Practice Test #4

A Recovery Services vault with Windows Server Backup is primarily a backup/restore approach. It can protect VM1’s data, but during a Toronto outage users won’t have immediate access; you must restore to alternate infrastructure first. This increases RTO and does not inherently improve user access speed across branch offices. It addresses data protection, not fast, continuous file access.

Azure blob containers with Azure File Sync is not a valid pairing for this use case. Azure File Sync requires an Azure file share (Azure Files) as the cloud endpoint, not Blob storage. While Blob is excellent for object storage and archival, it doesn’t provide SMB share semantics needed for typical Windows file server shared folders without additional services/gateways.

A Recovery Services vault with Azure Backup protects VM1 and can restore data to Azure or another server, but it is still a restore-based DR method. Users cannot access the shared files quickly during an outage unless you have already provisioned and synchronized an alternate file server. This option improves durability but typically results in higher RTO compared to a synchronized, cloud-backed file share solution.

Yes is incorrect because Azure Advisor does not capture or analyze network packet flows or provide allow/deny decisions for VM traffic. Advisor focuses on best-practice recommendations (cost optimization, security posture, reliability, performance), not operational traffic diagnostics. It may suggest improvements, but it cannot tell you whether specific packets were allowed or denied.

Azure Web Apps run on App Service, which does not provide the host-level access needed to install and register a custom COM component on the server. Even though deploying in two regions improves resiliency, the platform itself is incompatible with the application's dependency. The load balancer does not change that limitation. Therefore, this option fails the core technical requirement.

A virtual machine scale set does support the custom COM component because it provides OS-level control, but deploying in two regions is more expensive than necessary for the stated requirement. The question asks for availability if an Azure datacenter becomes unavailable, which is best addressed by Availability Zones within a single region. A two-region deployment adds duplicated infrastructure, networking, and operational complexity. Because cost must be minimized, this is not the best recommendation.

Traffic Manager with web apps in two regions is a valid pattern for multi-region web applications, but it still relies on App Service for hosting. App Service cannot host applications that require arbitrary COM components installed on the underlying server. Traffic Manager only handles DNS-based routing and failover; it does not solve the hosting compatibility issue. Therefore, this option does not meet the application's dependency requirement.

Yes is incorrect because the presence of VMs in two regions is not enough by itself to guarantee regional failover. Azure Application Gateway is a regional service, so a single instance does not continue serving traffic if its hosting region becomes unavailable. Although the VM choice satisfies the full .NET Framework and OS administration requirements, the architecture still has a single regional dependency at the ingress layer. A correct multi-region design would require a global load-balancing service such as Azure Front Door or Traffic Manager, typically combined with regional back-end components.

Azure Application Gateway with WAF can be deployed with a private frontend IP and can provide L7 routing and WAF protections. However, it is not an API management gateway and does not natively provide APIM-style rate limiting/quota policies. mTLS/client certificate enforcement is also not the typical strength for App Gateway in this scenario. It may partially meet private ingress but fails the full set of requirements.

APIM Standard tier does not support VNet injection (internal/private gateway). A “service endpoint” is not a mechanism to give APIM a private IP address in your VNet; it’s used to secure access to certain Azure PaaS services from a subnet. Therefore, Standard cannot satisfy the requirement to restrict ingress to a single private IP while also providing mTLS and rate limiting.

Azure Front Door is a global, internet-facing entry point with anycast public endpoints. Even with WAF, it cannot provide ingress restricted to a single private IP inside a VNet for VM-to-AKS private communication. It’s designed for public web acceleration and global load balancing, not private VNet-only API exposure with mTLS to internal consumers.

Azure Table Storage is a low-cost key/attribute store suitable for large volumes, but it has limited query capabilities and is not purpose-built for time-series analytics or near-real-time visualization at 50,000 writes/sec. It can work for simple lookups with careful partition/row key design, but dashboards and aggregations over time windows are harder and typically require additional analytics services.

Azure Event Grid is an event routing and notification service (pub/sub) used to deliver discrete events to handlers (Functions, Logic Apps, webhooks). It does not store data for querying and is not a time-series database. In an IoT architecture, Event Grid may help react to events, but it does not satisfy the requirement to store and query telemetry for visualization.

Azure Automation is a general automation platform for running scripts, scheduling tasks, and applying configuration management. Although it can automate parts of VM deployment or post-deployment configuration, it does not provide native HPC cluster orchestration or built-in awareness of third-party schedulers. It also lacks specialized capabilities such as cluster templates, scheduler-integrated autoscaling, and HPC-focused node lifecycle management. Therefore, it is not the best-fit service for provisioning and managing an Azure HPC cluster.

Azure Purview, now part of Microsoft Purview, is focused on data governance, cataloging, classification, and compliance. Its purpose is to help organizations discover and manage data assets across environments, not to deploy or operate compute infrastructure. It has no role in provisioning HPC nodes, integrating with schedulers, or scaling cluster resources. As a result, it is unrelated to the scenario described in the question.

Azure Lighthouse is designed for cross-tenant management and delegated administration, especially for service providers or enterprises managing multiple Azure tenants. It helps centralize governance, monitoring, and operational access, but it does not deploy or manage HPC clusters. Lighthouse has no built-in functionality for scheduler integration, compute node provisioning, or HPC autoscaling. Therefore, it does not satisfy the requirement to provision and manage HPC cluster nodes.

Incorrect. A general-purpose v1 (GPv1) storage account is a legacy account type and does not provide the same flexible blob tiering and pricing model as GPv2/Blob accounts. Even if blobs can be stored, this option does not specify using the Archive tier, so it won’t minimize storage cost to the level required for rarely accessed data with delayed retrieval.

Incorrect. This uses Azure Files (file share) in a GPv2 account. Azure Files is appropriate when you need SMB/NFS semantics, but it does not offer an Archive tier equivalent (offline storage with rehydration). Cool file share tiers can reduce cost, but not as much as Blob Archive for rarely accessed data, so it fails the “minimize storage costs” intent compared to Archive.

Incorrect. GPv1 with a file share is not a valid/optimal design for minimizing cost for rarely accessed data. Azure Files does not provide an Archive tier, and GPv1 is legacy with fewer modern cost-optimization and tiering capabilities. This option also doesn’t address the 24-hour retrieval model via rehydration; it implies online file share access rather than low-cost offline storage.