https://github.com/MicrosoftDocs/azure-docs/issues/32537
https://azure.microsoft.com/en-us/blog/vnet-peering-and-vpn-gateways/

Topic 2, Contoso Ltd Case Study
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
Contoso, Ltd. is a manufacturing company that has 15,000 employees.
The company uses SAP for sales and manufacturing.
Contoso has sales offices in New York and London and manufacturing facilities in Boston and Seattle.
Existing Environment
Active Directory
The network contains an on-premises Active Directory domain named ad.contoso.com. User email addresses use a domain name of contoso.com.
SAP Environment
The current SAP environment contains the following components:
* SAP Solution Manager
* SAP ERP Central Component (SAP ECC)
* SAP Supply Chain Management (SAP SCM)
* SAP application servers that run Windows Server 2008 R2
* SAP HANA database servers that run SUSE Linux Enterprise Server 12 (SLES 12) Problem Statements Contoso identifies the following issues in its current environment:
* The SAP HANA environment lacks adequate resources.
* The Windows servers are nearing the end of support.
* The datacenters are at maximum capacity.
Requirements
Planned Changes
Contoso identifies the following planned changes:
* Deploy Azure Virtual WAN.
* Migrate the application servers to Windows Server 2016.
* Deploy ExpressRoute connections to all of the offices and manufacturing facilities.
* Deploy SAP landscapes to Azure for development, quality assurance, and production.
All resources for the production landscape will be in a resource group named SAPProduction.
Business goals
Contoso identifies the following business goals:
* Minimize costs whenever possible.
* Migrate SAP to Azure without causing downtime.
* Ensure that all SAP deployments to Azure are supported by SAP.
* Ensure that all the production databases can withstand the failure of an Azure region.
* Ensure that all the production application servers can restore daily backups from the last 21 days.
Technical Requirements
Contoso identifies the following technical requirements:
* Inspect all web queries.
* Deploy an SAP HANA cluster to two datacenters.
* Minimize the bandwidth used for database synchronization.
* Use Active Directory accounts to administer Azure resources.
* Ensure that each production application server has four 1-TB data disks.
* Ensure that an application server can be restored from a backup created during the last five days within 15 minutes.
* Implement an approval process to ensure that an SAP administrator is notified before another administrator attempts to make changes to the Azure virtual machines that host SAP.
It is estimated that during the migration, the bandwidth required between Azure and the New York office will be 1 Gbps. After the migration, a traffic burst of up to 3 Gbps will occur.
Proposed Backup Policy
An Azure administrator proposes the backup policy shown in the following exhibit.

Azure Resource Manager Template
An Azure administrator provides you with the Azure Resource Manager template that will be used to provision the production application servers.

Explanation

Explanation:
Step 1: From the Azure portal, create a service principal
The Azure connector can use a Service Principal to authorize against Microsoft Azure. Follow these steps to create a Service Principal for SAP Landscape Management (LaMa).
Step 2: Add permissions to the service principal
The Service Principal does not have permissions to access your Azure resources by default. You need to give the Service Principal permissions to access them.
Step 3: From the Cloud Managers tab in LaMa, add an adapter
Create a new connector in SAP LaMa
Open the SAP LaMa website and navigate to Infrastructure. Go to tab Cloud Managers and click on Add. Select the Microsoft Azure Cloud Adapter Step 4: Install and configure LaMA on an SAP NetWeater instance Provision a new adaptive SAP system You can manually deploy a new virtual machine or use one of the Azure templates in the quickstart repository. It contains templates for SAP NetWeaver ASCS, SAP NetWeaver application servers, and the database. You can also use these templates to provision new hosts as part of a system copy/clone etc.
Note: To support customers on their journey into a cloud model (hybrid or entirely public cloud), SAP and Microsoft partnered to create an adapter that integrates the SAP management capabilities of LaMa with the IaaS advantages of Microsoft Azure.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/workloads/sap/lama-installation

Explanation
Graphical user interface, text, application, email Description automatically generated

Box 1: extensions
Azure Disk Encryption can be enabled via Azure PowerShell or Azure CLI. That is normally seen in remediation. In a real-world scenario you would like to see a virtual machine during its creation include disk encryption process. This is technically possible thanks to Disk Encryption VM extension.
Box 2: AzureDiskEncryption
Example:
"type": "Microsoft.Compute/virtualMachines/extensions",
"name": "[concat(parameters('vmName'),'/diskEncryption')]",
"apiVersion": "2019-03-01",
"location": "[parameters('location')]",
"dependsOn": [
"[resourceId('Microsoft.Compute/virtualMachines/', parameters('vmName'))]"
],
"properties": {
"publisher": "Microsoft.Azure.Security",
"type": "AzureDiskEncryption",
Reference:
https://azsec.azurewebsites.net/2019/12/28/azure-disk-encryption-arm-template-for-windows-vm/