Technique
- Open every tab (Overview, Existing environment, Requirements, sometimes Planned changes) and skim once.
- Read the requirements slowly and circle the constraint words: least cost, least administrative effort, must not be reachable from the internet, within 1 hour, must not delete.
- For each question, find the one requirement it maps to, then eliminate options that are possible but break the constraint word.
- Do not import assumptions from your own company. If the text does not say there is a VPN, there is no VPN.
Overview
Contoso has offices in Sydney and Melbourne and one Azure subscription, Sub1, in tenant contoso.com. All users are synced from on-premises AD DS with Entra Connect. There is no VPN or ExpressRoute.
Existing environment
| Resource | Detail |
|---|---|
| VNet1 | 10.10.0.0/16, Australia East. Subnets Web (10.10.1.0/24) and Data (10.10.2.0/24) |
| VM-Web1, VM-Web2 | Subnet Web |
| VM-SQL1 | Subnet Data |
| VNet2 | 10.20.0.0/16, Australia Southeast. Contains VM-App1 |
| contosodata1 | GPv2, LRS storage account; container invoices |
| RSV1 | Recovery Services vault, Australia East |
| RG-Prod | Holds everything above |
Requirements
- VM-App1 must reach VM-SQL1 by private IP at the least cost.
- The invoices container must be inaccessible from the internet; only subnets Web and Data may access it. Minimise cost.
- Invoices older than 120 days must move to Archive automatically; older than 7 years must be deleted.
- Group Helpdesk-AU must be able to restart VMs in RG-Prod but must not delete them or change network settings.
- VM-SQL1 must be recoverable in Australia Southeast within 1 hour if Australia East fails.
- Accidental deletion of RG-Prod must be prevented.
- A new web app runs in App Service with two staging environments and automatic scaling.