To solve this, you must configure both the resource application (App1) and the client application (App2).

App1, the resource API, must first define the permissions it exposes to other applications. This is accomplished by creating an "App role" (like the 'Writer' role). Therefore, the App roles blade is used to configure App1.

App2, the client application, must then request one of the permissions exposed by App1. This is done on the API permissions blade of App2, where you add a permission and grant it consent. Once granted, Azure AD will include the corresponding 'Writer' role claim in the access token it issues for App2 to call App1.

Microsoft Learn | Microsoft Entra ID Documentation: In the article "Add app roles to your application and receive them in the token," the procedure for a resource API to define its roles is detailed.

Section: "Create app roles by using the Azure portal"

Content: This section explicitly states, "To create an app role by using the Azure portal's user interface: 1. Sign in to the Microsoft Entra admin center... 3. Browse to Identity > Applications > App registrations and then select the app you want to define app roles in... 4. Under Manage, select App roles, and then select Create app role." This confirms that App roles is the correct blade for App1.

Microsoft Learn | Microsoft Entra ID Documentation: The guide "Quickstart: Configure a client application to access a web API" explains how a client app requests permissions.

Section: "Add permissions to access the web API"

Content: This section provides the steps for the client application (App2 in this scenario): "1. Under Manage, select API permissions > Add a permission. 2. Select the My APIs tab. 3. In the list of APIs, select your web API registration... 4. Select Application permissions... 5. In the list of permissions, select the check box next to [the role you defined]... 7. Select Grant admin consent..." This confirms that API permissions is the correct blade for App2.

The Azure portal’s Purchase reservations blade contains the reservation-pricing “savings estimator.”

After you choose resource type = “SQL Database”, select scope, term, and region, the blade immediately compares pay-as-you-go cost with the reservation price and shows the percentage and monetary savings. Microsoft’s official documentation directs customers to this blade when they are only evaluating reserved capacity so they can “see the savings before you buy.” Neither the SQL Database resource view nor Azure Advisor exposes this interactive estimator for SQL Database reservations.

B. Advisor provides high-level reservation recommendations, but it does not contain the detailed estimator; it links you to the Purchase Reservations experience for exact savings.

C. The SQL Database blade shows performance and pricing tier information but has no function to calculate reservation savings.

1. Microsoft Docs – “Buy reserved capacity for Azure SQL Database”

Steps 3-5: “In Cost Management + Billing > Reservations > Purchase reservations…the portal shows how much you can save compared to pay-as-you-go.” (https://learn.microsoft.com/azure/azure-sql/database/reserved-capacity-overview

§‘Purchase reserved capacity’

para. 4)

2. Microsoft Docs – “Save on costs with Azure Reservations”

“Estimate savings in the purchase experience.” (https://learn.microsoft.com/azure/cost-management-billing/reservations/save-compute-costs-reservation?tabs=azure-portal

‘Purchase reservations’ section

para. 3)

3. Microsoft Docs – “Advisor cost recommendations”

notes that Advisor “recommends” but redirects to Reservations for pricing details. (https://learn.microsoft.com/azure/advisor/advisor-cost-recommendations

para. 1)

To connect Azure Logic Apps to an on-premises SQL Server without a VPN, the designated solution is the on-premises data gateway. This gateway acts as a secure bridge, relaying data between on-premises data sources and Azure cloud services. The gateway is installed on a server within the on-premises network.

In Azure, you must create a corresponding connection gateway resource. This resource acts as a pointer to your registered on-premises gateway installation. When you configure the SQL Server connector in your Logic App, you select this gateway resource to route the connection securely to your on-premises Server1 database. This architecture avoids exposing the on-premises server to the internet or requiring a VPN.

Microsoft Documentation, "Connect to on-premises data sources from Azure Logic Apps": "Before you can connect logic apps to on-premises data sources, download, install, and set up an on-premises data gateway. The gateway works as a bridge that provides quick data transfer and encryption between data sources on premises... After you install the gateway on a local computer, you can then create a gateway resource for the gateway in Azure."

This documentation explicitly outlines the two required components: the on-premises gateway installation and the gateway resource in Azure.

Microsoft Documentation, "What is an on-premises data gateway?": "The on-premises data gateway acts as a bridge to provide quick and secure data transfer between on-premises data... and several Microsoft cloud services. These cloud services include Power BI, Power Apps, Power Automate, Azure Analysis Services, and Azure Logic Apps."

This source confirms that the on-premises data gateway is the correct technology for connecting Logic Apps to on-premises data.

Microsoft Documentation, "On-premises data gateway architecture": "The cloud service stores the credentials for your on-premises data source in Azure Managed Connectors... The on-premises data gateway encrypts and sends the query and credentials to the Azure Service Bus... The Azure Service Bus sends the pending request to the gateway."

This explains the underlying mechanism, which uses an outbound connection to Azure Service Bus, aligning with the scenario where inbound connections are not permitted and Server1 itself lacks internet access (as the gateway can be installed on a different proxy/edge server).

Azure Databricks is an analytics platform optimized for big data and machine learning workloads. The most appropriate and recommended storage solution for persisting raw ingested data for these workloads is Azure Data Lake Storage (ADLS) Gen2. ADLS Gen2 is specifically designed for big data analytics, providing a highly scalable, cost-effective data lake with a hierarchical namespace. This structure is crucial for organizing and efficiently processing massive volumes of structured, semi-structured, and unstructured data using the parallel processing capabilities of Apache Spark within Azure Databricks.

A. Azure Files: This is a managed file share service (SMB protocol) intended for lift-and-shift applications, not for the high-throughput, parallel I/O required by big data analytics platforms.

C. Azure SQL Database: This is a relational database (OLTP) optimized for transactional workloads with structured data, not for storing and processing large-scale, diverse raw data sets.

D. Azure Cosmos DB: This is a NoSQL database designed for low-latency, high-availability operational applications, making it less cost-effective and suitable for bulk data storage and batch analytics.

1. Microsoft Learn

Azure Databricks Documentation

"What is a data lakehouse?": This document explicitly states

"The data lakehouse architecture is enabled by a new

open

and standardized system design: storing data in open-source file formats (like Parquet) in a data lake (like Azure Data Lake Storage Gen2)

and having a transactional metadata layer on top (like Delta Lake)." This positions ADLS Gen2 as the foundational storage layer.

2. Microsoft Learn

Azure Databricks Documentation

"Tutorial: Azure Data Lake Storage Gen2

Azure Databricks & Spark": The introduction of this tutorial states

"This tutorial shows you how to connect your Azure Databricks cluster to an Azure storage account with Azure Data Lake Storage Gen2 enabled." This demonstrates the primary and intended integration pattern.

3. Microsoft Learn

Azure Architecture Center

"Modern analytics architecture with Azure Databricks": In the "Data flow" section

step 1 describes data ingestion: "Raw structured

semi-structured

and unstructured (text

image

audio

and video) data is ingested... and stored in Azure Data Lake Storage Gen2." This reference confirms ADLS Gen2 as the designated persistence layer for ingested data in a standard Databricks architecture.

Azure Content Delivery Network (CDN) is the correct choice for storing content close to end users. A CDN is a globally distributed network of servers (Points of Presence or POPs) that caches static content like images, CSS, and JavaScript files. When a user requests this content, it is delivered from the geographically closest POP, which significantly reduces latency and improves load times.

Azure Cache for Redis is the appropriate solution for storing content close to the application. It provides a managed, in-memory data store that applications can use as a high-performance cache. By caching frequently accessed data in Redis, which is located in the same Azure region as the application, the application can reduce its dependency on slower backend datastores (like SQL databases), thereby improving response time and scalability.

Azure Content Delivery Network (CDN) Documentation: "An Azure content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency."

Source: Microsoft Corporation. (2023). What is a content delivery network (CDN) on Azure?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/cdn/cdn-overview, Overview section.

Azure Cache for Redis Documentation: "Azure Cache for Redis provides an in-memory data store based on the Redis software. ... It improves the performance and scalability of an application that uses backend data stores heavily. It's able to process large volumes of application requests by keeping frequently accessed data in the server memory that can be written to and read from quickly."

Source: Microsoft Corporation. (2023). What is Azure Cache for Redis?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-overview, Introduction section.

An Azure SQL elastic pool is the optimal solution as it is specifically designed for managing and scaling multiple databases with varying and unpredictable usage demands. It allows the 20 databases to share a set of compute and storage resources at a set price. This model provides dynamic scaling of resources among the databases as needed, which directly addresses the varying usage patterns and minimizes costs by preventing over-provisioning for each database's peak load. The Azure SQL Database service meets the 99.99% uptime SLA requirement (in the General Purpose tier) and supports reserved capacity for the vCore purchasing model, fulfilling all constraints of the scenario.

A. A single Azure virtual machine does not provide the required 99.99% SLA and lacks the built-in dynamic compute scaling capabilities of a PaaS offering like Azure SQL Database.

B. While 20 serverless databases would provide dynamic scaling, an elastic pool is more cost-effective for managing a group of databases with varying usage by pooling resources, which better aligns with the cost minimization requirement.

C. Using an availability set for Azure virtual machines only increases the SLA to 99.95%, which is below the 99.99% requirement, and it still does not provide automatic, dynamic compute scaling.

1. Microsoft Learn

"Elastic pools in Azure SQL Database": This document states

"Elastic pools are a simple

cost-effective solution for managing and scaling multiple databases that have varying and unpredictable usage demands." It highlights how pools are ideal for SaaS applications where databases share resources

leading to cost savings.

Source: https://learn.microsoft.com/en-us/azure/azure-sql/database/elastic-pool-overview (Section: "When to consider a SQL Database elastic pool")

2. Microsoft Azure

"SLA for Azure SQL Database": The official SLA documentation confirms that the General Purpose service tier for Azure SQL Database

which can be used with elastic pools

provides an uptime guarantee of ≥99.99%.

Source: https://azure.microsoft.com/en-us/support/legal/sla/sql-database/v16/ (Section: "Details")

3. Microsoft Learn

"Prepay for Azure SQL Database compute resources with reserved capacity": This document confirms that reserved capacity is available for Azure SQL Database elastic pools using the vCore-based purchasing model

which satisfies the requirement for reserved capacity.

Source: https://learn.microsoft.com/en-us/azure/azure-sql/database/reserved-capacity-overview (Section: "Purchase reservations")

4. Microsoft Azure

"SLA for Virtual Machines": The SLA for two or more VMs in an Availability Set is 99.95%

and for a single VM using Premium SSD

it is 99.9%. Neither meets the 99.99% requirement.

Source: https://azure.microsoft.com/en-us/support/legal/sla/virtual-machines/v19/ (Section: "Details")

The correct sequence to enforce a configuration on both new and existing Azure resources using Azure Policy involves three main steps: defining the rule, applying it, and then correcting any existing resources that don't comply.

1. Create an Azure policy definition that uses the deployIfNotExists effect: This is the first step where you define the compliance rule. The deployIfNotExists effect is specifically chosen because it can trigger a template deployment to create or configure a resource to meet a standard. In this case, it would define the rule that an SQL database must have Transparent Data Encryption (TDE) enabled and specify a template to run to enable it if it's found to be missing.
2. Create an Azure policy assignment: A policy definition has no effect until it's assigned to a scope (such as a management group, subscription, or resource group). This assignment applies the rule to all resources within that scope. During this step, a managed identity is also configured, which grants the policy the necessary permissions to run the remediation template.
3. Invoke a remediation task: By default, a policy assignment only applies to newly created or updated resources. To enforce the policy on existing resources (i.e., SQL databases that were created before the policy was assigned), you must create and run a remediation task. This task scans the assigned scope for non-compliant resources and executes the deployIfNotExists action on each one, bringing them into compliance.

Microsoft Learn, Azure Policy Documentation: The tutorial "Enforce template deployments with Azure Policy" outlines this exact sequence. It demonstrates creating a policy with a deployIfNotExists effect, assigning it, and then creating a remediation task to apply the policy to existing resources.

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage/enforce-template-deployment, specifically the sections "Create the policy definition," "Assign the policy," and "Remediate non-compliant resources."

Microsoft Learn, Azure Policy Documentation: The document "Remediate non-compliant resources with Azure Policy" details how remediation tasks work specifically with deployIfNotExists and Modify effects to bring existing resources into a compliant state after a policy has been assigned.

Reference: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources, see the "How remediation works" section.

1. Connecting without Prompt (SSO)

To enable users to sign in to an application using their Azure Active Directory (Azure AD) accounts, the application must first be registered in an Azure AD tenant. This app registration process creates an identity configuration for your application, allowing it to integrate with Azure AD.

For users on Azure AD-joined Windows devices, this registration enables a Single Sign-On (SSO) experience. When a user signs into their device, they receive a Primary Refresh Token (PRT). This token is then used to silently acquire access tokens for other Azure AD-registered applications, like App1, without requiring the user to re-enter their credentials.

An Azure AD managed identity is incorrect as it provides an identity for applications to authenticate to other Azure services, not for user sign-in. Azure AD Application Proxy is used for publishing on-premises applications, which is not the case here.

2. Access from Company-Owned Computers

A conditional access policy is the specific Azure AD tool designed to enforce access rules based on various conditions, or "signals." To meet the requirement of allowing access only from company-owned computers, an administrator would create a Conditional Access policy that applies to App1. This policy would be configured with a "grant control" that requires the user's device to be Hybrid Azure AD joined or marked as compliant. Since the company computers are Azure AD joined, this policy effectively restricts access to only those managed devices.

The other options are incorrect as they serve different purposes:

• Administrative units scope administrative permissions.
• Azure Application Gateway is a load balancer.
• Azure Blueprints and Azure Policy are used for governing Azure resources, not for controlling user access to applications based on device state.

Microsoft Learn | Microsoft identity platform documentation. "Quickstart: Register an application with the Microsoft identity platform." This document states, "To delegate Identity and Access Management functions to Azure Active Directory (Azure AD), an application must be registered with an Azure AD tenant."

Microsoft Learn | Azure Active Directory documentation. "What is a Primary Refresh Token?" It explains, "A Primary Refresh Token (PRT) is a key artifact of Azure AD authentication... It allows single sign-on (SSO) across the applications used on that device." This SSO capability is contingent on the application being registered in Azure AD.

Microsoft Learn | Azure Active Directory documentation. "What is Conditional Access?". The documentation defines it as follows: "Conditional Access is the tool used by Azure Active Directory to bring signals together, to make decisions, and enforce organizational policies."

Microsoft Learn | Azure Active Directory documentation. "Conditional Access: Grant." This source details the access controls available in a policy, including "Require Hybrid Azure AD joined device," which is a control used to ensure access is from a corporate-managed computer.

To estimate the costs of migrating an on-premises application like App1 to Azure, the Azure Total Cost of Ownership (TCO) Calculator is the most appropriate tool. It is specifically designed to help users compare the cost of running their existing on-premises workloads against the cost of running those same workloads in Azure, providing a detailed report on potential savings.

To minimize compute costs for a migrated application, particularly one running on Windows Server or using SQL Server, the Azure Hybrid Benefit is a primary cost-saving measure. This benefit allows you to use your existing on-premises licenses with Software Assurance on Azure, which can significantly reduce the costs of running virtual machines and databases by eliminating the software licensing fees from the Azure bill.

Microsoft Azure Documentation, "Azure TCO Calculator". The documentation states, "The Total Cost of Ownership (TCO) Calculator helps you to estimate the cost savings you can realize by migrating your workloads to Azure." This confirms its role as a pre-migration estimation tool.

Microsoft Azure Documentation, "What is Azure Hybrid Benefit?". The official documentation explains, "Azure Hybrid Benefit is a licensing benefit that helps you to significantly reduce the costs of running your workloads in the cloud. It works by letting you use your on-premises Software Assurance-enabled Windows Server and SQL Server licenses on Azure." This directly supports its use for minimizing migration costs.

Microsoft Azure Documentation, "Azure Advisor for cost optimization". Advisor provides recommendations to optimize costs for existing Azure resources, stating it "helps you optimize and reduce your overall Azure spend." It is not a tool for estimating costs for a new workload.

Microsoft Learn, "SC-100: Design a security posture management strategy", Module 2, Unit 5. This module discusses how compliance and security requirements often mandate predictable and stable infrastructure. This implicitly discourages the use of interruptible compute like Azure Spot VMs for such workloads, as their eviction model can conflict with availability requirements mandated by compliance standards.

The most effective strategy to minimize costs for a workload with predictable peak and off-peak times (such as standard business hours) is to reduce the allocated resources during the off-peak period. Creating an Azure Automation runbook to automatically resize the virtual machines to a smaller, less expensive size outside of business hours directly addresses this requirement. This is a form of scheduled vertical scaling (scaling down) that ensures you are not paying for unneeded capacity during periods of low demand.

B. Configure the Scale Up settings for a web app.

This is typically a manual, one-time change of an App Service Plan's pricing tier and is not an automated, recurring strategy for daily cost optimization.

C. Deploy a virtual machine scale set that scales out on a 75 percent CPU threshold.

This describes reacting to high load by adding more instances (scaling out), which increases cost. It does not address the primary goal of reducing costs during predictable low-traffic periods.

D. Configure the Scale Out settings for a web app.

This applies to Azure App Services (PaaS), not virtual machines (IaaS). While it can be used for scheduled scaling, option A is specific to the virtual machine context implied by the answer choices.

---

1. Azure Automation Overview: Official documentation states that a common use case for Azure Automation is to "Start and stop resources on a schedule. Shut down VMs during off-hours and turn them on in the morning for your dev/test environments." Resizing is a similar

supported operation.

Source: Microsoft Learn

"Azure Automation overview"

Section: "Process automation".

2. Resize a Virtual Machine: The official documentation confirms that virtual machines can be resized to change their CPU

RAM

and other properties

which directly impacts their cost. It also notes this can be automated.

Source: Microsoft Learn

"Resize a virtual machine"

Section: "Resize a VM".

3. Overview of Autoscale in Microsoft Azure: This document distinguishes between horizontal scaling (changing the number of instances

as in options C and D) and vertical scaling (changing the size of instances

as in option A). For predictable workloads

scheduled scaling is a key cost-management feature.

Source: Microsoft Learn

"Overview of autoscale in Microsoft Azure"

Section: "Horizontal vs. vertical scaling".