nerdexam
Microsoft

AZ-120 · Question #86

Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a manufacturing company that has 15,000 employees. The company uses SAP for sales and manufacturing. Contoso has sales offices in New York and…

The correct answer is C. Azure Active Directory (Azure AD) Privileged identity Manager (PIM). Azure AD Privileged Identity Management (PIM) is the correct answer because it provides exactly the approval workflow described: before an administrator can activate a privileged role (such as making changes to SAP-hosting VMs), PIM can require another designated approver…

Design and implement an infrastructure to support SAP workloads on Azure

Question

Case Study 2 - Contoso, Ltd Overview Contoso, Ltd. is a manufacturing company that has 15,000 employees. The company uses SAP for sales and manufacturing. Contoso has sales offices in New York and London and manufacturing facilities in Boston and Seattle. Existing Environment Active Directory The network contains an on-premises Active Directory domain named ad.contoso.com. User email addresses use a domain name of contoso.com. SAP Environment The current SAP environment contains the following components:

  • SAP Solution Manager
  • SAP ERP Central Component (SAP ECC)
  • SAP Supply Chain Management (SAP SCM)
  • SAP application servers that run Windows Server 2008 R2
  • SAP HANA database servers that run SUSE Linux Enterprise Server 12

(SLES 12) Problem Statements Contoso identifies the following issues in its current environment:

  • The SAP HANA environment lacks adequate resources.
  • The Windows servers are nearing the end of support.
  • The datacenters are at maximum capacity.

Requirements Planned Changes Contoso identifies the following planned changes:

  • Deploy Azure Virtual WAN.
  • Migrate the application servers to Windows Server 2016.
  • Deploy ExpressRoute connections to all of the offices and

manufacturing facilities.

  • Deploy SAP landscapes to Azure for development, quality assurance,

and production. All resources for the production landscape will be in a resource group named SAPProduction. Business goals Contoso identifies the following business goals:

  • Minimize costs whenever possible.
  • Migrate SAP to Azure without causing downtime.
  • Ensure that all SAP deployments to Azure are supported by SAP.
  • Ensure that all the production databases can withstand the failure of

an Azure region.

  • Ensure that all the production application servers can restore daily

backups from the last 21 days. Technical Requirements Contoso identifies the following technical requirements:

  • Inspect all web queries.
  • Deploy an SAP HANA cluster to two datacenters.
  • Minimize the bandwidth used for database synchronization.
  • Use Active Directory accounts to administer Azure resources.
  • Ensure that each production application server has four 1-TB data

disks.

  • Ensure that an application server can be restored from a backup

created during the last five days within 15 minutes.

  • Implement an approval process to ensure that an SAP administrator is

notified before another administrator attempts to make changes to the Azure virtual machines that host SAP. It is estimated that during the migration, the bandwidth required between Azure and the New York office will be 1 Gbps. After the migration, a traffic burst of up to 3 Gbps will occur. Proposed Backup Policy An Azure administrator proposes the backup policy shown in the following exhibit. Azure Resource Manager Template An Azure administrator provides you with the Azure Resource Manager template that will be used to provision the production application servers. Which Azure service should you deploy for the approval process to meet the technical requirements?

Options

  • AJust in time (JIT) VM access
  • BAzure Active Directory (Azure AD) Identity Protection
  • CAzure Active Directory (Azure AD) Privileged identity Manager (PIM)
  • DAzure Active Directory (Azure AD) conditional access

How the community answered

(18 responses)
  • A
    6% (1)
  • B
    6% (1)
  • C
    78% (14)
  • D
    11% (2)

Explanation

Azure AD Privileged Identity Management (PIM) is the correct answer because it provides exactly the approval workflow described: before an administrator can activate a privileged role (such as making changes to SAP-hosting VMs), PIM can require another designated approver - like an SAP administrator - to review and authorize the request, satisfying the notification/approval requirement.

Why the distractors are wrong:

  • A (JIT VM Access) controls inbound port access to reduce VM attack surface; it restricts network access, not administrative change approvals.
  • B (Identity Protection) detects risky sign-ins and identity-based threats automatically - it has no approval workflow for role-based administrative actions.
  • D (Conditional Access) enforces policy-based access rules (e.g., device compliance, MFA, location) at sign-in time but cannot trigger a human approval process before a specific action is taken.

Memory tip: Think of PIM as "Permission needs Permission" - an admin must request a privileged role, and a second authorized person must approve it before any action can occur, making it the only option here with a built-in human approval gate.

Topics

#Azure AD PIM#privileged identity management#SAP administrator access#JIT access

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-120 Practice