Design and Implement Networking for SAP on Azure Virtual Machines AZ-120 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An organization has an SAP environment in Azure with VMs in a spoke virtual network. The VMs need to resolve the names of on-premises SAP servers that are reachable through a site-to-site VPN. The on-premises DNS servers are authoritative for the corporate domain. You need to configure name resolution for the Azure VMs so they can resolve on-premises hostnames. What should you do?

   • AAdd the on-premises DNS servers as DNS servers in the Azure DNS zone's SOA record.
   • BCreate a private DNS zone in Azure and link it to the spoke virtual network, then add records for the on-premises servers.
   • CUse Azure DNS Private Resolver to forward queries to on-premises DNS servers.
   • DConfigure the spoke virtual network to use a custom DNS server that forwards queries to the on-premises DNS servers.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary purpose of Azure ExpressRoute in a hybrid SAP deployment?

   • ATo provide a VPN connection over the internet
   • BTo provide DNS resolution for on-premises resources
   • CTo load balance traffic between on-premises and Azure
   • DTo provide a dedicated, private network connection between on-premises and Azure
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company has an SAP environment in Azure with a hub-and-spoke network topology. The SAP VMs are in a spoke virtual network. The security team requires that all outbound internet traffic from the SAP VMs be inspected and logged. You need to design the network security solution. What should you do?

   • AApply a network security group to the SAP subnet that denies all outbound internet traffic.
   • BRoute all outbound traffic from the spoke through Azure Firewall in the hub and enable logging.
   • CUse a network virtual appliance (NVA) in the spoke to inspect traffic.
   • DEnable Azure DDoS Protection on the spoke virtual network.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   You need to ensure that an SAP application VM can access an Azure Storage account without using the public internet. Which Azure feature should you configure?

   • AProximity placement group
   • BNetwork security group
   • CPrivate endpoint
   • DAzure DNS zone
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An SAP environment in Azure uses a private endpoint for an Azure Storage account. The SAP VMs need to resolve the storage account's private endpoint FQDN to the private IP address. The VMs are in a virtual network that is linked to a private DNS zone. What should you verify to ensure name resolution works?

   • AThe private DNS zone is linked to the virtual network and auto-registration is enabled for the private endpoint.
   • BThe virtual network has a custom DNS server that can resolve the storage account's public FQDN.
   • CThe storage account's public endpoint is disabled.
   • DThe virtual network is peered to the hub where the private DNS zone is hosted.
   Reveal Solution Discussion Select an answer first