CertifyCloudxAce every cloud certification.

AZ-120 sample questions with answers

10 free practice questions for the Microsoft Certified: Azure for SAP Workloads Specialty exam. Try each one, then open the answer to see why the right option wins and every other option loses.

Question 1Migrate SAP workloads to Azure

Woodgrove Bank runs SAP S/4HANA under RISE with SAP. The database has grown to the point where the memory footprint drives most of the subscription cost. Compliance requires that archived documents remain readable for ten years, and the archive must live in storage that the bank owns and controls, not in the SAP-managed subscription. Which approach should you recommend?

  1. A.

    Export the tables to CSV files with an SAP query and copy the files to a customer Azure file share each month

  2. B.

    Use SAP Information Lifecycle Management with the ILM Store writing archive files to a customer-owned Azure Blob Storage account

  3. C.

    Enable Azure Blob Storage lifecycle management on the SAP-managed backup container so that older blobs move to the archive access tier

  4. D.

    Schedule Azure Backup long-term retention of the SAP database and delete the archived documents from the database

Show answer

Answer: B

SAP Information Lifecycle Management moves data out of the database into an external archive store, and a customer-owned storage account behind a private endpoint keeps the archive under the bank's control.

  • A. CSV exports are not a supported archiving method and lose retention rules, legal hold, and application readability.
  • B. The ILM Store persists archive files in a customer-owned Blob Storage account, shrinking the database while retention rules keep the data governed.
  • C. The SAP-managed backup container is not customer-controlled and holds backups rather than archived business documents.
  • D. Backup retention keeps recovery copies and does not reduce the live database size or provide application-readable archives.
Question 2Migrate SAP workloads to Azure

Trey Research uses several SAP software as a service applications, including SAP SuccessFactors, SAP Ariba, and SAP Analytics Cloud. Each application currently has its own trust relationship configured directly with Microsoft Entra ID, and every new SAP cloud application means another federation setup. You must reduce the number of trust relationships that have to be maintained while keeping Microsoft Entra ID as the authoritative source of authentication. What should you recommend?

  1. A.

    Deploy an on-premises Active Directory Federation Services farm, register every SAP cloud application as a relying party, and then retire all the existing Microsoft Entra ID trusts

  2. B.

    Configure password-based single sign-on with shared credentials for each SAP cloud application

  3. C.

    Federate SAP Cloud Identity Services Identity Authentication with Microsoft Entra ID and use it as the proxy identity provider for the SAP cloud applications

  4. D.

    Publish each SAP cloud application through Microsoft Entra application proxy with pre-authentication

Show answer

Answer: C

SAP Cloud Identity Services Identity Authentication can proxy authentication to Microsoft Entra ID, so one federation covers every SAP cloud application instead of one per application.

  • A. Active Directory Federation Services moves authentication off Microsoft Entra ID and still requires a trust for each application.
  • B. Password-based single sign-on with shared credentials removes federation, breaks accountability, and does not honour Conditional Access.
  • C. Identity Authentication acts as a proxy identity provider to Microsoft Entra ID, so one federation serves every SAP cloud application.
  • D. Application proxy publishes internal web applications to the internet and does nothing for applications that are already software as a service.
Question 3Migrate SAP workloads to Azure

Litware Chemicals will migrate an SAP ERP landscape that runs on Windows Server with Microsoft SQL Server. The company owns SQL Server Enterprise licences with active Software Assurance and Windows Server licences with Software Assurance. The production virtual machine sizes are already fixed and will run continuously for three years. You must reduce the Azure invoice as much as possible without changing the virtual machine sizes. Which two actions should you perform? (Choose TWO.)

Choose 2.

  1. A.

    Enable Azure Spot pricing for the production application servers

  2. B.

    Apply an Azure Savings Plan for compute instead of any other compute commitment

  3. C.

    Apply Azure Hybrid Benefit for Windows Server and for SQL Server to the production virtual machines

  4. D.

    Move the production virtual machines to a Standard HDD storage tier

  5. E.

    Deploy the production virtual machines from a pay-as-you-go SQL Server image in Azure Marketplace

  6. F.

    Purchase three-year Azure Reserved Virtual Machine Instances for the production virtual machine sizes

Show answer

Answer: C, F

Azure Hybrid Benefit removes the Windows Server and SQL Server licence charge from the bill, and a three-year reserved instance gives the deepest compute discount for fixed sizes running continuously.

  • A. Spot VMs can be evicted at short notice, which a continuously running production SAP application tier can't tolerate.
  • B. A savings plan trades some discount for family flexibility, which is not needed when sizes are fixed for three years.
  • C. Software Assurance licences can be applied through Azure Hybrid Benefit, removing Windows Server and SQL Server licence charges from the virtual machine rate.
  • D. Standard HDD cannot meet SAP production storage latency and throughput guidance, so it trades support for cost.
  • E. A pay-as-you-go SQL Server image bills licence cost hourly and wastes the owned licences with Software Assurance.
  • F. A three-year reserved instance gives the deepest compute discount when the size and region are fixed for the whole term.
Question 4Migrate SAP workloads to Azure

Munson Pickles runs an ExpressRoute circuit that terminates on a virtual network gateway in a hub virtual network in its own Azure subscription. The SAP-managed RISE virtual network is peered to that hub. Factory users on the corporate network report that they cannot reach the SAP application servers in the RISE environment, although virtual machines in the customer hub can. What should you configure?

  1. A.

    Enable gateway transit on the hub side of the peering and use remote gateway on the SAP RISE side

  2. B.

    Create a second ExpressRoute circuit and connect it directly to the SAP RISE virtual network

  3. C.

    Recreate the connection as global virtual network peering between the hub and the SAP RISE virtual network

  4. D.

    Add a user-defined route in the hub that sends the SAP RISE prefix to the internet

Show answer

Answer: A

Spoke networks reach on-premises through a hub gateway only when the hub peering allows gateway transit and the peered network uses the remote gateway.

  • A. Gateway transit on the hub plus use remote gateway on the peered network propagates the on-premises routes into the RISE network.
  • B. A connection set up inside RISE reaches only the SAP virtual network and can't coexist with remote gateway transit; the hub gateway is the preferred path.
  • C. Global peering only matters for networks in different regions and does not by itself enable gateway transit.
  • D. Routing the SAP prefix to the internet abandons the private path and would not deliver traffic to the peered network.
Question 5Migrate SAP workloads to Azure

At Tailwind Traders, a basis administrator recently deployed an SAP application server on a virtual machine size that is not certified by SAP, which put the landscape out of support. You must prevent any virtual machine from being created in the SAP subscriptions unless its size is on an approved list. Existing virtual machines must not be affected, and the block must happen before the resource is created. What should you implement?

  1. A.

    An Azure Policy assignment of a custom copy of the allowed sizes definition that uses the Audit effect for every SAP subscription

  2. B.

    A custom Azure role that excludes the Microsoft.Compute/virtualMachines/write action

  3. C.

    An Azure Policy assignment of the Allowed virtual machine size SKUs definition, which denies non-listed sizes

  4. D.

    An Azure resource lock of type CanNotDelete on the SAP resource groups

Show answer

Answer: C

Only the Deny effect stops a non-compliant resource at the request stage, and the allowed virtual machine SKUs definition is the built-in way to restrict sizes.

  • A. An Audit effect lets the non-compliant VM be created and only reports it afterwards.
  • B. Removing the virtual machine write permission blocks all virtual machine creation, not only uncertified sizes.
  • C. The Allowed virtual machine size SKUs definition rejects a create request for any size that isn't on the approved list, before the VM exists.
  • D. A CanNotDelete lock prevents deletion and has no effect on which virtual machine size is chosen.
Question 6Migrate SAP workloads to Azure

Fabrikam is configuring Microsoft Entra single sign-on with SAML for several SAP NetWeaver ABAP systems. In transaction SAML2, the default provider name for system T01, client 122, is T01122. Which provider name should you maintain?

  1. A.

    https://T01122

  2. B.

    The Microsoft Entra tenant ID

  3. C.

    T01122, unchanged

  4. D.

    T01122@fabrikam.com

Show answer

Answer: A

Set the SAML2 provider name to https://<SID><client>, the <protocol>://<name> format that Microsoft Entra ID expects.

  • A. Microsoft Entra ID expects the name in the <protocol>://<name> format, and https://<SID><client> is the recommended value.
  • B. The provider name identifies the SAP service provider, not the identity provider tenant.
  • C. The default <SID><client> format doesn't match what Microsoft Entra ID expects.
  • D. A mail-style value isn't the <protocol>://<name> format that the SAML configuration needs.
Question 7Migrate SAP workloads to Azure

Relecloud uses SAP Identity Management (SAP IDM) to manage the lifecycle of SAP users, and SAP has announced that SAP IDM is being retired. Which platform does SAP recommend as the migration target?

  1. A.

    Active Directory Federation Services

  2. B.

    Microsoft Entra ID Governance

  3. C.

    Microsoft Entra Connect Sync

  4. D.

    SAP Secure Login Service

Show answer

Answer: B

SAP recommends Microsoft Entra ID Governance as the replacement for SAP Identity Management.

  • A. AD FS is a federation service, not an identity governance platform.
  • B. SAP recommends that SAP IDM customers migrate to Microsoft Entra ID Governance.
  • C. Entra Connect Sync synchronizes Active Directory with Entra ID; it doesn't govern SAP user lifecycles.
  • D. SAP Secure Login Service provides SSO for SAP GUI; it doesn't manage identity lifecycles.
Question 8Migrate SAP workloads to Azure

Six weeks after go-live, Wingtip Toys finds that its production SAP HANA VM uses far less memory and CPU than planned. The team wants to move the database to a smaller M-series size. Which check is most important before resizing?

  1. A.

    Confirm that Azure Advisor shows a right-sizing recommendation for the smaller size and that a matching reservation can be bought before the next billing cycle

  2. B.

    Confirm that the smaller size has a temporary disk large enough to hold /hana/log

  3. C.

    Confirm that the smaller size is certified for production SAP HANA and that its storage throughput limit still covers /hana/data and /hana/log

  4. D.

    Confirm that the smaller size has the same number of vCPUs as the application servers

Show answer

Answer: C

Before shrinking a HANA VM, confirm that the target size is HANA-certified and that its lower storage limits still meet the HANA volumes.

  • A. Advisor and reservations are cost follow-ups; they don't tell you whether the new size is supported for HANA or can carry its I/O.
  • B. The temporary disk is non-persistent and must never hold the HANA log volume.
  • C. Production HANA must run on a certified size, and a smaller size also brings lower storage throughput limits that must still meet the HANA volumes' needs.
  • D. There's no requirement for the database VM to match the application servers' vCPU count.
Question 9Migrate SAP workloads to Azure

Northwind Traders is choosing storage for the /hana/data and /hana/log volumes of a production SAP HANA VM on Azure. Which storage type can't be used for these volumes?

  1. A.

    Azure NetApp Files NFS v4.1 volumes

  2. B.

    Standard SSD managed disks

  3. C.

    Ultra Disk

  4. D.

    Premium SSD v2

Show answer

Answer: B

Only Premium SSD, Premium SSD v2, Ultra Disk, and Azure NetApp Files are certified for SAP HANA data and log volumes.

  • A. Azure NetApp Files NFS v4.1 volumes are certified for SAP HANA data and log.
  • B. Standard SSD isn't among the storage types that are mandatory for /hana/data and /hana/log.
  • C. Ultra Disk is one of the SAP HANA certified Azure storage types and is often used for /hana/log.
  • D. Premium SSD v2 is one of the SAP HANA certified Azure storage types.
Question 10Migrate SAP workloads to Azure

Adventure Works requires Microsoft to respond within 15 minutes when a business-critical Azure system is down, and it wants Microsoft 365 covered by the same support agreement. Which support offering meets these requirements?

  1. A.

    Unified Enterprise support

  2. B.

    Professional Direct support

  3. C.

    Developer support

  4. D.

    Standard support

Show answer

Answer: A

Only Unified Enterprise support covers Microsoft 365 and offers a 15-minute response for a critical Azure system down.

  • A. Unified Enterprise covers Azure, Microsoft 365, and other Microsoft technologies, with a 15-minute target for a business-critical system down in Azure.
  • B. Professional Direct covers Azure only, and its fastest target is one hour for critical business impact.
  • C. Developer offers business-hours support for trial and non-production environments.
  • D. Standard covers Azure only, with a one-hour target for critical business impact.

Keep going with 501 more AZ-120 questions

Free papers every day, in the real exam formats, with progress by exam domain. Unlock every paper and timed mock exam when you are ready.

Practise freeSee all AZ-120 papers
AZ-120 sample questions with answers (10 free) · CertifyCloudx