when your data scientists need complete control over the design and training of an algorithm using your own data. Second, Azure Cognitive Services provide pre-built machine learning models that enable applications to see, hear, speak, understand, and even begin to reason.

Answer 17

platforms for creating virtual agents that understand and reply to questions just like a human. Azure Bot Service is a bit different from Azure Machine Learning and Azure Cognitive Services, in that, it has a specific use case. Namely, it creates a virtual agent that can intelligently communicate with humans. Behind the scenes, the bot you build uses other Azure services, such as Azure Cognitive Services to understand what their human counterparts are asking for.

Answer 18

Bots can be used to shift simple repetitive tasks such as taking dinner reservations, or gathering profile information onto automated systems that might no longer require direct human intervention. Users converse with a bot by using text, interactive cards, and speech. A bot interaction can be a quick question and answer, or it can be as sophisticated conversation that intelligently provides access to services.

Answer 19

A. Azure Bot Service - creates virtual agent solutions that utilize natural language and is a cost-effective option.

Answer 20

A. Machine Learning

Answer 21

B. The ability to add recognition and identification capabilities when analyzing pictures, videos, and other visual content. D. The ability to convert speech into text and text into natural-sounding speech. Translate from one language to another and enable speaker verification and recognition.

Answer 22

C. Azure Machine Learning

Answer 23

A. Azure Cognitive Services

Answer 24

Azure boards is an agile project management suite that includes Kanban boards, reporting and tracking ideas, and work from high-level epics to work items and issues. Like Kanban boards, it visually displays work at various stages of a process.

Answer 25

A suite of services that address every stage of the software development life cycle. Azure DevOps is a centralized source code repository where software development, DevOps, Engineering, and documentation professionals can publish their code for review and collaboration.

Answer 26

Azure Pipelines is a continuous integration and continuous delivery pipeline automation tool. As your test plans is an automated test tool that can be used in a CICD pipeline to ensure quality before a software release. As your artifacts is a repository for hosting artifacts such as compiled source code, which can be fed into testing or Deployment Pipeline steps.

Answer 27

*helps organizations to manage the VMs that developers and testers need to ensure a new app works across various operating systems. Azure DevTest Labs provides an automated means of managing the process of building, setting up, and tearing down virtual machines that contain bills of your software projects. *Anything you can deploy in Azure VM, Azure Resource Manager template can be provisioned through DevTest Labs.

Answer 28

B. Azure DevOps Services

Answer 29

B. Azure DevOps Services

Answer 30

A. GitHub and GitHub Actions - With GitHub, your company can publish its code, accept community contributions to improve the code examples, accept feedback, and bug reports. Because this scenario involves open-source code, GitHub is a leading candidate.

Answer 31

Azure Advisor evaluates your Azure resources and makes recommendations to help improve reliability, security, and performance, achieve operational excellence, and reduce costs. It is not used to set up alerts for outages

Answer 32

A. Azure Monitor

Answer 33

B. Azure Service Health

Answer 34

C. Azure Advisor

Answer 35

B. Azure Advisor

Answer 36

each individual step should be performed to achieve a desired outcome.

Answer 37

only a desired outcome, and it allows an interpreter to decide how to best achieve that outcome. This distinction is important because tools that are based on declarative code can provide a more robust approach to deploying dozens or hundreds of resources simultaneously and reliably.

Answer 38

Azure Portal Given the requirement to view data visually and create custom reports the Azure portal is the best choice. You can quickly find answers to questions using a range of reporting options.

Answer 39

Azure Mobile App The Azure mobile app running on a phone or tablet could help key employees keep an eye on the health of the cloud environment. The Azure mobile app is a good compromise in this scenario, it allows employees the freedom to be away from the office while still being able to perform one-off management and administrative tasks.

Answer 40

Azure CLI is more beneficial to those with a Linux administration and scripting background who wish to perform one-off management or administrative actions.

Answer 41

Azure Functions and Azure Logic Apps

Answer 42

You are concerned only with the code that's running your service and not the underlying platform or infrastructure. You use functions most commonly when you need to perform work in response to an event. You do this often via a rest request, timer, or message from another Azure service and when that work can be completed quickly within seconds or less.

Answer 43

A low code development platform hosted as a cloud service. This service helps you automate and orchestrate tasks, business processes, and workflows when you need to integrate apps, data, systems, and services across enterprises or organizations. Logic Apps simplifies how you design and build scalable solutions, whether in the cloud, on-premises, or both. This solution covers app integration, data integration, system integration, enterprise application integration, and business-to-business integration. Azure Logic Apps is designed in a web-based designer and can execute a logic that's triggered by Azure services without your having to write any code, you build an app by linking triggers to actions with connectors. There are logic actions, such as those you would find in most programming languages. Examples of actions include working with variables, decision statements, and loops, and tasks that parse and modify data. To build enterprise integration solutions with Azure logic apps, you can choose from a growing gallery of over 200 connectors. The gallery includes services such as Salesforce, SAP, Oracle DB, and file shares.

Answer 44

FALSE *There is a server (or a group of servers) that execute your code or desired functionality. The key idea is that you are not responsible for setting up or maintaining that server. You don't have to worry about scaling the server or dealing with outages. The cloud vendor takes care of all the maintenance and scaling concerns for you.

Answer 45

FALSE *Serverless computing is used to handle backend scenarios. It is responsible for sending messages from one system to another, or processing messages that were sent from other systems. It's not used for end-user facing systems.

Answer 46

Azure Functions

Answer 47

Azure Logic Apps

Answer 48

Azure Functions allows you to host a single method or function using a popular programming language in the cloud that runs in response to an event such as an HTTP request, a new message on a queue, or on a timer.

Answer 49

A managed service that's hosted in the cloud and that acts as a central message hub for bidirectional communication between your IoT application and the devices it manages. You can use Azure IoT Hub to build IoT solutions with reliable and secure communications between millions of IoT devices and a cloud-hosted solution back-end. You can connect virtually any device to your IoT Hub. The IoT Hub service supports communications both from the device to the cloud and from the cloud to the device. It also supports multiple messaging patterns, such as device-to-cloud telemetry, file upload from devices, and request to reply methods to control your devices from the cloud. After an IoT Hub receives messages from a device, it can route that message to other Azure services. From a cloud-to-device perspective, IoT Hub allows for Command and Control. That is, you can have either manual or automated remote control of connected devices so you can instruct the device to open valves, set target temperatures, restart stuck devices, and so on. IoT Hub monitoring helps you maintain the health of your solution by tracking events such as device creation, device failures, and device connections.

Answer 50

builds on top of IoT Hub by adding a dashboard that allows you to connect, monitor, and manage your IoT devices. The visual user interface makes it easy to quickly connect new devices and watch as they begin sending telemetry or messages. You can watch the overall performance across all devices in aggregate. You can set up alerts that send notifications when a specific device needs maintenance. Finally, you can push hardware updates to the device. To help you get up and running quickly, IoT Central provides starter templates for common scenarios across various industries, such as retail, energy, healthcare, and government. You then customize the design starter templates directly in the UI by choosing from existing themes or creating your own custom theme, setting the logo, and so on. With IoT Central, you can tailor the starter templates for the specific data that's sent from your devices, the reports you want to see, and the alerts you want to send. You can use the UI to control your devices remotely. This feature allows you to push a software update or modify a property of the device. You can adjust the desired temperature for one or all of your refrigerated vending machines from directly inside of IoT Central. A key part of IoT Central is the use of device templates. By using a device template, you can connect a device without any service site coding. IoT central uses the templates to construct the dashboards, alerts, and so on. Device developers still need to create code to run on the devices, and that code must match the device template specification.

Answer 51

Azure Sphere creates an end-to-end, highly secure IoT solution for customers that encompasses everything from the hardware and operating system on the device to the secure method of sending messages from the device to the message hub. Azure Sphere has built-in communication and security features for internet-connected devices. Azure Sphere comes in three parts. The first part is the Azure Sphere Micro-controller Units, or MCU, which is responsible for processing the operating system and signals from attached sensors. This image displays the Seed Azure Sphere MT3620 Development Kit MCU, one of several different starter kits that are available for prototyping and developing Azure Sphere applications. The second part is a customized Linux Operating System that handles communication with the security service and can run the vendor's software. The third part is Azure Sphere Security Service, also known as AS3. Its job is to make sure that the device has not been maliciously compromised. AS3 is Microsoft's cloud-based service that communicates with Azure Sphere chips to enable maintenance, update, and control. When the device attempts to connect to Azure, it first must authenticate itself per device, which it does by using certificate-based authentication. If it authenticates successfully, AS3 checks to ensure that the device hasn't been tampered with. After it has established a secure channel of communication, AS3 pushes any OS or approved customer-developed software updates to the device. After the Azure Sphere system has validated the authenticity of the device and authenticated it, the device can interact with other Azure IoT services by sending telemetry and other information.

Answer 52

TRUE - As we mentioned previously, Azure Sphere ensures a secure channel of communication between the device and azure by controlling everything from the hardware to the operating system and the authentication process. This ensures that the integrity of the devices uncompromised. After a secure channel is established, messages can be received from the device securely and messages air software updates can be sent to the device remotely.

Answer 53

TRUE - Programmers can still create a customized set of management tools and reports by using the IoT Hub Rest ful, API.

Answer 54

Azure Sphere creates an end-to-end highly secure IoT solution for customers that encompasses everything from the hardware and operating system on the device, to the secure method of sending messages from the device to the message hub.

Answer 55

Azure IoT Hub is the best choice in this scenario. It is a managed service hosted in the cloud that acts as a central message hub for bi-directional communication between your IoT application and the devices it manages. You can connect virtually any device to your IoT Hub.

Answer 56

TRUE It would make sense to copy existing logic written in C#, from the Windows Service and port it to an Azure Function. It's possible that the same logic could be implemented in Azure Logic Apps. However, since the service already exists in C#, it can be leveraged for use in an Azure Function.

Answer 57

Azure Security Center is a monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises. The term security posture refers to cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats. Provide security recommendations that are based on your current configurations, resources, and networks. Continuously monitor your resources and perform automatic security assessments to identify potential vulnerabilities before those vulnerabilities can be exploited.

Answer 58

TRUE You can also use adaptive application controls to define rules that list allowed applications to ensure that only applications you allow can run.

Answer 59

A SIEM system aggregates security data from many different sources as long as those sources support an open standard logging format. It also provides capabilities for threat detection and response.

Answer 60

Azure sentinel is Microsoft's cloud-based SIEM system, it uses intelligence security analytics and threat analysis Azure sentinel enables you to collect cloud data at scale across all users, devices, applications, and infrastructure both on-premises and from multiple clouds. Detect previously undetected threats while minimizing false positives by using Microsoft's Comprehensive Analytics and Threat Intelligence. Investigate threats with artificial intelligence and examined suspicious activities at scale.

Answer 61

Azure Key Vault is a centralized cloud service for storing application secrets in a single central location. It provides secure access to sensitive information by providing access control and logging capabilities. Azure Key Vault can help you manage secrets. You can use Key Vault to securely store and tightly control access to tokens, passwords, certificates, API keys, and other secrets. Manage encryption keys, you could use Key Vault as a key management solution. Key Vault makes it easier to create and control the encryption keys that are used to encrypt your data. Manage SSL/TLS certificates, Key Vault enables you to provision, manage, and deploy your public and private secure sockets layer, transport layer security, or SSL/TLS certificates for both your Azure resources and your internal resources.

Answer 62

1. Centralizing the storage for your application's secrets enables you to control their distribution and reduces the chances that secrets are accidentally leaked. 2. Securely stores secrets and keys: Azure uses industry-standard algorithms, key lengths, and HSMs. Access to Key Vault requires proper authentication and authorization. 3. Access monitoring and access control: by using Key Vault, you can monitor and control access to your application secrets. 4. Simplified administration of application secrets: Key Vault makes it easier to enroll and renew certificates from public certificate authorities, RCAs. You can also scale up and replicate content within regions and use standard certificate management tools. 5. Integration with other Azure services: you can integrate key vault with storage accounts, container registries, event hubs, and many more Azure services. These services can then securely reference the secrets stored in Key Vault.

Answer 63

TRUE A dedicated host is mapped to a physical server in an Azure data center, and a host group is a collection of dedicated hosts.

Answer 64

Azure Security Center is a monitoring service that provides visibility of your security posture across all your services on Azure and on-premises.

Answer 65

Implement an application control rule in Azure Security Center. With Azure Security Center, you can define a list of allowed applications to ensure that only applications you allow can run. Azure Security Center can also detect and block malware from being installed on your VMs.

Answer 66

Azure Sentinel Azure Sentinel is Microsoft's cloud based SIEM solution and can combine and report on security data from different sources

Answer 67

Configure the VM’s to run on Azure Dedicated Host. By default, virtual machines (VMs) on Azure run on shared hardware that's managed by Microsoft. Although the underlying hardware is shared, VM workloads are isolated from workloads being run by other Azure customers. However, some organizations must follow regulatory compliance that requires them to be the only customer using the physical machine that hosts their virtual machines. Azure Dedicated Host provides dedicated physical servers to host your Azure VMs for Windows and Linux.

Answer 68

The objective of defense and depth is to protect information and prevent it from being stolen by those who aren't authorized to access it. A defense and death strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data. Each layer provides protection, so that if one layer is breached, a subsequent layer is already in place to prevent further exposure. This approach removes reliance on any single layer of protection. It slows down an attack and provides alert telemetry that security teams can act upon either automatically or manually. Play video starting at ::58 and follow transcript0:58 The physical security layer is the first line of defense to protect computing hardware in the data center. The identity and access layer controls access to infrastructure and change control. The perimeter layer uses distributed denial of service protection to filter large scale attacks before they can cause a denial of service for users. The network layer limits communication between resources through segmentation and access controls. The compute layer secures access to virtual machines. The application layer helps ensure that applications are secure and free of security vulnerabilities. And the data layer controls access to business and customer data that you need to protect. These layers provide a guideline for you to help make security configuration decisions in all of the layers of your applications. Azure provides security tools and features at every level of the defense and death concept. Let's take a closer look at each layer.

Answer 69

1. physical security layer 2. identity and access layer 3. perimeter layer 4. network layer 5. compute layer 6. application layer 7. data layer These layers provide a guideline for you to help make security configuration decisions in all of the layers of your applications. Azure provides security tools and features at every level of the defense and death concept.

Answer 70

The objective is to protect information and prevent it from being stolen by those who aren't authorized to access it. A defense and death strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data. Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure. This approach removes reliance on any single layer of protection. It slows down an attack and provides alert telemetry that security teams can act upon either automatically or manually.

Answer 71

The physical security layer is the first line of defense to protect computing hardware in the data center. Physically securing access to buildings and controlling access to computing hardware within the data center, are the first line of defense. With physical security, the intent is to provide physical safeguards against access to assets. These safeguards ensure that other layers can be bypassed and last or theft is handled appropriately.

Answer 72

The identity and access layer controls access to infrastructure and change control. At the identity and access layer, it's important to control access to infrastructure and change control. Use single sign on, and multi factor authentication and ordered events and changes.

Answer 73

The perimeter layer uses distributed denial of service protection to filter large scale attacks before they can cause a denial of service for users. At the perimeter layer, it's important to use DDoS protection to filter large-scale attacks before they can affect the availability of a system for users. Use perimeter firewalls to identify an alert on malicious attacks against your network at the network perimeter.

Answer 74

The network layer limits communication between resources through segmentation and access controls. At the network layer, it's important to limit communication between resources, deny by default, restrict inbound Internet access and limit outbound access where appropriate, and implement secure connectivity to on-premises networks. At this layer, the focuses on limiting the network connectivity across all your resources to allow only what's required. By limiting this communication, you reduce the risk of an attack spreading to other systems in your network.

Answer 75

The compute layer secures access to virtual machines. At the compute layer, it's important to secure access to virtual machines and implement in-point protection on devices and keep systems patched and current malware unpatched systems and improperly secured systems. Open your environment to attacks. The focus in this layer is on making sure that your compute resources are secure and that you have the proper controls in place to minimize security issues.

Answer 76

The application layer helps ensure that applications are secure and free of security vulnerabilities. It's important to ensure that applications are secure and free of vulnerabilities, store sensitive application secrets in a secure storage medium makes security a design requirement for all application development. Integrating security into the application development lifecycle helps reduce the number of vulnerabilities introduced in cold. Every development team should ensure that its applications are secure by default. In almost all cases, Attackers are after data stored in a database stored on disk inside virtual machines stored in software as a service.

Answer 77

And the data layer controls access to business and customer data that you need to protect. Those who store and control access to data are responsible for ensuring that it's properly secured. Often, regulatory requirements dictate the controls and processes that must be in place to ensure the confidentiality, integrity, and availability of the data - common principles used to define a security posture (CIA). Integrity prevents unauthorized changes to information at rest when it's stored and in transit when it's being transferred from one place to another, including from a local computer to the cloud.

Answer 78

A Firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules. You can create firewall rules that specify ranges of IP addresses. Azure Firewall is a managed cloud-based network security service that helps protect resources in your Azure virtual networks. Azure Firewall is a Stateful Firewall. A Stateful Firewall analyzes the complete context of a network connection, not just an individual package of network traffic. Azure Firewall features high availability and unrestricted cloud scalability. Azure Firewall provides a central location to create, enforce and log application and network connectivity policies across subscriptions and virtual networks. It uses a static, unchanging public IP address for your virtual and network resources, which enables outside Firewalls to identify traffic coming from your virtual network. The service is integrated with Azure Monitor to enable logging and analytics. You typically deploy Azure Firewall on a central virtual network to control general network access.

Answer 79

1. built-in high availability 2. unrestricted cloud scalability 3. inbound and outbound filtering rules 4. inbound destination network address translation or DNAT support 5. Azure Monitor logging

Answer 80

Network rules define source, address, protocol, destination port, and destination address.

Answer 81

NAT defines destination IP addresses and ports to translate inbound requests.

Answer 82

Azure DDoS Protection helps protect your Azure resources from DDoS attacks. DDoS protection uses the scale and elasticity of Microsoft's global network to bring DDoS mitigation capacity to every Azure region. The DDoS Protection Service helps protect your azure applications by analyzing and discarding DDoS traffic at the azure network edge before it can affect your services availability.

Answer 83

DDoS attack attempts to overwhelm and exhaust an application's resources, making the application slow or unresponsive to legitimate users. DDoS attacks can target any resource that's publicly reachable through the Internet, including websites. When you combine DDoS protection with recommended application design practices, you help provide a defense against DDoS attacks.

Answer 84

A network security group enables you to filter network traffic to and from Azure resources within an Azure virtual network. You can think of in NSGs like an internal firewall. An NSG can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by source and destination IP address, port and protocol. A network security group can contain as many rules as you need within Azure subscription limits. When you create a network security group, Azure creates a series of default rules to provide a baseline level of security. You can't remove the default rules, but you can overwrite them by creating new rules with higher priorities.

Answer 85

1. The Standard service tier provides additional mitigation capabilities that are tuned specifically to Azure Virtual Network resources. The Standard tier also provides always-on traffic monitoring and real-time mitigation of common network-level attacks. 2. The Basic service tier is automatically enabled for free as part of your Azure subscription. Always-on traffic monitoring and real-time mitigation of common network-level attacks provide the same defenses that Microsoft's online services use. The Basic service tier ensures that Azure infrastructure itself is not impacted during a large-scale DDoS attack. Azure's global network is used to distribute and mitigate attack traffic across Azure regions.

Answer 86

Network Security Groups - enables you to filter network traffic to and from Azure resources within an Azure Virtual Network. Azure firewall is a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules.

Answer 87

Azure Firewall

Answer 88

Secure Score

Answer 89

Authentication, which is sometimes referred to as AuthN, is the process of establishing the identity of a person or service that wants to access a resource. It involves a process of call and response where the end-user or service is challenged for a set of credentials. These credentials are then used as the basis to create a security principle, and this security principle is used to establish the user's Identity and Access Control. You can think of this as the digital version of a person showing an identity card to a doorman prior to being granted access to an office building. By using authentication, you can establish whether the user is who they say they are.

Answer 90

Sometimes referred to as AuthZ, authorization is the process of establishing what level of access an authenticated person or service has. It specifies what data they're allowed to access, and what they can do with it. Once again, let's look at our doorman example. Once you show your identity card to the doorman, and you have been successfully identified, the doorman may only allow you to access one room in the building based on the information on your identity card. This process of access based on Identity credentials is an authorization. Once authenticated, authorization defines what kinds of applications, resources, and data the user can access.

Answer 91

Azure Active Directory is Microsoft's cloud-based Identity and Access Management Service. Azure AD enables an organization's employees to sign in and access both internal and external resources, while also keeping them secure. In doing so, users can sign in and access external resources such as Microsoft 365, the Azure portal, and thousands of others Software as a Service or SaaS applications, internal resources such as apps on the organization's corporate network and intranet, along with any Cloud apps developed by the organization.

Answer 92

A tenant represents an organization in Azure Active Directory. It's a dedicated Azure AD instance that an organization receives an ohms when it signs up for a Microsoft Cloud service, such as Azure, Microsoft Intune, or Microsoft 365. You can think of a tenant as an instance of your organization with isolated data which is separated from other tenants or organizations. Each Microsoft 365, Office 365, Azure and Dynamic CRM Online tenant is automatically an Azure AD tenant.

Answer 93

1. Authentication 2. Registration of devices 3. Device Management 4. Application Management

Answer 94

Single sign-on enables a user to sign in one time and use that credential to access multiple resources and applications from different providers. With SSO, you need to remember only one ID and one password. Access across applications is granted to a single identity that's tied to the user, which simplifies the security model.

Answer 95

Multi-factor authentication is a process where users are prompted during the sign-in process for an additional form of identification. Examples include a code on their mobile phone or a fingerprint scan. Multi-factor authentication is important as it provides an additional level of security for your identities by requiring two or more elements to fully authenticate. These elements fall into three categories. Something the user knows, this might be an email address and password. Something the user has, this might be a code that's sent to the user's mobile phone. Something the user is, this is typically some sort of biometric property, such as a fingerprint or face scan that's used on many mobile devices. Azure AD multi-factor authentication or MFA is a Microsoft service that provides multi-factor authentication capabilities. Azure AD MFA enables users to choose an additional form of authentication during sign-in, such as a phone call or mobile app notification.

Answer 96

Conditional access is a tool that Azure Active Directory uses to allow or deny access to resources based on identity signals. These signals include who the user is, where the user is, and what device the user is requesting access from. Conditional access helps IT administrators empower users to be productive wherever and whenever, and protect the organization's assets. Conditional access also provides a more granular multi-factor authentication experience for users. For example, a user may not be challenged for a second authentication factor if they're at a known location. However, they might be challenged for a second authentication factor if they're sign-in signals are unusual, or they're at an unexpected location. During sign-in, conditional access collect signals from the user, makes decisions based on those signals, and then enforces that decision by allowing or denying the access request, or challenging for a multi-factor authentication response. *Conditional access is useful when you require multi-factor authentication to access an application. You can configure whether all users require multi-factor authentication or only certain users, such as administrators.

Answer 97

1. Azure Active Directory free edition | 2. Azure Active Directory Premium, P1 or P2

Answer 98

Azure AD helps users access both external and internal resources. External resources might include Microsoft Office 365, the Azure portal, and thousands of other software as a service (SaaS) applications. Internal resources might include apps on your corporate network and intranet, along with any cloud applications developed within your organization.

Answer 99

Single Sign On (SSO) - users sign in one time and use that credential to access multiple resources and applications from different providers.

Answer 100

The term governance describes the general process of establishing rules and policies and ensuring that those rules and policies are enforced. When running in the cloud, a good governance strategy helps you maintain control over the applications and resources that you manage in the cloud. Maintaining control over your environment ensures that you stay compliant with industry standards, like the payment card industry data security standard, PCIDSS. In corporate or organizational standards, such as ensuring that network data is encrypted. Governance can be beneficial to organizations in a wide range of areas such as multiple engineering teams working in Azure, multiple subscriptions to manage.

Answer 101

The Cloud Adoption Framework for Azure provides you with proven guidance to help with your Cloud Adoption journey. It helps you create and implement the Business and Technology strategies needed to succeed in the Cloud. The Cloud Adoption Framework consists of tools, documentation, and proven practices which can help you create and implement the Business and Technology strategies needed to succeed in the Cloud.

Answer 102

1. define your strategy 2. make a plan 3. ready your organization 4. adopt the Cloud 5. govern and manage your cloud environments

Answer 103

In the first stage, you define your strategy using the Cloud Adoption framework, which includes tools, documentation, and proven practices. You answer questions such as, why you're moving to the cloud and what you want to get out of cloud migration, do you need to scale to meet demand or reach new markets? Will it reduce costs or increased business agility. *Let's take a look at the steps in this stage. 1. Define a document your motivations. Meeting with stakeholders and leadership can help you answer why you're moving to the Cloud. 2. Document business outcomes, meet with leadership from your finance, marketing, sales, and human resource groups to help you document your goals. 3. Develop a business case - validate that moving to the cloud gives you the right return on investment ROI for your efforts. 4. Choose the right first Project. Choose a project that's achievable but also shows progress toward your cloud migration goals.

Answer 104

In the second stage, you build a plan that maps your aspirational goals to specific actions. A good plan helps ensure that your efforts map to the desired business outcomes. * Let's walk through the steps in this stage. 1. First, digital estate. This is when you create an inventory of the existing digital assets and workloads that you plan to migrate to the cloud. 2. Second, initial organizational alignment. In this step, you ensure that the right people are involved in your migration efforts, both from a technical standpoint as well as from a cloud governance standpoint. 3. Third, skills readiness plan. Here, you build a plan that helps individuals build the skills they need to operate in the cloud. 4. Last Cloud adoption plan. In this final step, you build a comprehensive plan that brings together the development operations and business teams toward a shared Cloud Adoption goal.

Answer 105

Here, you build a plan that helps individuals build the skills they need to operate in the cloud. In the third stage, you get your organization ready by creating a landing zone. A landing zone is an environment in the cloud that helps you begin hosting your workloads. Begin to build out the Azure subscriptions that support each of the major areas of your business. A landing zone includes: cloud Infrastructure, as well as governance, accounting and security capabilities.

Answer 106

Build a comprehensive plan that brings together the development operations and business teams toward a shared Cloud Adoption goal. In the fourth stage, you begin to migrate your applications to the cloud. Use the Azure Migration Guide to deploy your first project to the cloud. Use Azure innovation guide to accelerate development and build a minimum viable product MVP for your idea. Verify that your progress maps to recommended best-practices before you move forward. Create feedback loops by checking in frequently with your customers to verify that you're building what they need.

Answer 107

Form your Cloud governance and Cloud management strategies. As the cloud state changes over time, so too will your cloud governance processes and policies. * Let's look at the steps in the govern phase of this stage. 1. Methodology: Consider your end state solution, then define a methodology that incrementally takes you from your first steps all the way to full Cloud governance. 2. Use the governance benchmark tool to assess your current state and future state to establish a vision for applying the framework. 3. Create a minimally viable product that captures the first steps of your governance plan. 4. Iteratively add governance controls that address tangible risks as you progress towards your end state solution. Now for the steps in the manage phase of this stage, it is here that you define your minimum commitment to Operations management. A management baseline is the minimum set of tools and processes that should be applied to every asset in an environment. Document supported workloads to establish operational commitments with the business and agree on cloud management investments for each workload. Apply recommended best-practices to iterate on your initial management baseline.

Answer 108

1. Resources 2. resource groups 3. subscriptions 4. management groups

Answer 109

Resources are instances of services that you create, like virtual machines, storage, or SQL databases. Resources are combined into resource groups, which act as a logical container into which Azure resources like web apps, databases, and storage accounts are deployed and managed.

Answer 110

A subscription, groups together user accounts and the resources that have been created by those user accounts. For each subscription, there are limits or quotas, on the amount of resources that you can create and use. Organizations can use subscriptions to manage costs and the resources that are created by users, teams, or projects.

Answer 111

Management groups help you manage access, policy, and compliance, from multiple subscriptions. All subscriptions in a management group, automatically inherit the conditions applied to that management group.

Answer 112

Azure blueprints enables you to define the set of standard Azure resources that your organization requires. For example, you can define a blueprint that specifies that a certain resource lock must exist. Azure blueprints can automatically replace the resource lock if the lock is removed. You learn more about Azure blueprints later in this module. To make the protection process more robust, you can combine resource locks with Azure blueprints.

Answer 113

1. CanNotDelete - means authorized people can still read and modify a resource, but they can't delete the resource without first removing the lock. 2. ReaderOnly - means authorized people can read a resource, but they can't delete or change the resource.

Answer 114

Earlier, you learned that you can organize related resources by 1. Placing them in their own subscriptions. 2. Using them to manage related resources.

Answer 115

Resource tags are another way to organize resources. Tags provide extra information or metadata about your resources. Metadata is useful for a variety of purposes including Resource Management. Tags enable you to locate and act on resources that are associated with specific workloads, environments, business units, and owners. Tags enable you to group resources so that you can report on costs, allocate internal cost centers, track budgets and forecast estimated cost. Tags enable you to group resources according to how critical their availability is to your business. This grouping helps you formulate service-level agreements, SLAs. An SLA is an uptime or performance guarantee between you and your users. Tags enable you to classify data by its security level, such as public or confidential. Tags enable you to identify resources that align with governance or regulatory compliance requirements, such as ISO 27001. Tags can also be part of your standards enforcement efforts. Tags can help you visualize all of the resources that participate in complex deployments.

Answer 116

Azure Policy is a service in Azure that enables you to create a sign and manage policies that control or audit your resources. These policies enforce different rules and effects over your resource configurations so that those configurations stay compliant with corporate standards. Azure Policy enables you to define both individual policies and groups of related policies known as initiatives. Azure Policy evaluates your resources and highlights resources that aren't compliant with the policies you've created. Azure Policy can also prevent non-compliant resources from being created. Azure Policy comes with a number of built-in policy and initiative definitions that you can use under categories such as storage, networking, Compute, Security Center, and monitoring.

Answer 117

To implement your policy definitions, you assign definitions to resources. A policy assignment is a policy definition that takes place within a specific scope. This scope could be a management group, a collection of multiple subscriptions, a single subscription, or a resource group. Policy assignments are inherited by all child resources within that scope. If a policy is applied to a resource group, that policy is applied to all resources within that resource group. You can exclude a sub-scope from the policy assignment. If there are specific child resources, you need to be exempt from the policy assignment. When a condition is evaluated against her existing resources, each resource is marked as compliant or non-compliant.

Answer 118

Tags provide extra information, or metadata, about your resources. You might create a tag that's named Sales whose value is the name of the billing department. You can use Azure Policy to ensure that the proper tags are assigned when resources are provisioned.

Answer 119

Azure RBAC enables you to create roles that define access permissions. You might create one role that limits access only to virtual machines and a second role that provides administrators with access to everything.

Answer 120

1. CanNotDelete - means authorized people can still read and modify a resource, but they can't delete the resource without first removing the lock. 2. ReadOnly

Answer 121

1. Resource Groups 2. ARM template 3. Policy Assignment 4. Role Assignment

Answer 122

Create an Azure Policy

Answer 123

* Create a new Azure Policy that only displays the preferred SKU sizes. * After you enable this policy, it will be effective when you create new virtual machines or resize existing ones. Azure Policy also evaluates any current virtual machines in your existing environment.

Answer 124

Think of a control as a known good standard that you can compare your solution against to ensure security. These controls address today's regulations and adapt as regulations evolve.

Answer 125

1. Global 2. US Government 3. Industry 4. Regional

Answer 126

Azure government is a separate instance of the Microsoft Azure service, it addresses the security and compliance needs of US federal agencies, state and local governments, and their solution providers. Azure government offers physical isolation from non-US government deployments and provide screened US personnel. Azure government services handle data that is subject to certain government regulations and requirements. To provide the highest level of security and compliance, Azure government uses physically isolated data centers and networks located only in the US. Azure government customers, such as the US federal, state, and local government, or their partners, are subject to validation of eligibility.

Answer 127

In order to comply with government regulation, Azure services in China are operated by 21Vianet, which is based on the technology licensed from Microsoft. Azure China 21Vianet is a physically separated instance of cloud services located in China. Azure China 21 Vianet is independently operated and transacted by Shanghai Blue Cloud Technology Company, or 21Vianet

Answer 128

Microsoft Trust Center

Answer 129

Online Services Terms The Online Services Terms (OST) is a legal agreement between Microsoft and the customer that details the obligations by both parties with respect to the processing and security of customer data and personal data. The OST applies specifically to Microsoft's online services that you license through a subscription including Azure, Dynamics 365, Office 365, and Bing Maps.

Answer 130

The Microsoft Privacy Statement provides information that's relevant to specific services, including Cortana.

Answer 131

Azure Advisor

Answer 132

1. Define your workload 2. Adjust assumptions 3. View the report.

Answer 133

The first step, define your workloads, Is where you enter the specification of your on-premises infrastructure into the TCO calculator based on these four categories. The service category includes operating systems, virtualization methods, CPU cores, and memory RAM. The databases category includes database types, server hardware, and the Azure service you want to use, which includes the expected maximum concurrent users sign-ins. The storage category includes storage type and capacity, which includes any backup or archive storage. The networking category includes the amount of network bandwidth you currently consume in your on-premises environment.

Answer 134

In Step 2, you adjust your assumptions about your operating costs. Here you specify whether your current on-premises licenses are enrolled for software assurance. If they are, you can save money by reusing those licenses on Azure. You can also specify whether you need to replicate your storage to another Azure region for greater redundancy. Then, you can also see the key operating cost assumptions across several different areas. You might need to adjust these to more accurately reflect your situation. These costs have been certified by Nucleus Research, an independent research company. For example, these costs include electricity price per kilowatt-hour, network maintenance cost as a percentage of network hardware and software costs, hourly pay rate for IT administration. To improve the accuracy of the TCO calculator results, you adjust the values so that they match the costs of your current on-premises infrastructure.

Answer 135

In Step 3, you generate a report based on your answers in Steps 1 and 2. You start by choosing a time-frame between one and five years. The TCO calculator generates a report that's based on the information you've entered. For each category, compute, data center, networking, storage, and IT labor, you can also view a side-by-side comparison of the cost breakdown of operating those workloads on-premises versus operating them on Azure.

Answer 136

Among these factors that affect your costs are resource type, usage meters, resource usage, Azure subscription types, and Azure Marketplace.

Answer 137

A CSP is a Microsoft partner who helps you build solutions on top of Azure. Your CSP bills you for your Azure usage at a price they determine. They also answer your support questions, escalating them to Microsoft as needed.

Answer 138

An Enterprise Agreement Larger customers (known as Enterprise customers) can sign an Enterprise Agreement with Microsoft that commits them to spend a predetermined amount on Azure services over a period of 3 years, which is typically paid annually. As an Enterprise Agreement customer, you will receive the best, customized pricing based on the kinds and amounts of services you plan on using.

Answer 139

When you spend all the credit included with your Azure free account, Azure resources that you deployed are removed from production and your Azure virtual machines are stopped and deallocated. The data in your storage accounts are available as read-only. At this point, you can upgrade your subscription to a pay-as-you-go subscription.

Answer 140

False You don't need an Azure subscription to review service SLAs. You can access SLAs from the Service Level Agreements page on azure.microsoft.com.

Answer 141

52.56 mins

Answer 142

A Virtual Network Gateway To implement a solution that enables the client computers on your on-premises network to communicate to the Azure virtual machines, you need to configure a VPN (Virtual Private Network) to connect the on-premises network to the Azure virtual network. The Azure VPN device is known as a Virtual Network Gateway.

Answer 143

With Azure Cloud Shell, you can create virtual machines using Bash or PowerShell.

Answer 144

No. Platform as a service (PaaS) is a complete development and deployment environment in the cloud. PaaS includes infrastructure servers, storage, and networking as well as middleware, development tools, business intelligence (BI) services, database management systems, and more. PaaS is designed to support the complete web application lifecycle: building, testing, deploying, managing, and updating. However, virtual machines are examples of Infrastructure as a service (IaaS). IaaS is an instant computing infrastructure, provisioned and managed over the internet. Try going back and reviewing Microsoft Azure Fundamental Concepts & Architectural Components.

Answer 145

Azure Files Storage offers fully managed file shares in the cloud that are accessible via the industry standard Server Message Block (SMB) protocol. Azure file shares can be mounted concurrently by cloud or on-premises deployments of Windows, Linux, and macOS. Diagnostic logs, metrics, and crash dumps are just three examples of data that can be written to a file share and processed or analyzed later. Try going back and reviewing Microsoft Azure Fundamental Concepts & Architectural Components.

Answer 146

An Azure virtual machine is an example of Infrastructure as a Service (IaaS).

Answer 147

1. In a consumption-based model, you don’t need to purchase and manage a costly infrastructure that they may or may not use to its full capacity. 2. You only pay for additional resources when they are needed.

Answer 148

To implement a solution that enables the client computers on your on-premises network to communicate to the Azure virtual machines, you need to configure a VPN (Virtual Private Network) to connect the on-premises network to the Azure virtual network. The Azure VPN device is known as a Virtual Network Gateway.

Answer 149

Azure HDInsight is a fully managed, open-source analytics service for enterprises. It is a cloud service that makes it easier, faster, and more cost-effective to process massive amounts of data. HDInsight allows you to run popular open-source frameworks and create cluster types.

Answer 150

DevTest Labs allows for the creation of labs consisting of pre-configured bases or Azure Resource Manager templates.

Answer 151

Azure virtual machine scale sets let you create and manage a group of load-balanced VMs. The number of VM instances can automatically increase or decrease in response to demand or a defined schedule. Scale sets provide high availability to your applications and allow you to centrally manage, configure, and update many VMs. However, this question does not specify that the scale set will be configured across multiple datacenters so this solution does not meet the goal.

Answer 152

Computing capacity can be increased by adding additional RAM or CPUs to a virtual machine.

Answer 153

The public cloud is a shared entity whereby multiple corporations each use a portion of the resources in the cloud.

Answer 154

Create a hybrid cloud - a combination of a private cloud and a public cloud. With a hybrid cloud, you can continue to use the on-premises servers while adding new servers in the public cloud. Adding new servers in Azure minimizes the capital expenditure costs

Answer 155

Create a subscription - an agreement with Microsoft to use one or more Microsoft cloud platforms or services, for which charges accrue. You get billed per subscription. Try going back and reviewing Microsoft Azure Fundamental Concepts & Architectural Components.

Answer 156

No. Azure App Service is a PaaS (Platform as a Service) service. However, Azure Storage accounts are an IaaS (Infrastructure as a Service) service. Therefore, this design does not meet the requirements. Try going back and reviewing Microsoft Azure Storage and Networking Services.

Answer 157

1. Point-to-site Virtual Private Networks 2. Azure ExpressRoute 3. Site-to-site Virtual Private Networks

Answer 158

You use service endpoints to connect to other Azure resource types, such as Azure SQL databases and storage accounts. This approach enables you to link multiple Azure resources to virtual networks, thereby improving security and providing optimal routing between resources.

Answer 159

Azure DevOps Services has a much more granular set of permissions that allow organizations to refine who can perform most operations across the entire toolset. Also, Azure DevOps is highly customizable, allowing an administrator to add custom fields to capture metadata and other information alongside each work item. By contrast, GitHub Issues uses tags as its primary means of helping a team categorize issues.

Answer 160

Azure Sphere

Answer 161

Azure Monitor

Answer 162

Azure Databricks is an Apache Spark-based analytics platform. The platform consists of several components including MLlib which is a Machine Learning library consisting of common learning algorithms and utilities, including classification, regression, clustering, collaborative filtering, dimensionality reduction, as well as underlying optimization primitives.

Answer 163

Azure DevOps Repos is a set of version control tools that you can use to manage your code. Azure DevOps repos are a set of repositories that allow you to version control and manage your project code. It helps to work and coordinate code changes across a team.

Answer 164

A network security group works like a firewall. You can attach a network security group to a virtual network and/or individual subnets within the virtual network. You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group.

Answer 165

Premier, Professional Direct, Standard, and Developer only

Answer 166

Multiple subscriptions; There are different payment options in Azure including pay-as-you-go (PAYG), Enterprise Agreement (EA), and Microsoft Customer Agreement (MCA) accounts. Your Azure costs are per subscription. You are charged monthly for all resources in a subscription. Therefore, to use different payment options per department, you will need to create a separate subscription per department.

Answer 167

12 months; The Modern Lifecycle Policy covers products and services that are serviced and supported continuously. For products governed by the Modern Lifecycle Policy, Microsoft will provide a minimum of 12 months' notification before ending support if no successor product or service is offered.

Answer 168

Your existing Azure resources are removed from production and your Azure virtual machines are stopped and deallocated.