Pass the Microsoft Certified: Azure Solutions Architect Expert AZ-305 Questions and answers with Dumpstech

One option is to deploy APIM (API Management) inside the cluster VNet.

The AKS cluster and the applications that consume the microservices might reside within the same VNet, hence there is no reason to expose the cluster publicly as all API traffic will remain within the VNet. For these scenarios, you can deploy API Management into the cluster VNet. API Management Premium tier supports VNet deployment.

General Purpose / Standard prevents data loss through high available storage https://docs.microsoft.com/en-us/azure/azure-sql/database/service-tier-general-purpose?view=azuresql. This architectural model relies on high availability and reliability of Azure Blob storage that transparently replicates database files and guarantees no data loss if underlying infrastructure failure happens. General Purpose / Standard support Zone Redundancy For General Purpose tier the zone-redundant configuration is Generally Available in the following regions: https://docs.microsoft.com/en-us/azure/azure-sql/database/high-availability-sla?view=azuresql & tabs=azure-powershell Without any information regarding the usage pattern, serverless is possible. Other option is D https://docs.microsoft.com/en-us/azure/azure-sql/database/serverless-tier-overview?view=azuresql

This solution does not meet the goal because an Azure Policy initiative can only enforce the location of resources, not resource groups. Resource groups are not a resource type that can be targeted by Azure Policy1. To enforce the location of resource groups, you need to use Azure Resource Manager templates2 or Azure PowerShell3 to create them in the desired regions.

Box 1: Azure Files

Scenario: App2 has the following file storage requirements:

Save files to an Azure Storage account.

Replicate files to an on-premises location.

Ensure that on-premises clients can read the files over the LAN by using the SMB protocol.

Box 2: Azure File Sync

Use Azure File Sync to centralize your organization ' s file shares in Azure Files, while keeping the flexibility, performance, and compatibility of an on-premises file server. Azure File Sync transforms Windows Server into a quick cache of your Azure file share. You can use any protocol that ' s available on Windows Server to access your data locally, including SMB, NFS, and FTPS. You can have as many caches as you need across the world.

Requirements: Identity Requirements

Contoso identifies the following requirements for managing Fabrikam access to resources:

Every month, an account manager at Fabrikam must review which Fabrikam users have access permissions to App1. Accounts that no longer need permissions must be removed as guests.

The solution must minimize development effort.

Box 1: The Azure AD Privileged Identity Management (PIM)

When should you use access reviews?

Too many users in privileged roles: It ' s a good idea to check how many users have administrative access, how many of them are Global Administrators, and if there are any invited guests or partners that have not been removed after being assigned to do an administrative task. You can recertify the role assignment users in Azure AD roles such as Global Administrators, or Azure resources roles such as User Access Administrator in the Azure AD Privileged Identity Management (PIM) experience.

Box 2: Access reviews

Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User ' s access can be reviewed on a regular basis to make sure only the right people have continued access.

Scenario: Security Requirement

All secrets used by Azure services must be stored in Azure Key Vault.

Services that require credentials must have the credentials tied to the service instance. The credentials must NOT be shared between services.

Box 1: A service principal

A service principal is a type of security principal that identifies an application or service, which is to say, a piece of code rather than a user or group. A service principal ' s object ID is known as its client ID and acts like its username. The service principal ' s client secret acts like its password.

Note: Authentication with Key Vault works in conjunction with Azure Active Directory (Azure AD), which is responsible for authenticating the identity of any given security principal.

A security principal is an object that represents a user, group, service, or application that ' s requesting access to Azure resources. Azure assigns a unique object ID to every security principal.

Box 2: A role assignment

You can provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control.