Microsoft AZ-120 Practice Test - Questions Answers, Page 7

Box 1: Yes

Box 2: No

A design that's not supported is the segregation of the SAP application layer and the DBMS layer into different Azure virtual networks that aren't peered with each other. We recommend that you segregate the SAP application layer and DBMS layer by using subnets within an Azure virtual network instead of by using different Azure virtual networks.

Box 3: Yes

Be aware that network traffic between two peered Azure virtual networks is subject to transfer costs. Huge data volume that consists of many terabytes is exchanged between the SAP application layer and the DBMS layer. You can accumulate substantial costs if the SAP application layer and DBMS layer are segregated between two peered Azure virtual networks.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/dbms_guide_general

Box 1: true

enableAcceleratedNetworking: If the network interface is accelerated networking enabled.

To further reduce network latency between Azure VMs, we [Micorosoft] recommend that you choose Azure Accelerated Networking. Use it when you deploy Azure VMs for an SAP workload, especially for the SAP application layer and the SAP DBMS layer.

Box 2: true

Write Accelerator should be used for the volumes that contain the transaction log or redo logs of a DBMS. It is not recommended to use Write Accelerator for the data volumes of a DBMS as the feature has been optimized to be used against log disks.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/dbms_guide_general

Box 1: No

Need AD FS for MFA. See box 3.

Note: Azure Active Directory (Azure AD) Pass-through Authentication allows your users to sign in to both on-premises and cloud-based applications using the same passwords. This feature is an alternative to Azure AD Password Hash Synchronization (see Box 2).

Box 2: Yes

Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Azure AD Connect synchronizes a hash, of the hash, of a users password from an on-premises Active Directory instance to a cloud-based Azure AD instance.

Password hash synchronization is an extension to the directory synchronization feature implemented by Azure AD Connect sync. You can use this feature to sign in to Azure AD services like Office 365. You sign in to the service by using the same password you use to sign in to your on-premises Active Directory instance.

Box 3: Yes

If your organization is federated with Azure AD, you can use Azure Multi-Factor Authentication to secure AD FS resources, both on-premises and in the cloud. Azure MFA enables you to eliminate passwords and provide a more secure way to authenticate.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-ad-fs-and-azure-mfa

Box 1: No

To log in to a Linux VM with Azure AD credentials, install the Azure Active Directory login VM extension.

Note: Azure AD Connect is the Microsoft tool designed to meet and accomplish your hybrid identity goals.

Box 2: Yes

If you deploy SAP VMs in a cross-premises scenario, where on-premises Active Directory and DNS are extended in Azure, it is expected that the VMs are joining an on-premises domain.

Box 3: No

Reference:

https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/deployment-guide

Box 1: Yes

To configure Azure AD single sign-on with SAP HANA, perform the following steps:

1. In the Azure portal, on the SAP HANA application integration page, select Single sign-on.

2. On the Select a Single sign-on method dialog, select SAML/WS-Fed mode to enable single sign-on.

Box 2: No

Box 3: No

Key security considerations for deploying SAP on Azure

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/saphana-tutorial

Box 1: Yes

The SAP Azure Enhanced Monitoring Extension builds on top of the Azure Diagnostic extension, which stores its data in an Azure Storage account that you specify.

Box 2: Yes

The Set-AzVMAEMExtension cmdlet updates the configuration of a virtual machine to enable or update the support for monitoring for SAP systems that are installed on the virtual machine. The cmdlet installs the Azure Enhanced Monitoring (AEM) extension that collects the performance data and makes it discoverable for the SAP system. The -OSType specifies the OS. Either Windows or Linux.

Box 3: Yes

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/diagnostics-extension-overview

https://docs.microsoft.com/en-us/powershell/module/az.compute/set-azvmaemextension

Box 1: "*/read"

"*/read" allows you to view everything in the subscription.

You need to grant an SAP administrator read-only access to the Azure subscription

Box 2: "Microsoft.Network/*/read"

The SAP administrator must be prevented from viewing network information.

When you integrate SAP Cloud Platform Identity Authentication with Azure AD, you can:

Control in Azure AD who has access to SAP Cloud Platform Identity Authentication.

Enable your users to be automatically signed-in to SAP Cloud Platform Identity Authentication with their Azure AD accounts. Manage your accounts in one central location - the Azure portal.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/sap-hana-cloud-platform-identity-authentication-tutorial