TPT Limited plans to migrate an SAP environment to Microsoft Azure with following requirements for the Azure network infrastructure: - Prevent the end users from accessing the database servers…

Question

Options

• AConfigure an infernal Azure Standard Load Balancer for incoming connections.
• BCreate a site-to-site VPN between the on premises network and Azure.
• CConfigure Azure Traffic Manager to route incoming connections.
• DSegregate the SAP application servers and database servers by using different Azure virtual
• EIn the same Azure virtual network, segregate the SAP application service and database servers

• A
  10% (3)
• B
  3% (1)
• C
  79% (23)
• D
  7% (2)

Explanation

Note: This question asks for two correct answers, but only "C" is listed - the second correct answer is almost certainly E (same VNet, separate subnets). The explanation below covers both.

C (Traffic Manager) is correct because it is a DNS-based global routing service that directs internet users to Azure-hosted SAP endpoints, satisfying the requirement to expose SAP systems over the internet without exposing backend database servers directly.

E (same VNet, different subnets) is the second correct answer because hosting app and database servers in the same virtual network but in separate subnets (enforced by Network Security Groups) achieves three goals at once: it isolates DB servers from end users, logically detaches app servers from DB servers, and keeps inter-tier traffic within the VNet - meaning no VNet peering fees, minimizing communication costs.

Why the distractors are wrong:

• A (Internal Load Balancer): Designed for private, internal traffic distribution - it has no public endpoint, so it cannot route internet users to SAP.
• B (Site-to-site VPN): Bridges on-premises networks to Azure; it doesn't address internet access for external end users or internal network segmentation.
• D (separate VNets): Segregates tiers, but cross-VNet communication requires VNet peering, which adds cost - violating the cost-minimization requirement.

Memory tip: Think "Traffic Manager = internet front door; subnets + NSGs = internal bouncer." Together they handle external routing and internal isolation cheaply.

No community discussion yet for this question.