Exam Bundle

The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint. That result is evidence for another corrective change: Use the documented Managed Instance failover and post-failover validation procedure including replica state and application identity. The alternative problem is: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. The current Riverton Utilities issue is instead: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. Its decisive acceptance evidence would be: A controlled outage follows the documented manual or automatic policy and the test record identifies the correct trigger.

After controlled regional failover the application reconnects using the listener and commits approved transactions on the new primary. That result is evidence for another corrective change: Use an appropriate failover group with stable read-write listener routing and supported failover policy when automatic app-level redirection is required. The alternative problem is: An Azure SQL Database has active geo-replication configured but the application still connects only to the primary and cannot recover automatically when that region fails. The current Riverton Utilities issue is instead: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. Its decisive acceptance evidence would be: A controlled outage follows the documented manual or automatic policy and the test record identifies the correct trigger.

A controlled failback test shows only the current authorized primary accepts writes while the previous primary is safely fenced. That result is evidence for another corrective change: Implement supported cluster or failover-group role enforcement and application endpoint fencing before allowing writes after recovery. The alternative problem is: A post-failover application continues writing to a former primary after network recovery because the architecture lacks split-brain protection and role validation. The current Riverton Utilities issue is instead: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. Its decisive acceptance evidence would be: A controlled outage follows the documented manual or automatic policy and the test record identifies the correct trigger.

Check the configured failover policy, grace period and supported automatic-failover scope and align the runbook with actual behavior. That relates to a separate SQL administration problem: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. The Riverton Utilities requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Implement supported cluster or failover-group role enforcement and application endpoint fencing before allowing writes after recovery. That relates to a separate SQL administration problem: A post-failover application continues writing to a former primary after network recovery because the architecture lacks split-brain protection and role validation. The Riverton Utilities requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Use an appropriate failover group with stable read-write listener routing and supported failover policy when automatic app-level redirection is required. That relates to a separate SQL administration problem: An Azure SQL Database has active geo-replication configured but the application still connects only to the primary and cannot recover automatically when that region fails. The Riverton Utilities requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

After controlled regional failover the application reconnects using the listener and commits approved transactions on the new primary. That result is evidence for another corrective change: Use an appropriate failover group with stable read-write listener routing and supported failover policy when automatic app-level redirection is required. The alternative problem is: An Azure SQL Database has active geo-replication configured but the application still connects only to the primary and cannot recover automatically when that region fails. The current Riverton Utilities issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database. That result is evidence for another corrective change: Configure SQL Server availability group health and replica synchronization telemetry with actionable alerts. The alternative problem is: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. The current Riverton Utilities issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

The secondary transitions to the intended online writable state and accepts an application connection after log application. That result is evidence for another corrective change: Apply required remaining log backups and perform the supported final recovery step before opening the secondary for production access. The alternative problem is: A SQL Server log shipping database is left in an unrecovered state during a planned disaster switch and users cannot connect to it. The current Riverton Utilities issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Monitor replication state and evaluate potential data loss before an unplanned asynchronous geo failover, following business RPO policy. That relates to a separate SQL administration problem: A database team treats an Azure SQL active geo-replica as synchronously consistent and starts a data-critical failover without checking replication lag. The Harborline Logistics requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Check the configured failover policy, grace period and supported automatic-failover scope and align the runbook with actual behavior. That relates to a separate SQL administration problem: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. The Harborline Logistics requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Configure and monitor Always On availability group health, synchronization and appropriate planned-failover readiness. That relates to a separate SQL administration problem: A SQL Server on Azure VM application requires database-level high availability but its Availability Group replica has not synchronized before a planned failover. The Harborline Logistics requirement is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. That approach does not directly establish the required fix; the requested acceptance evidence is: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database. That result is evidence for another corrective change: Configure SQL Server availability group health and replica synchronization telemetry with actionable alerts. The alternative problem is: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. The current Harborline Logistics issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

The secondary transitions to the intended online writable state and accepts an application connection after log application. That result is evidence for another corrective change: Apply required remaining log backups and perform the supported final recovery step before opening the secondary for production access. The alternative problem is: A SQL Server log shipping database is left in an unrecovered state during a planned disaster switch and users cannot connect to it. The current Harborline Logistics issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

A planned failover completes when replicas are synchronized and the application resumes through the supported listener endpoint. That result is evidence for another corrective change: Configure and monitor Always On availability group health, synchronization and appropriate planned-failover readiness. The alternative problem is: A SQL Server on Azure VM application requires database-level high availability but its Availability Group replica has not synchronized before a planned failover. The current Harborline Logistics issue is instead: A region-paired Azure SQL deployment has a secondary database that is too small for reporting load and the team mistakes successful replication for recovery readiness. Its decisive acceptance evidence would be: The designated secondary handles the expected reads and a promotion rehearsal meets documented capacity thresholds.

Use the documented Managed Instance failover and post-failover validation procedure including replica state and application identity. That relates to a separate SQL administration problem: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. The Harborline Logistics requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Use an appropriate failover group with stable read-write listener routing and supported failover policy when automatic app-level redirection is required. That relates to a separate SQL administration problem: An Azure SQL Database has active geo-replication configured but the application still connects only to the primary and cannot recover automatically when that region fails. The Harborline Logistics requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Implement supported cluster or failover-group role enforcement and application endpoint fencing before allowing writes after recovery. That relates to a separate SQL administration problem: A post-failover application continues writing to a former primary after network recovery because the architecture lacks split-brain protection and role validation. The Harborline Logistics requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

A controlled failback test shows only the current authorized primary accepts writes while the previous primary is safely fenced. That result is evidence for another corrective change: Implement supported cluster or failover-group role enforcement and application endpoint fencing before allowing writes after recovery. The alternative problem is: A post-failover application continues writing to a former primary after network recovery because the architecture lacks split-brain protection and role validation. The current Harborline Logistics issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

The secondary transitions to the intended online writable state and accepts an application connection after log application. That result is evidence for another corrective change: Apply required remaining log backups and perform the supported final recovery step before opening the secondary for production access. The alternative problem is: A SQL Server log shipping database is left in an unrecovered state during a planned disaster switch and users cannot connect to it. The current Harborline Logistics issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

A controlled outage follows the documented manual or automatic policy and the test record identifies the correct trigger. That result is evidence for another corrective change: Check the configured failover policy, grace period and supported automatic-failover scope and align the runbook with actual behavior. The alternative problem is: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. The current Harborline Logistics issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Use the documented Managed Instance failover and post-failover validation procedure including replica state and application identity. That relates to a separate SQL administration problem: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. The Cedarfield Hospitality requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Monitor replication state and evaluate potential data loss before an unplanned asynchronous geo failover, following business RPO policy. That relates to a separate SQL administration problem: A database team treats an Azure SQL active geo-replica as synchronously consistent and starts a data-critical failover without checking replication lag. The Cedarfield Hospitality requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Inspect backup, copy and restore job history and restore the log shipping chain with suitable schedules and alerts. That relates to a separate SQL administration problem: An on-premises SQL Server log shipping secondary is consistently hours behind because copy and restore jobs fail without monitoring. The Cedarfield Hospitality requirement is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. That approach does not directly establish the required fix; the requested acceptance evidence is: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint. That result is evidence for another corrective change: Use the documented Managed Instance failover and post-failover validation procedure including replica state and application identity. The alternative problem is: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. The current Cedarfield Hospitality issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

The secondary restore lag declines into the accepted range and all three log shipping stages complete in sequence. That result is evidence for another corrective change: Inspect backup, copy and restore job history and restore the log shipping chain with suitable schedules and alerts. The alternative problem is: An on-premises SQL Server log shipping secondary is consistently hours behind because copy and restore jobs fail without monitoring. The current Cedarfield Hospitality issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

A controlled outage follows the documented manual or automatic policy and the test record identifies the correct trigger. That result is evidence for another corrective change: Check the configured failover policy, grace period and supported automatic-failover scope and align the runbook with actual behavior. The alternative problem is: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. The current Cedarfield Hospitality issue is instead: An availability group becomes unhealthy but operators watch only VM CPU metrics and miss replica connection and synchronization failures. Its decisive acceptance evidence would be: A controlled replica disconnect is detected by the AG monitoring signal and the recovery runbook identifies the affected database.

Use an appropriate failover group with stable read-write listener routing and supported failover policy when automatic app-level redirection is required. That relates to a separate SQL administration problem: An Azure SQL Database has active geo-replication configured but the application still connects only to the primary and cannot recover automatically when that region fails. The Cedarfield Hospitality requirement is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. That approach does not directly establish the required fix; the requested acceptance evidence is: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.

Check the configured failover policy, grace period and supported automatic-failover scope and align the runbook with actual behavior. That relates to a separate SQL administration problem: An Azure SQL failover group is set to manual but the operations runbook claims automatic recovery will occur after any transient outage. The Cedarfield Hospitality requirement is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. That approach does not directly establish the required fix; the requested acceptance evidence is: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.

Configure and monitor Always On availability group health, synchronization and appropriate planned-failover readiness. That relates to a separate SQL administration problem: A SQL Server on Azure VM application requires database-level high availability but its Availability Group replica has not synchronized before a planned failover. The Cedarfield Hospitality requirement is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. That approach does not directly establish the required fix; the requested acceptance evidence is: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.

The incident report records lag at failover and validates the recovered transaction state against the approved RPO. That result is evidence for another corrective change: Monitor replication state and evaluate potential data loss before an unplanned asynchronous geo failover, following business RPO policy. The alternative problem is: A database team treats an Azure SQL active geo-replica as synchronously consistent and starts a data-critical failover without checking replication lag. The current Cedarfield Hospitality issue is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. Its decisive acceptance evidence would be: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.

A controlled failback test shows only the current authorized primary accepts writes while the previous primary is safely fenced. That result is evidence for another corrective change: Implement supported cluster or failover-group role enforcement and application endpoint fencing before allowing writes after recovery. The alternative problem is: A post-failover application continues writing to a former primary after network recovery because the architecture lacks split-brain protection and role validation. The current Cedarfield Hospitality issue is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. Its decisive acceptance evidence would be: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.

The secondary transitions to the intended online writable state and accepts an application connection after log application. That result is evidence for another corrective change: Apply required remaining log backups and perform the supported final recovery step before opening the secondary for production access. The alternative problem is: A SQL Server log shipping database is left in an unrecovered state during a planned disaster switch and users cannot connect to it. The current Cedarfield Hospitality issue is instead: A database DR test promotes the secondary SQL Managed Instance and then reconnects applications without validating data consistency or application write permission. Its decisive acceptance evidence would be: The promoted endpoint permits intended application writes and the sample transaction reconciliation matches the agreed recovery checkpoint.