To manage on-premises servers via Azure Arc, the Connected Machine agent is required for the OS, while the Azure Arc Resource Bridge is necessary to enable VM lifecycle management from the Azure portal.

Azure Automanage can automate the setup of best practices, while the Update Management Center (the successor to the old Update Management) provides a unified dashboard for the patching status of both Azure and Arc-enabled VMs.

Azure File Sync supports Windows Volume Shadow Copy (VSS), allowing users to use the ‘Previous Versions’ tab in File Explorer. Alternatively, you can restore files directly from snapshots taken of the Azure File share in the cloud.

Hotpatching is a feature exclusive to Windows Server Azure Edition. To use it on-premises, the server must be onboarded via Azure Arc to validate the licensing and manage the orchestration of the patches.

The Telemetry event log (under Applications and Services Logs > Microsoft > FileSync) provides granular local error codes. The Sync Health dashboard in the Azure portal provides a centralized view of any sync groups that are in an error state.

Cloud tiering only kicks in when the specified ‘Volume Free Space’ policy is met (e.g., if the volume isn’t full enough, nothing tiers). Additionally, files that are currently open or locked by applications cannot be tiered to the cloud.

Asynchronous replication is designed for long distances where latency exceeds 5ms. Even in asynchronous mode, a high-performance log volume is essential to minimize the ‘write’ bottleneck before data is replicated to the remote site.

To perform synchronization (especially Password Hash Sync), the service account requires ‘Replicating Directory Changes’ and ‘Replicating Directory Changes All’ permissions at the root of the domain in the local AD.

Azure Relay Hybrid Connections use the Relay namespace and SAS keys for authentication. Because the connection is outbound from the SQL server, no public IP or inbound firewall ports are required for the connection to function.

SDN in Azure Stack HCI uses the Network Controller to manage infrastructure. Microsegmentation is achieved via the ‘Data Center Firewall’, which applies stateful ACLs at the virtual port level for each VM.

For agent-based dependency mapping, the MMA (to collect data) and the Dependency Agent (to map the connections) are required on each source server to visualize the network traffic between nodes.

The cleanup process specifically targets the artifacts of the test, such as the test VMs and their disks in Azure. It also triggers the migration tool to resume normal replication tracking for the source VMs.

To support SSO for apps using Windows Auth, the App Proxy connector must use KCD to impersonate the user. This requires an SPN to be registered in the local AD for the service account running the connector.

Filtering can be configured within the Sync Rules Editor (attribute-based filtering) or within the Connector properties in the Service Manager (domain or OU-based filtering).

To enable cloud-based password resets that sync back to the local AD, you must enable SSPR in the Azure portal and activate the Password Writeback feature within the Azure AD Connect configuration.

The Synchronization Service Manager allows you to view the management agents and individual object metadata (metadverse), while the Synchronization Rules Editor is used to inspect or modify the logic governing attribute flow.

Azure File Sync will not tier files that are in use by an application. Additionally, there is a minimum file size (typically 64 KB) below which files are not tiered because the metadata overhead would outweigh the space savings.

Correct Answers: D and E

A Private Endpoint creates a private IP address for the Azure Storage account within an Azure virtual network. Traffic to the storage account remains on the Microsoft backbone network instead of traversing the public internet.

To allow on-premises DNS servers to resolve storage1.blob.core.windows.net to the private IP address, DNS queries must be forwarded to Azure. Configuring a DNS Conditional Forwarder on the on-premises DNS server to an Azure DNS Private Resolver enables Azure Private DNS Zones to return the private IP address associated with the Private Endpoint.

Together, these two configurations provide secure name resolution and private connectivity for Azure Private Link.

Incorrect:

A. Service Endpoint

Service Endpoints secure traffic to Azure services over the Azure backbone but do not provide a private IP address for the Storage account. They also do not change DNS resolution to a private address. Azure Private Link requires a Private Endpoint, not a Service Endpoint.

B. Azure Firewall in DNAT mode

Azure Firewall DNAT is used to publish inbound services by translating public IP addresses to private IP addresses. It is unrelated to Azure Private Link or DNS resolution for Azure Storage accounts.

C. Public DNS CNAME record

Azure automatically manages the required public DNS CNAME records for Azure Storage. Creating your own public CNAME record does not cause on-premises clients to resolve the storage account to the Private Endpoint’s private IP. Private DNS integration is required instead.

For non-domain joined servers, WAC requires either HTTPS for WinRM or adding the remote machines to the TrustedHosts list to allow Kerberos/NTLM authentication to bypass domain requirements.

A witness must be in a separate failure domain. Placing it on a third server or using an Azure File share (Cloud Witness equivalent) ensures that if one HCI node fails, the other can still reach the witness to maintain quorum.

A ‘Test Failover’ creates a temporary copy of the VM in an isolated environment. It does not interrupt the ongoing replication from the source server, allowing you to verify that the SQL services start correctly in Azure.

Azure Update Manager is the native, agentless solution for tracking updates across Azure and Arc-enabled servers. Microsoft Defender for Cloud provides the security recommendations and vulnerability assessments to identify missing patches as a security risk.

For Azure Stack HCI, storing BitLocker recovery keys in Active Directory (on-premises) is the standard method. However, for a more modern hybrid approach, you can use the Azure Key Vault to centralize secrets and keys for both cloud and HCI workloads.

The Mobility Service on the source machine communicates with the Process Server over port 9443 (HTTPS) to send replication data. Port 443 is used for management communication to the Configuration Server.

Three-way mirroring and Dual parity both require at least five nodes (for parity) or three nodes (for mirroring) and provide the ability to lose two hardware components simultaneously while maintaining data availability.

Site-awareness is configured by grouping nodes into Fault Domains (Sites) and then setting the ‘PreferredSite’ property on the cluster or specific VM roles to ensure they fail over to local nodes before moving to the secondary site.

Defender for Servers requires the Defender for Cloud plan to be enabled. To collect security data from Arc-enabled servers, you must deploy the appropriate extension (like the Defender for Endpoint extension) to the hybrid machine.

Modern monitoring for hybrid clusters relies on Azure Arc to provide the management identity and the Azure Monitor Agent (AMA). Data Collection Rules (DCRs) then define exactly which metrics and logs are streamed to the Log Analytics workspace.

The Azure Network Adapter feature in WAC creates a Point-to-Site VPN connection between the specific server and an Azure VNet. It requires a P2S-compatible Gateway and a modern version of Windows Server (2016+) to support the automated setup.

Seamless SSO relies on a computer account in the local AD and a GPO that adds the Microsoft SSO URL to the ‘Intranet’ zone in the users’ browsers. If either the SPN is missing or the GPO isn’t applied, SSO will fail while PTA still works.

Azure Update Manager uses the ‘Periodic Assessment’ feature of the Azure Connected Machine agent to scan for updates every 24 hours. This is the modern, agentless replacement for the legacy Automation-based update management.

In Azure Stack HCI, faster flash media (NVMe or SSD) is used for the cache tier to provide high-speed reads and writes, while larger, slower drives (HDD or slower SSDs) provide the capacity tier.

For individual Windows Servers, the MARS agent is installed locally and it connects to a Recovery Services vault in Azure to store the backup data.

CAU can be extended using plug-ins. The ‘Hotfix’ plug-in allows the cluster to pull updates from a designated SMB share, which is useful for out-of-band updates or specialized drivers.

Machine Configuration (formerly Guest Configuration) uses Azure Policy to audit settings inside the OS. You can use the built-in policy for ‘Audit Windows VMs that have the specified accounts in the Administrators group’.

The Synchronization Service Manager (miisclient.exe) allows you to drill down into specific sync runs. By clicking on ‘Export’ for a connector, you can see exactly which objects and attributes were updated in the metaverse or target directory.

The Key Vault extension for Arc-enabled servers allows the machine to pull certificates, keys, and secrets from a Key Vault and automatically install them into the local OS certificate store, supporting auto-renewal.

Azure Site Recovery Plans allow you to insert ‘Post-steps’. By linking an Azure Automation Runbook to the recovery plan, you can automate complex tasks inside the VM (via Hybrid Worker) or on the Azure resources themselves during a failover.

Hotpatching is a feature exclusive to Windows Server Azure Edition. To use it on-premises, the server must be onboarded via Azure Arc to validate the licensing and manage the orchestration of the patches.

To configure a Cloud Witness, the cluster requires the name of a standard Azure Storage Account and one of its two access keys to authenticate and maintain the blob-based quorum file.

Azure AD Smart Lockout can lock accounts in the cloud to protect them from brute-force attacks before they hit the local AD. If the cloud lockout threshold is lower than the local AD threshold, users may be blocked from cloud services while still active on-premises.

VM Insights (which uses the Azure Monitor Agent) provides specialized Map and Performance views. These pre-built workbooks and dashboards specifically track performance metrics and dependencies for both Azure and Arc-enabled VMs.

Storage Replica requires low latency for synchronous replication. To optimize performance, Microsoft recommends that the log volume be placed on faster storage (SSD/NVMe) to handle the write I/O overhead before data is committed to the data volume.

Azure supports legacy OS versions but highlights them as ‘Ready with conditions’ due to support status. Additionally, Azure Managed Disks have a 32 TB limit per disk (VHDX), and overall capacity limits must be adhered to for successful migration.

To implement site-awareness, you first create the fault domains (Racks or Sites) using ‘New-ClusterFaultDomain’ and then assign the specific cluster nodes to those domains to influence VM placement and data locality.

Unlike local changes which are seen immediately, changes made directly in the Azure File share metadata are scanned on a 24-hour cycle. To speed this up, you must use the Change Detection cmdlet to trigger a manual crawl.

Automatic failover in a Stretch Cluster requires Synchronous replication (to ensure zero data loss) and a witness located at a third site to prevent split-brain scenarios and provide the quorum vote.

By default, many extended attributes are not synced. You must enable the ‘Directory extension attribute sync’ feature in the Optional Features section of the wizard to select and synchronize custom or additional AD attributes.

Azure Automanage offers a specific ‘Dev/Test’ profile designed for non-production workloads. it includes a subset of services (like basic monitoring) compared to the more comprehensive and expensive ‘Production’ profile.

Azure Arc supports connectivity through an HTTP proxy or via Azure Private Link. Using Private Link allows the Arc management traffic to flow over a VPN or ExpressRoute without traversing the public internet.

Resource Monitor provides real-time disk activity by file. Performance Monitor (PerfMon) includes specific object counters for Azure File Sync that can help track sync performance and throughput bottlenecks.

Synchronous replication requires low latency (typically <5ms) and sufficient bandwidth to handle write I/O. If these requirements aren't met, performance degrades significantly, and you may need to switch to asynchronous replication.

Cloud tiering policies, including Volume Free Space, are properties of the ‘Server Endpoint’. These can be managed through the Storage Sync Service in the Azure Portal or via the Azure File Sync extension in Windows Admin Center.

Azure File Sync detects local changes immediately via USN journal, but changes made directly in the cloud share are only scanned every 24 hours unless forced by the ‘Invoke-AzStorageSyncChangeDetection’ cmdlet.

Microsoft Defender for Cloud includes a ‘Regulatory Compliance’ dashboard. It uses Azure Policy to audit your Arc-enabled and Azure resources against specific standards like PCI-DSS, ISO 27001, and the Azure Security Benchmark.

Storage Replica supports ‘Cluster-to-Cluster’ for DR between two separate clusters. ‘Stretch Cluster’ is a single cluster that spans two sites, providing automated failover for high availability.

Azure Migrate provides two primary ways to see dependencies: an agentless method that analyzes TCP connection data, and an agent-based method that uses the MMA/Dependency agent for deeper insights.

Azure Policy with the ‘Deploy-if-not-exists’ effect is the standard way to automate extension deployment. When a new Arc server is detected, the policy automatically triggers the installation of the Defender extension.

Multi-VM consistency ensures that a group of VMs (like an app and its DB) share common recovery points. A Recovery Plan is then used to orchestrate the actual failover and boot order of those machines.

Lift and Shift’ (Rehosting) is achieved by migrating the entire VM/server image as-is. Both Azure Migrate and ASR provide tools to replicate the block-level data of a server to an Azure VM.