Microsoft - AZ-305: Designing Microsoft Azure Infrastructure Solutions

Sample Questions

Explanation:

Attribute-based access control (ABAC) is an authorization system that defines access based on attributes associated with security principals, resources, and the environment of an access request. With ABAC, you can grant a security principal access to a resource based on attributes. Azure ABAC refers to the implementation of ABAC for Azure.

Azure role-based access control (Azure RBAC) is an authorization system that helps you manage who has access to Azure resources, what they can do with those resources, and what areas they have access to. In most cases, Azure RBAC will provide the access management you need by using role definitions and role assignments. However, in some cases you might want to provide more fine-grained access management or simplify the management of hundreds of role assignments.

Azure ABAC builds on Azure RBAC by adding role assignment conditions based on attributes in the context of specific actions. A role assignment condition is an additional check that you can optionally add to your role assignment to provide more fine-grained access control. A condition filters down permissions granted as a part of the role definition and role assignment. For example, you can add a condition that requires an object to have a specific tag to read the object. You cannot explicitly deny access to specific resources using conditions.

Currently, conditions can be added to built-in or custom role assignments that have blob storage or queue storage data actions.

Reference: What is Azure attribute-based access control (Azure ABAC)?

• Support multiple read-only replicas.
• Automatically load balance read-only requests across all the read- only replicas.
• Minimize administrative effort.

Explanation:

As part of High Availability architecture, each single database or elastic pool database in the Premium and Business Critical service tier is automatically provisioned with a primary read-write replica and one or more secondary read-only replicas. The secondary replicas are provisioned with the same compute size as the primary replica. The read scale-out feature allows you to offload read-only workloads using the compute capacity of one of the read-only replicas, instead of running them on the read-write replica. This way, some read-only workloads can be isolated from the read-write workloads, and don't affect their performance. The feature is intended for the applications that include logically separated read-only workloads, such as analytics. In the Premium and Business Critical service tiers, applications could gain performance benefits using this additional capacity at no extra cost.

The read scale-out feature is also available in the Hyperscale service tier when at least one secondary replica is added. Hyperscale secondary named replicas provide independent scaling, access isolation, workload isolation, support for various read scale-out scenarios, and other benefits. Multiple secondary HA replicas can be used for load-balancing read-only workloads that require more resources than available on one secondary HA replica.

Reference: Use read-only replicas to offload read-only query workloads

• Automatically scale the apps by creating additional instances.
• Minimize administrative effort to maintain nodes and clusters.
• Ensure that containerized apps are highly available across multiple availability zones.
• Provide a central location for the lifecycle management and storage of container images.

Explanation:

Azure Container Apps is a serverless platform that allows you to maintain less infrastructure and save costs while running containerized applications. Instead of worrying about server configuration, container orchestration, and deployment details, Container Apps provides all the up-to-date server resources required to keep your applications stable and secure.

Common uses of Azure Container Apps include:

• Deploying API endpoints
• Hosting background processing jobs
• Handling event-driven processing
• Running microservices

Additionally, applications built on Azure Container Apps can dynamically scale based on the following characteristics:

• HTTP traffic
• Event-driven processing
• CPU or memory load
• Any KEDA-supported scaler

Azure Container Apps uses availability zones in regions where they're available. 

You can deploy images hosted on private registries by providing credentials in the Container Apps configuration.

References:

Azure Container Apps overview

Reliability in Azure Container Apps

Set scaling rules in Azure Container Apps

Container registries

Explanation:

You can migrate VMware VMs to Azure using the Migration and modernization tool. This tool offers a couple of options for VMware VM migration:

• Migration using agentless replication. Migrate VMs without needing to install anything on them.
• Migration with an agent for replication. Install an agent on the VM for replication.

We need to create an Azure Migrate project and deploy the Azure Migrate appliance on-premises.

Reference: Select a VMware migration option

Explanation:

Because App1 must run on the same server as DB1, we should use a SQL Server instance running on a virtual machine. To minimize administrative effort, we should use Azure MIgrate to migrate the entire server inclusing DB1 and App1.

Reference: Migrate machines as physical servers to Azure