AZ-120 sample exam questions
15 exam-style questions for Microsoft AZ-120: SAP on Azure, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.
- Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might
meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You plan to migrate an SAP HANA instance to Azure.
You need to gather CPU metrics from the last 24 hours from the instance.
Solution: You query views from SAP HANA Studio.
Does this meet the goal?- AYes
- BNo
Show answer
Correct answer: A
WhySAP HANA Studio can query monitoring views such as M_HOST_RESOURCE_UTILIZATION and the load history, which provide CPU metrics over the last 24 hours, so this meets the goal.
- A
- HOTSPOT
You plan to implement a deployment of SAP NetWeaver on Azure. The deployment will be hosted on virtual machines that run Windows Server 2022.
You need to configure an authentication solution for the deployment. The solution must meet the following requirements:
• Support single sign-on (SSO) and multi-factor authentication (MFA) for SAP NetWeaver applications.
• Minimize administrative effort.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Authenticate the virtual machines by using: Active Directory Domain Services (AD DS) / Azure AD / Azure Active Directory Domain Services (Azure AD DS) Authenticate the SAP NetWeaver applications by using: Active Directory Domain Services (AD DS) / Azure AD / Azure Active Directory Domain Services (Azure AD DS) Show answer
- Authenticate the virtual machines by using: Azure Active Directory Domain Services (Azure AD DS)
- Authenticate the SAP NetWeaver applications by using: Azure AD
WhyAzure AD DS provides a managed domain for joining the Windows Server VMs without running your own domain controllers, minimizing administration. SAP NetWeaver integrates with Azure AD through SAML for SSO, and Azure AD Conditional Access adds MFA. These are now named Microsoft Entra Domain Services and Microsoft Entra ID.
- You are deploying an SAP production landscape to Azure.
Your company's chief information security officer (CISO) requires that the SAP deployment complies with ISO 27001.
You need to generate a compliance report for ISO 27001.
What should you use?- AAzure Log Analytics
- BAzure Monitor
- CAzure Active Directory (Azure AD)
- DAzure Security Center
Show answer
Correct answer: D
WhyMicrosoft Defender for Cloud (formerly Azure Security Center) has a regulatory compliance dashboard with ISO 27001 reports. Log Analytics and Monitor only collect data, and Azure AD handles identity.
- A
- HOTSPOT
Your network contains an on-premises SAP landscape. The landscape contains a database server named DB1.
You have an Azure subscription that contains a storage account named storageaccount1.
You export multiple databases to separate folders in a folder named D:\Data on DB1.
You plan to migrate the on-premises SAP landscape to Azure.
You need to copy the exported databases on DB1 to a container in storageaccountl by using AzCopy.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

azcopy Bench / Copy / Load / Sync Option --blob-tier / --include-path / --include-pattern / --recursive Show answer
- azcopy Copy
- Option --recursive
Whyazcopy copy uploads the local folder to the blob container, and --recursive makes it include all the subfolders that hold each exported database. Sync compares source and destination rather than doing a plain upload, and bench only tests throughput.
- You plan to deploy an SAP environment on Azure.
You plan to store all SAP connection strings securely in Azure Key Vault without storing credentials on the Azure virtual machines that host SAP.
What should you configure to allow the virtual machines to access the key vault?- AAzure Active Directory (Azure AD) Privilege Identity Manager (PIM)
- Brole-based access control (RBAC)
- Ca Managed Service Identity (MSI)
- Dthe Custom Script Extension
Show answer
Correct answer: C
WhyA managed identity (formerly Managed Service Identity) lets the VM authenticate to Key Vault with Azure AD without any stored credentials. RBAC or access policies grant permissions but need an identity first, PIM handles just-in-time elevation, and the Custom Script Extension runs scripts.
- A
- HOTSPOT
You have an on-premises SAP HANA deployment that uses HANA system replication in synchronous mode.
You plan to migrate the on-premises deployment to Azure and use ultra disks as part of the HANA deployment on Azure.
You need to configure storage resources and high availability for the HANA deployment on Azure.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Use the ultra disks as: Data disks only / Data disks and the operating system disk / Data disks, the operating system disk, and the temporary disk Implement high availability by using: Availability sets / Availability zones / Multiple regions Show answer
- Use the ultra disks as: Data disks only
- Implement high availability by using: Availability zones
WhyUltra disks can only be used as data disks, not as OS or temporary disks. Availability zones give datacenter-level protection with latency low enough for synchronous HANA system replication, whereas replication across regions would normally be asynchronous.
- DRAG DROP
You plan to deploy SAP HANA to an Azure virtual machine that has a constrained vCPU size.
You need to validate that the virtual machine complies with SAP-defined resource requirements by using the SAP HANA Hardware and Cloud Measurement Tools (HCMT).
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Arrange 5 of these in the correct order:
- Download the HCMT.
- Run the hcmt command and specify the executionplan.json parameter.
- Upload the ZIP file to the SAP HANA Hardware and Cloud Measurement Analysis.
- Run the hcmtsetup command.
- Run the SAPCAR utility.
Show answer
- Download the HCMT.
- Run the SAPCAR utility.
- Run the hcmtsetup command.
- Run the hcmt command and specify the executionplan.json parameter.
- Upload the ZIP file to the SAP HANA Hardware and Cloud Measurement Analysis.
WhyHCMT ships as an SAR archive, so you download it and extract it with SAPCAR. Then hcmtsetup prepares the tool, hcmt runs the measurements from the execution plan, and the resulting ZIP is uploaded to the online analysis service for evaluation.
- Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an on-premises datacenter.
You have an Azure subscription that contains a virtual network named VNet1.
You have an SAP RISE managed workload.
You need to ensure transitive connectivity between the datacenter, VNet1, and the managed workload.
Solution: You configure a Site-to-Site (S2S) VPN connection between the datacenter and VNet1 and an S2S VPN connection between VNet1 and the managed workload.
Does this meet the goal?- AYes
- BNo
Show answer
Correct answer: B
WhyVPN connections from the datacenter to VNet1 and from VNet1 to the managed workload are not transitive, because gateways do not forward traffic between separate connections by default. Transitive connectivity needs routing such as a hub with route server, virtual WAN or an appliance, so this does not meet the goal.
- A
- You have an SAP landscape on Azure that uses SAP HANA.
You perform a daily backup of HANA to Azure Blob Storage and retain copies of each backup for one year.
You need to reduce the backup storage costs.
What should you implement?- Aa stored access policy
- Ba Recovery Services Vault backup policy
- Ca storage access tier
Show answer
Correct answer: C
WhyHANA backups written to Blob Storage are cheapest when moved to a cooler storage access tier, such as Cool or Archive, with lifecycle management for one-year retention. A stored access policy only controls SAS permissions, and a Recovery Services vault policy applies to Azure Backup, not files in Blob storage.
- A
- HOTSPOT
You have an Azure subscription.
You plan to deploy SAP HANA to Azure virtual machines by using Azure Center for SAP solutions. The virtual machines will use customized resource names.
You need to use the Azure command-line interface (CLI) to deploy the solution.
How should you complete the command? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

az workloads sap-application-server-instance / sap-database-instance / sap-virtual-instance --configuration ./payload. bicep / json / tf Show answer
- az workloads sap-virtual-instance
- --configuration ./payload. json
WhyAzure Center for SAP solutions deploys a whole system as a Virtual Instance for SAP solutions, using az workloads sap-virtual-instance create. The configuration is supplied as a JSON payload file, which is also where customized resource names are defined.
- You are evaluating which migration method Litware can implement based on the current environment and the business goals.
Which migration method will cause the least amount of downtime?- AMigrate SAP ECC to SAP Business Suite in HANA, and then migrate SAP to Azure.
- BUse Near-Zero Downtime (NZDT) to migrate to SAP HANA and Azure during the same maintenance window.
- CUse the Database Migration Option (DMO) to migrate to SAP HANA and Azure during the same maintenance window.
- DMigrate SAP to Azure, and then migrate SAP ECC to SAP Business Suite on HANA.
Show answer
Correct answer: B
WhyNear-Zero Downtime (NZDT) replicates data to the target while the source stays in use, leaving only a short cutover, so it causes the least downtime. DMO combined with the move needs a long single maintenance window for the whole export and import. Doing two separate migrations adds downtime.
- A
- You are evaluating the migration plan.
Licensing for which SAP product can be affected by changing the size of the virtual machines?- ASAP ECC
- BSAP Solution Manager
- CPI
- DSAP SCM
Show answer
Correct answer: A
WhyThe case study text is not available here, so this is the best-supported choice. SAP licences are bound to the hardware key of the host, so resizing the VMs running the production ERP system, SAP ECC, can invalidate its licence. Solution Manager, PI and SCM are less tied to sizing.
- A
- You need to recommend a solution to reduce the cost of the SAP non-production landscapes after the migration.
What should you include in the recommendation?- AConfigure scaling of Azure App Service
- BMigrate the SQL Server databases to Azure SQL Data Warehouse
- CDeallocate virtual machines when not in use
- DDeploy non-production landscapes to Azure DevTest Labs
Show answer
Correct answer: D
WhyThe given answer suggests Azure DevTest Labs, which provides auto-shutdown policies and cost controls for non-production workloads. Deallocating VMs when not in use is also a valid saving, so the choice is close. App Service scaling and SQL Data Warehouse do not apply to SAP non-production VMs.
- A
- What should you use to perform load testing as part of the migration plan?
- AJMeter
- BSAP LoadRunner by Micro Focus
- CAzure Application Insights
- DAzure Monitor
Show answer
Correct answer: B
WhySAP LoadRunner by Micro Focus is the SAP-supported load testing tool, which simulates users against SAP applications for migration validation. Azure Application Insights and Azure Monitor observe behavior rather than generating load, and JMeter does not natively simulate SAP GUI traffic.
- A
- Once the migration completes, to which size should you set the ExpressRoute circuit to the New York office to meet the business goals and technical
requirements?- A500 Mbps
- B1,000 Mbps
- C2,000 Mbps
- D5,000 Mbps
Show answer
Correct answer: B
WhyThe case study text is not available here; this is the commonly cited answer. After migration the New York office needs enough ExpressRoute bandwidth for user and replication traffic, and 1,000 Mbps covers it. 500 Mbps is likely too small, while 2,000 and 5,000 Mbps add unneeded cost.
- A