Design and Implement Networking for SAP on Azure Virtual Machines AZ-120 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   You are designing an SAP deployment on Azure. Which Azure resource defines the private IP address space in which you place subnets and virtual machines?

   • AAzure DNS zone
   • BRoute table
   • CVirtual network (VNet)
   • DNetwork security group
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Contoso has SAP workloads in Azure and on-premises. They use ExpressRoute for connectivity. They want to use a custom domain name for their SAP application servers in Azure, and they need on-premises clients to resolve these names to the Azure private IPs. They currently use Azure DNS private zones for Azure resources. What should you do?

   • ACreate a public DNS zone in Azure DNS and add A records pointing to the public IPs of the SAP VMs.
   • BCreate a DNS record in the Azure DNS private zone for each SAP VM, and configure on-premises DNS servers to forward queries for that domain to Azure DNS.
   • CConfigure a private endpoint for each SAP VM and use its private DNS zone.
   • DUse Azure-provided DNS (168.63.129.16) as the DNS server for on-premises clients.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is designing the virtual network for SAP on Azure. They have three tiers: web, application, and database. They want to ensure that the web tier can only communicate with the application tier, and the application tier can only communicate with the database tier. They also want to minimize the number of subnets. What should you do?

   • ACreate one subnet for all tiers and use NSGs on each VM's NIC to restrict traffic.
   • BCreate three subnets and use Azure Firewall to route all traffic between subnets.
   • CCreate two subnets: one for web and application, and one for database, and use an NVA to filter traffic.
   • DCreate three subnets, one for each tier, and apply network security groups (NSGs) to each subnet to restrict traffic.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company is deploying SAP on Azure and needs to secure traffic between the application tier and the database tier. The application servers and database VMs are in the same virtual network but different subnets. You need to ensure that only the application servers can communicate with the database on port 3306, and all other traffic is blocked. What should you configure?

   • AAn Azure Firewall with an application rule that allows only the application servers to access the database IP on port 3306.
   • BA service endpoint on the database subnet that restricts access to the application subnet.
   • CA network virtual appliance (NVA) with a routing table that directs database traffic through the NVA for inspection.
   • DA network security group (NSG) applied to the database subnet with an allow rule for port 3306 from the application subnet and a deny-all rule for all other inbound traffic.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which Azure networking feature is most effective for reducing network latency between SAP application VMs and database VMs that are in the same region?

   • AAzure Front Door
   • BAzure Traffic Manager
   • CNetwork security group
   • DProximity placement group
   Reveal Solution Discussion Select an answer first