CCNA Describe Azure architecture and services Questions

GRS replicates data asynchronously to a paired secondary region. It provides protection against a complete regional outage without offering read access to the secondary copy, which keeps costs lower than RA-GRS. This meets the company's requirement.

Azure Batch is a managed service built specifically for parallel and large-scale batch computing. By using low-priority (Spot) VMs, you leverage Azure's surplus compute capacity at a substantial discount compared to pay-as-you-go pricing, while Azure Batch automatically schedules tasks, handles retries, and scales the pool based on the job's queue. Since your workload is daily, interruptible, and large, low-priority VMs are the most cost-effective and operationally appropriate choice.

Azure Event Hubs is a fully managed event streaming platform that ingests millions of events per second over AMQP or Kafka-compatible protocols. It partitions event data for ordering, retains events for replay, and scales via throughput units, making it the correct choice for high-volume telemetry and log pipelines.

Azure Files provides fully managed file shares that are accessible via the SMB protocol, which can be mounted by multiple Linux VMs concurrently. These shares reside in Azure storage accounts and can be accessed across availability zones, enabling shared read/write access for applications. This directly meets the requirement for a common file system accessible by several VMs simultaneously.

Azure Machine Learning is the correct answer because it is Microsoft's fully managed cloud platform for the entire machine learning lifecycle. It enables data preparation, model training with automated ML and hyperparameter tuning, model registration and versioning, deployment to Azure Kubernetes Service or other compute targets, and continuous monitoring of models in production. With integrated MLOps capabilities and a rich set of tools like the drag-and-drop designer and Jupyter notebooks, it is the dedicated service for building and operating custom ML models.

Azure Bastion is the correct answer because it is a fully managed PaaS service that provides secure, browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal. It is deployed into a virtual network and allows VM access over TLS without requiring any public IP address to be assigned to the VM itself. Additionally, Bastion protects against port scanning and allows organizations to enforce Azure AD conditional access policies, making it the ideal solution for secure VM administration.

JIT VM Access in Microsoft Defender for Cloud is a network-security feature that creates time-limited rules in an NSG (and optionally Azure Firewall) to permit inbound traffic to a VM's management port — commonly 3389 for RDP or 22 for SSH — only from the requesting user's IP address. When the approved session ends or the configured duration expires, Defender for Cloud automatically reverts the rules, removing the port exposure. This shrinks the VM attack surface by ensuring management ports are closed at all other times and aligns with the principle of least-privilege network access.

Azure Functions is a serverless compute service that supports multiple languages, including Python. It can be triggered by Azure Blob Storage events (e.g., a new blob created) to automatically run the function code. The consumption plan bills only for the execution time, and there is no infrastructure to manage. This matches all the requirements perfectly.

Azure Site Recovery (ASR) gives you full control over the target region: when you configure replication, you can select any Azure region where ASR is available and that supports the required VM size and storage types. Microsoft recommends paired regions for automatic failover alignment and reduced latency, but this is a best practice, not a mandate. You can even replicate to a region outside your home geography, provided your subscription has access and you account for data residency policies.