Pass Microsoft Certified: Azure for SAP Workloads Specialty Certification Exams in First Attempt Easily

Microsoft Certified: Azure for SAP Workloads Specialty Certification Practice Test Questions, Microsoft Certified: Azure for SAP Workloads Specialty Exam Practice Test Questions

Want to prepare by using Microsoft Certified: Azure for SAP Workloads Specialty certification exam practice test questions efficiently. 100% actual Microsoft Certified: Azure for SAP Workloads Specialty practice test questions and answers, study guide and training course from Exam-Labs provide a complete solution to pass. Microsoft Certified: Azure for SAP Workloads Specialty exam practice test questions and answers in VCE Format make it convenient to experience the actual test before you take the real exam. Pass with Microsoft Certified: Azure for SAP Workloads Specialty certification practice test questions and answers with Exam-Labs VCE files.

Azure IaaS for SAP

9. Azure Storage (Part Two)

There are two types of discs that can be provisioned for an Azure VM. Unmanaged discs reside inside a storage account, which you would provision and maintain under your Azure subscription. This includes, but is not limited to, maintaining Azure storage thresholds by ensuring that storage has no heating capacity or throughput limitations. If more throughput and/or capacity is required, then you will need to create a new storage account while using the managed storage. The Storage Account Control Plane is maintained by Microsoft, which means you just select the size and access tier required and let Microsoft handle the rest for you. You will need to understand the different disc types and where they are used. If you aren't familiar with disc types, please visit the Microsoft Azure Documentation site for more detail. As this is an SAP-related course, we will focus on Premium, SSD, and Ultra disks. These can give you a maximum throughput of 900 MB per second or 2000 Mbps, respectively, while scaling to a maximum IOPS of 200 to 160,000. In case of Ultra disks, please check availability using the Azure Service Availability Site, as not every disc can be attached to every single VM SKU, and not every VM SKU is available in every region. So this is an important consideration that you need to keep in mind while designing your SAP system in order to ensure that your managed discs follow your high availability strategy. By default, discs and their copies are provisioned with different stamps to protect against single-stamp hardware or software failures. This can also be extended to availability zones, where you can distribute your managed discs across different datacenter zones, i.e. within that primary region. At this point in time, it is important that you read SAP Support Node Number 297-2496, which lists supported file systems for different operating systems and databases for both NetWeaver and SAP Hana. There are some restrictions around the use of NFS, which we will get to in the next slide. I will now cover the Azure Write Accelerator, which is an important disc feature only available for M series machines running on Premium Storage with Azure managed disks. This is an important design consideration when it comes to deciding which managed disc to attach to what VM series, and this is the perfect example. Question: The sole purpose of its functionality is to improve I/O latency of writes. That's the reason why it's highly recommended for log files from the perspective of SAP. Write accelerators shouldn't be enabled on DBMS data drives as they have been optimised for log operations. As a result, it is recommended to enable it when logging or redoing logging in ADBMs. There are other considerations when using Write Accelerator: disc caching should be turned off or set to read only, and disc snapshots are not supported. Azure Backup would automatically exclude those drives by default. You also need to take note that only smaller I. O. sizes are taking the accelerator path. That is, files smaller than 512 KB. Let's now have a look at the different storage types supported by SAP. SAP has set up the minimum certified storage requirements. Azure Premium Storage Hosting The SAP Hana logs folder hanalog can be stored on PremiumStorage with Azure write accelerator enabled. As for Hana data, it can be placed on both Premium Storage and UltraDisc without an Azure write accelerator. As we have discussed earlier, Azure Ultra Disks is another high-performing storage offering from Microsoft. This offering does not bind disc size to capabilities. You can define disc size at 4 GB to 65 kg, IOPS at 100 to 160,000, and finally storage throughput, which could range from 300 to 2000 MB per second. Ultra Disks offer better read latency in comparison to Premium Storage, and this can be useful to speed up the startup times and loading of data into memory. For SAP Hana, please make sure you check disc and VM availability, as those combinations don't currently exist in every region. Microsoft developed Azure NetAppFiles in close collaboration with. NetApp as a true Azure first-party service sold and supported by Microsoft There are a few very important key takeaways to consider. Azure NetApp Files is a fully managed cloud service. Customers do not perform any storage or administrative tasks or need to worry about any of the underlying infrastructure or management. Also, this is not a hosting arrangement. Customers don't have to purchase any gear or sign any long contracts up front. Azure NetApp Files is sold and supported by Microsoft as a true first-party service, not a marketplace offering. One purchase provides all the necessary components. No separate licenses, support agreements, or addons from NetApp or any other vendor are required. ANF appears as just another line item on the customer's Azure bill. The customer's existing support agreement also applies to ANF, and Azure takes the first call for support. As a full Azure service, ANF can be consumed against an EA agreement and built on an hourly basis, just like any other Azure native service. ANF includes portal integration, access from Rest APIs, CLI PowerShell, and the availability of associated SDKs. It emits telemetry, metrics, and monitoring the same as any Azure service to ensure that ANF is a seamless and easy-to-consume experience for customers. It is compensated and retires quota, and ACR is the same as for any other Azure product too.This provides streamlined accountability and ownership. Azure NetApp Files is built using the power of Data on Tap, the world's number one storage OS with a deep install base and the market-leading Nas vendor in enterprise external storage. This comes with a rich portfolio of complete and proven protocol support, with powerful data management features, high availability, data protection, efficient and performant data management features, and high performance. Customers who want to migrate their enterprise file-based storage workloads from on-premises to the cloud are likely to encounter difficulties. Running that workload on NetApp security and enterprise readiness is primary to establishing credibility with top-tier customers through leveraging the best of both Azure and NetApp. Both NetApp and Microsoft offer critical capabilities in this area, including Phipps 142 compliant data encryption, address RBAC, and network ACLs. We'll show this in more detail in an Architecture Focus section later. Hybrid is a concept that is core to the identities of both Azure and NetApp. Both companies believe that customers should have a choice regarding where to place their data. Both are aligned in their work to enable data mobility and will be building increasingly powerful and flexible replication and migration features as they continue forward. One thing you need to be mindful of when basing your storage design around NF for both Analog is that you need to ensure that NFS version 4 is used. NFS version three isn't supported when ENF is the underlying storage system, but shared ANF volumes with NFS version three or version four can be used. Please keep this in mind.

10. Azure Storage (Part Three)

According to SAP storage design considerations, HLI comes with four times the memory size of storage volume size.As you can see from the example below, an S 72HL July skew will have 1280GB for the Hana data drive, 512GB for the Hana log drive, 768GB for the Hana shared drive, and 512GB for the Hana log backup drive. So when you start thinking of storage, you need to factor this into your design to ensure that you can estimate the right skew size for your hoi. If you require more storage, then you can order extra storage in 1 TB blocks, which can be attached to extend existing volumes or create new volumes altogether. These volumes will be mapped using NFS version four one.Also, you need to keep in mind that you have a file size limitation of 16 terabytes. If you exceed this file location size, you will start experiencing errors, which would cause the index server to crash. The last thing here is to understand the encryption address feature and the options you have with different HLI revisions and types. With the Type 1 class of SKUs, the volume the boot line is stored on is encrypted. In revision. Three large hana instance stamps Using the Type Two class of SKUs of Hana LargeInstance, you need to encrypt the bootloader with OS methods. In revision four Hana Large Instance tabs using TypeTwo units, the volume the bootlan is stored on is encrypted at rest by default as well.

11. Azure Networking (Part One)

In this section we will go through the necessary components for designing our network. Azure Virtual Network, or VNet for short, is a core foundation of your infrastructure implementation on Azure. You can consider it as a ringfence where your resources can communicate freely. The VNET can be a communication boundary for those resources that need to communicate together. You can have multiple VNETs in your subscription. If they weren't connected, we call them "peers" in Azure World. Then there will be no traffic flow in between. They can also share the same IP range. It is very important to understand the requirements and set up your VNet correctly, because changing it at a later date, especially with production workloads running on it, could cause downtime. When you provision a VNet, an address space needs to be allocated to it from private address blocks that are ten (0080 00:16) and 170 216 00:12. If you are planning to connect multiple venues together, then you cannot have an overlapping address space. You also need to factor in the IP range you use on premise. This cannot crash or overlap with IP addressing in Azure, especially if you will be connecting on-premises to Azure via an express route or a side-to-side VPN. We will cover connectivity later in this section by configuring VNET with an IP address space. This is analogous to a DHCP service sequentially assigning IPS to resources as they are created. Or you can set IP to static in the properties of the VM Nic card, and that's best practise if you don't want the IP to change. You can also configure your VNet with your DNS server's IP addresses so that resources can resolve services on premise and vice versa. VNETs can be split into multiple subnets. You need to have at least one subnet when you create your VNet. Subnets are used to split your VNet into multiple segments, so you don't land on a flat network. Flat networks lack control and are hard to govern. For example, you can have a subnet for your Internet-facing services, another subnet for your applications, another for databases, and maybe one for your Active Directory servers. It is best practise to segment databases depending on application server roles, so you can isolate tiers from each other and apply security rules and governance on top. We mentioned previously that a VNet is a boundary for your resource communication. So if you create subnets, they will communicate freely between each other. So you might be wondering: How do we apply controls? In this case, network security groups, or NSGs, are the control plane that we use to filter traffic. NSGs are stateful but simple firewall rules based on source and destination, IP, and port. What I meant by "statewide to hear" is that if you have a rule outbound for Server A to talk to Server B, then Server B will be able to communicate with Server A over the same session. This would give you a lot more control over your network and what you can and cannot say to each other. So you can lock down traffic only to the necessary points, and hence you can stay compliant no matter if other ports are opened. We also mentioned earlier about how two VNETs can't communicate with each other unless they are peers. VNETs can be peering across different subscriptions and regions. The only requirement is not having an overlapping IP addressspace on each of the VNETs which you want to. Peer Peering will use Microsoft Highspeed Backbone totransmit data through, so you will be gettingfast speeds high throughput and low latency. There are two services that fall under Networking Service Endpoint, which is a way of landing a paused service such as Azure SQL or Azure Storage, among other services, on a subnet through an optimised route using Microsoft Backbone. Private Endpoint is a network interface on your VNet with a private IP address, in front of a Private Endpoint-enabled Azure service. This effectively places the service on your V. Nine.

12. Azure Networking (Part Two)

We'll go over the various types of connectivity for Onpremise, but first, in order to have that kind of connectivity, you'll need to create a subnet called the Gateway Subnet Net. This subnet would be designated for your virtual gateway. When you create the virtual gateway, you will be prompted for two options: VPN or Express Rootgateway. If you select VPN, then you won't be able to connect an Express Route circuit to it. But if you choose Express Route VirtualGateway, then you can connect both. There are two types of VPN. The . Two-side VPN is used for testing and gives the lowest throughput. You can have a limited number of connections, and as the name denotes, it's a single computer connection to Azure, which is normally used for developers. The site-to-site VPN connection can offer better benefits by bridging two networks. It could be your on-premises connection to the public Internet using an encrypted tunnel. This kind of connection is not recommended for production as there is no SLA. Microsoft won't offer any SLA on the Internet. This type of connection can be used as a backup to the recommended connection to Azure, which is the Express Route. Express Root is a dedicated circuit using hardware installed on your own premises for your private data center, which has a dedicated link to Microsoft Azure Edge devices. Express Road is safer and more resilient than a normal VPN as it provides two connections through a single circuit. You can always add site redundancy by provisioning a second Express Route on another site and using network routing to route traffic through the secondary connection if the primary goes offline. Express Route is critical for communication between application VMs running in AzureVNet and on-premises systems, as well as your HLI servers. Fastpath helps route traffic between SAP application servers running inside an Azure VNet and your Holi according to an optimised route that bypasses the virtual network gateway and hops directly through edge routers to the Hoi servers. This enables low latency. You need to remember that an Ultra Performance Express Routegateway is required to have the fastpath feature. Global Reach adds icing on the cake by enabling transit between on-premises and HLS servers to hop via the Express Route circuit on-premises directly to the Express Route circuit. For HLI, this would bypass your venue gateway and reduce latency. This is a paid add-on that you need to put on top of your own premised Express Route. To use this feature, you will need to have Express Route Premium Status. Last but not least, from a connectivity perspective, Virtual One, or Vone, brings many networking services such as connectivity, VPN, ExpressRoute, et cetera, routing, and security together under the same operational interface. The V One architecture is a hub and spoke architecture, bridging branches together through scale and performance. Microsoft has come up with a new framework called the Cloud Adoption Framework, coupled with a well-architected framework, to drive the building blocks for the enterprise-scale landing zone. This landing zone brings all security policies and compliance monitoring, backup NDR auditing, and logging into a strategic method built on a hub-and-spoke model. We can't talk about a hub without talking about spokes. They live together. The hub is the main landing for all core services such as connectivity and identity. You can imagine spokes as your pots of workloads, and I define a workload as one or more. Servers or services could be IAS or PAS that effectively bring a meaningful service to the consumer. Those components for a single workload are underpinned and managed by a set of rules, depending on whether that environment is production or nonproduction user-defined. Routing or UDR is very important in this scenario as it dictates how traffic can flow from each of the spokes to the hub. And if it can't flow down to the premise, it also controls traffic coming back up to each of the spokes. These routes are configured by an administrator, but there are other routes that exist in system routes, which you should be aware of. For example, when having a virtual network gateway, it sets the default routes to be the gateway itself. Also, if you peer Vnets together, routes would automatically populate the routing table to enable traffic flow. This is all done through BGP.

13. HLI

Now let's look at the high-level architecture for SAP Hana's large instance. data centre implementation. This diagram shows your typical scenario for an organisation running SAP Hana on large instances and Shenz. This is just high-level architecture. Some components are invisible on this diagram, otherwise it would become unreadable and hard to follow. I will go through each component in detail, so let's start from the left of the diagram, walking towards the right. The first thing we see straight away isthat we have a subscription in an Azureregion, call it Region One with Application ServerVMs running inside that virtual network. In this example, we have SAP WebDispatcher, SAP Application, and SAP Central Services VMs that would be running in high availability across different availability zones. In order to really give you that SLA When Microsoft provisioned large Hana instances, they assigned them to a specific VNet. So in order to install SAP Hana and configure your server, you would need a jump box running inside that VNet or another VNet that is peering with this VNet. The Express Route circuit for Hoi would connect to your Express Route gateway on that vein, which would enable your traffic to flow. You always have to bear in mind thatHoi have no access to the Internet directly. Some of the previous slides discussed how you can update yourHoi using Red Hat or Susie Management servers. Please make sure to set up Express Route FastPath, because it would enable efficient routing between your application servers in your VNETs and your HLI servers. Also, in this particular scenario, the customer has an ExpressRoute circuit running from on-premises to Azure. Using Express Route, Global Reach would bridge those two circuits together, that is, MSECustomer and MSEHoi, so traffic would not hop over the VNX to minimise latency. To extend this architecture further and provide regional availability, another Azure region was prepared with a duplicate environment. This could be a smaller-scale environment, like smaller SKUs, especially around Azure VMs. You could also adapt agility by replicating VMs to region two using Azure SiteRecovery (ASR). This would only incur storage costs. VMs will be provisioned on failure. SAP must be in the same SKUs as changing Hoi SKUs isn't as easy and quick as changing Azure VM SKUs. Both HLIS will be replicating using Hana system replication in async mode. You can connect your Express Route circuits using Global Reach to enable HSR traffic, that is, storage replication, to flow between two Hoi regions.

14. Security and Identity

One of the important pillars of SAP and Azure is how to provide authentication and authorization in addition to data and infrastructure security. This section will dive into some of the technologies used in SAP on Azure designs and implementation. Azure AD Azure Active Directory is a cloud-native enterprise identity provider for identity and access management. It enables capabilities such as single sign-on, SSO, and multi-factor authentication. It has capabilities to protect your users and their identities through machine learning and artificial intelligence in order to map their behaviour and use of identity detection and flag anomalies to administrators or even to users themselves through their smart devices. In the case of a breach, AzureAD can bridge your on-premises active directory. To create a hybrid identity provider, it requires installing Azure AD connectors on premises and synchronising your on-premises directory with Azure. This will provide you with a single point of contact to manage and administer your identities, including capabilities such as password, self-service, and password right back. It takes the burden of managing those "forgot my password" calls and gives you time to focus on what matters most, which is to ensure your business and services are running efficiently. When we talk about multifactor authentication, we mean something you are, your username, something you remember, your password, and something that you own or have, which is your smartphone. A combination of Azure AD policies through conditional access and MFA would push your security posture around identity to the optimum level and ensure complete visibility and governance when it comes to complying with cybersecurity and organisational identity policies. Both SAP NetWeaver and SAP Hana can be enabled for single sign on.This will give you control over user access to both flavours of SAP systems through Azure AD. SAP NetWeaver supports both SAML service provider-sanitized SSO and O. You need a minimum of SAP NetWeaver 7.2 or later. SAP Hana supports identity provider IDP over SSL and requires Hana Studio and the SSA Administration Web Interface installed on the Hana instance. Furthermore, SAP Hana supports just-in-time user provisioning, with Azure AD provisioning services allowing the automatic creation of user accounts in the top-level identity authentication service, reducing admin efforts and the risk of inconsistencies in spun SSL. This option allows your end users to sign in via the application's sign in page, which sends an authorization request to the identity provider Azure AD. Once the IDP authenticates the user's identity, the user is logged into the application, and the IDP initiates SSL. With this option, your end users must login into your identity provider's SSO page, that is, the Azure AD login page, and then click an icon to log into their application. Microsoft Azure also provides other security tools such as role-based access control, or RBAC. This controls access to the Azure control panel, such as logging in through the portal, and creates configured delete resources, such as virtual machines. You can grant just enough access to enable the user to perform their roles, such as the VM Operator Role, which would grant the user the ability to start and stop a VM using tools such as the Portal PowerShell or Azure CLI, but would not allow them to delete the VMs. That kind of control is vital when you have multiple teams working on the same shared environment. Hence, you can grant support personnel the operator role permissions to control the stopping and starting of resources, while subscription owners or service administrators could have owner rights on that resource. Another useful tool when it comes to accessing resources is the Azure Security Center feature called Just in Time Access, or Git. For sure, this will assign a time limit to elevated user rights for a resource. For example, support personnel need to add a new disc to a VM. The user sends a request to the Azure Security Center to elevate their privileges, mentioning the reasoning behind the request. When the manager issues an approval, the support personnel will have new privileges to do their job for a particular duration before it comes out. This is good practise when you don't want to grant them permanent access to resources or when you forget to reduce their privileges after their work is completed. Using JIT keeps logs of the activities and permissions privileged Identity Management PIM this is a powerful tool which ispart of Azure Ad Premium P, two licenses. It is a role activation tool. In Azure AD, the user has to be enrolled into PIM, which means the user needs to have MFA enabled on their account. The administrator will assign the appropriate role with elevated access to a user, and that role can be activated through access requests and approval processes. This way, you can keep an audit trail on the number of users with those privileges and also minimise users with permanent admin roles. Identity and Access Management, or IDAM, uses RBAC. in applying the correct permissions or resources, resource groups, and the Azure Subscription Layer You need to be aware that RBAC roles are inherited by default from the subscription level and cascade through the individual resources. You can alter those permissions at the resource group level. The resource groups could be an application tier boundary, like web applications that can be managed by the web team or database tiers managed by a DB team, etc. You could use resource groups to group all servers for a single service and grant permissions to the service owners. The Azure Resource Manager approach makes applying permissions at a granular level possible. Lock Azure locks are a useful feature for any resource. Locks have two actions. The first one is not deleted. Authorized users can read and modify a resource but cannot delete it. They have to remove the lock to delete, hence an extra layer of protection, especially against accidental deletion such as human error or even a rogue script that could delete all your production resources in an instant. This is why security professionals look at both RBAC and Azure locks together for full control. The second lock action is read only, which means authorised users can read but cannot do anything else like modify or delete. Every resource has the capability of being logged. Logging, depending on the resource, can be for administrative actions, security changes, service health and alerts, etc. for auditing our actions on the AzureControl plane, such as creating or deleting resources These two, in combination, can best be described as a Loganalytics workspace. Loganalytics, which we will cover under monitoring, is a tool in Azure used to log data and run complex queries on big data sets. It's used mainly to analyse and visualise data gathered from Azure. Azure policy is a set of security rules and organisational standards applied to Azure resources to assess compliance at various levels. For example, you can set a policy to audit VMs that have Azure disc encryption enabled. This would audit all VMs and return anything that isn't compliant with that policy. It could be an enforced policy, which means it can take action to bring that resource to compliance. In our example, it would apply Azure disc encryption to those VMs. Management groups are a logical layer where you can bring subscriptions together and apply a set of policies across the board. For example, a manager could be grouped for development subscriptions with policies to only allow creation of certain VM SKUs or resource locations. As we go through the next modules, things will become clearer, as we will use some of these technologies.

So when looking for preparing, you need Microsoft Certified: Azure for SAP Workloads Specialty certification practice test questions and answers, study guide and complete training course to study. Open in Avanset VCE Player & study in real exam environment. However, Microsoft Certified: Azure for SAP Workloads Specialty exam practice test questions in VCE format are updated and checked by experts so that you can download Microsoft Certified: Azure for SAP Workloads Specialty certification exam practice test questions and answers files in VCE format.