AZ-120 Practice Questions

This option addresses all requirements. Deploying across Availability Zones provides the highest level of intra-region HA. HSR in synchronous mode with Pacemaker provides automatic failover and a near-zero RPO for HA. For DR, a third VM in the paired region with asynchronous HSR meets the low RTO/RPO requirements more effectively than backup/restore. The other options fail to meet one or more key requirements: Option A's DR strategy doesn't meet the RTO/RPO. Option C uses an Availability Set which is less resilient than Zones. Option D suggests an unsupported configuration (Always On for HANA) and a poor DR strategy.

Azure Automation provides a feature called 'Start/Stop VMs v2' (the successor to the v1 solution) which is specifically designed to schedule the automatic startup and shutdown of Azure VMs. It is a pre-packaged, low-code solution that can be configured with schedules and targeted at specific VMs using tags, making it ideal for managing non-production SAP environments to reduce costs. The auto-shutdown feature on a VM is for a single VM, not a landscape. Azure Policy is for governance, and Azure Functions would require custom scripting.

Application Security Groups (ASGs) allow you to group VMs with similar functions (e.g., 'SAP_App_Servers', 'SAP_DB_Servers') and define network security rules based on these logical groups rather than explicit IP addresses. By creating an ASG for the app tier and another for the DB tier, you can create a highly specific NSG rule that says 'Allow traffic from source ASG 'SAP_App_Servers' to destination ASG 'SAP_DB_Servers' on port 3xx15'. This is more granular and easier to manage than rules based on IP ranges, especially in dynamic environments.

In an SAP RISE engagement, SAP takes responsibility for managing the infrastructure and technical managed services, which includes the operating system management (patching, updates, security). The customer's responsibility shifts to the application layer (e.g., custom code, user management). This is a key value proposition of the RISE with SAP offering.

Each Azure VM SKU has its own maximum limits for IOPS and throughput, independent of the limits of the attached disks. It is possible for the combined potential performance of multiple high-performance disks (like several P30s) to exceed the total I/O capacity of the VM itself. In this scenario, the VM becomes the bottleneck and throttles the I/O, even if the individual disks are not at their limits. The solution would be to resize the VM to a SKU with higher I/O limits.

Azure Backup for SAP HANA stores backups in a Recovery Services vault. To meet the requirement of using customer-managed keys (CMK) for backup encryption, the Recovery Services vault itself must be configured with a CMK from Azure Key Vault. This ensures that the backup data is encrypted with a key that the customer controls. Azure Disk Encryption encrypts the VM's disks but does not control the encryption of the backups stored in the vault. Encrypting the storage account is a general setting and doesn't apply specifically to the Azure Backup service's managed storage. Configuring TDE on HANA encrypts the database files at rest, but not the backups managed by the Azure Backup service.

ExpressRoute Global Reach is specifically designed to link ExpressRoute circuits together to provide a private network between on-premises sites or between virtual networks in different geopolitical regions connected via ExpressRoute. Since the company already has an ExpressRoute circuit, enabling Global Reach is the optimal solution for creating a high-performance, low-latency private connection between the two Azure regions over the Microsoft backbone. Global VNet peering is a valid option but relies on the public backbone and can incur higher data transfer costs. A VNet-to-VNet VPN is slower and has lower bandwidth than ExpressRoute. Creating a second circuit is less cost-effective than using Global Reach.

The performance metrics clearly indicate a CPU bottleneck, as the CPU utilization is maxed out while disk I/O metrics are well within their limits. Therefore, the most direct and effective solution is to increase the available CPU resources. Resizing the VM to another Ddsv4-series with more vCPUs (scaling up) will directly address the CPU constraint. Migrating to Ultra Disk would not help as there is no I/O bottleneck. Changing to a memory-optimized series without increasing vCPUs would not solve the CPU pressure. Enabling Accelerated Networking is a best practice but will not resolve a core CPU limitation.

Azure shared disks are the recommended shared storage solution for WSFC on Azure because they explicitly support SCSI Persistent Reservations (SCSI-PR), which is a requirement for WSFC. This allows multiple VMs to attach to the same managed disk, making it suitable for clustered applications like SAP ASCS/SCS. Azure Files Premium can be used for file shares but doesn't present a block device that supports SCSI-PR. Azure NetApp Files is an NFS/SMB service. A Storage Spaces Direct (S2D) cluster is more complex and not the standard recommendation for this specific SAP scenario.

The Azure Pricing Calculator is the primary tool for estimating the costs of specific Azure services (like VMs, storage, networking) for a new deployment. The Total Cost of Ownership (TCO) Calculator is used to compare the cost of running a workload on-premises versus in Azure, which is perfect for a migration scenario. Azure Advisor provides cost optimization recommendations for existing resources, and Azure Monitor is for monitoring performance and health, not for pre-deployment cost estimation.