Microsoft Microsoft Certifications AZ-220 Questions & Answers

• Question 121:

  You have an Azure IoT hub that uses a Device Provisioning Service instance.

  You create a new individual device enrollment that uses symmetric key attestation.

  Which detail from the enrollment is required to auto provision the device by using the Device Provisioning Service?

  A. the registration ID of the enrollment

  B. the primary key of the enrollment

  C. the device identity of the IoT hub

  D. the hostname of the IoT hub

  Correct Answer: A

  The registration ID is used to uniquely identify a device registration with the Device Provisioning Service. The device ID must be unique in the provisioning service

  ID scope. Each device must have a registration ID.

  Note: An individual enrollment is an entry for a single device that may register. Individual enrollments may use either X.509 leaf certificates or SAS tokens (from a physical or virtual TPM) as attestation mechanisms. The registration ID in an

  individual enrollment is alphanumeric, lowercase, and may contain hyphens.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-dps/concepts-service#enrollment

• Question 122:

  You have an Azure subscription that contains a resource group named RG1.

  You need to deploy the Device Provisioning Service. The solution must ensure that the Device Provisioning Service can accept new device enrollments.

  You create a Device Provisioning Service instance.

  Which two actions should you perform next? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Linked IoT hubs blade of the Device Provisioning Service, link an Azure IoT hub.

  B. From the Azure portal, create a new Azure IoT hub.

  C. From the Manage allocation policy blade of the Device Provisioning Service, configure an allocation policy.

  D. From the Certificates blade of the Device Provisioning Service, upload an X.509 certificate to the Device Provisioning Service.

  Correct Answer: D

  A: The Device Provisioning Service can only provision devices to IoT hubs that have been linked to it.

  C: Allocation policy. The service-level setting that determines how Device Provisioning Service assigns devices to an IoT hub. There are three supported allocation policies:

  Lowest latency: devices are provisioned to an IoT hub with the lowest latency to the device.

  Evenly weighted distribution

  Static configuration via the enrollment list

  Reference:

  https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/concepts-service

• Question 123:

  You have 10,000 IoT devices that connect to an Azure IoT hub. The devices do not support over-the-air (OTA) updates.

  You need to decommission 1,000 devices. The solution must prevent connections and autoenrollment for the decommissioned devices.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Update the connectionState device twin property on all the devices.

  B. Blacklist the X.509 root certification authority (CA) certificate for the enrollment group.

  C. Delete the enrollment entry for the devices.

  D. Remove the identity certificate from the hardware security module (HSM) of the devices.

  E. Delete the device identity from the device registry of the IoT hub.

  Correct Answer: BC

  B: X.509 certificates are typically arranged in a certificate chain of trust. If a certificate at any stage in a chain becomes compromised, trust is broken. The certificate must be blacklisted to prevent Device Provisioning Service from provisioning devices downstream in any chain that contains that certificate.

  C: Individual enrollments apply to a single device and can use either X.509 certificates or SAS tokens (in a real or virtual TPM) as the attestation mechanism. (Devices that use SAS tokens as their attestation mechanism can be provisioned only through an individual enrollment.) To blacklist a device that has an individual enrollment, you can either disable or delete its enrollment entry.

  To blacklist a device that has an individual enrollment, you can either disable or delete its enrollment entry.

  Reference: https://docs.microsoft.com/en-us/azure/iot-dps/how-to-revoke-device-access-portal

• Question 124:

  You have three Azure IoT hubs named Hub1, Hub2, and Hub3, a Device Provisioning Service instance, and an IoT device named Device1.

  Each IoT hub is deployed to a separate Azure region.

  Device enrollment uses the Lowest latency allocation policy.

  The Device Provisioning Service uses the Lowest latency allocation policy.

  Device1 is auto-provisioned to Hub1 by using the Device Provisioning Service.

  Device1 regularly moves between regions.

  You need to ensure that Device1 always connects to the IoT hub that has the lowest latency.

  What should you do?

  A. Configure device attestation that uses X.509 certificates.

  B. Implement device certificate rolling.

  C. Disenroll and reenroll Device1.

  D. Configure the re-provisioning policy.

  Correct Answer: D

  Automated re-provisioning support.

  Microsoft added first-class support for device re-provisioning which allows devices to be reassigned to a different IoT solution sometime after the initial solution assignment. Re-provisioning support is available in two options:

  Factory reset, in which the device twin data for the new IoT hub is populated from the enrollment list instead of the old IoT hub. This is common for factory reset scenarios as well as leased device scenarios.

  Migration, in which device twin data is moved from the old IoT hub to the new IoT hub. This is common for scenarios in which a device is moving between geographies.

  Reference:

  https://azure.microsoft.com/en-us/blog/new-year-newly-available-iot-hub-device-provisioning-service-features/

• Question 125:

  You create an Azure IoT hub by running the following command.

  az iot hub create --resource-group MyResourceGroup --name MyIotHub --sku B1 --location westus --partition-count 4

  What does MylotHub support?

  A. Device Provisioning Service

  B. cloud-to-device messaging

  C. Azure IoT Edge

  D. device twins

  Correct Answer: A

  The Device Provisioning Service is included in the Basic Tiers (such as B1).

  Incorrect Answers:

  B, C, D: The Standard tier is needed for cloud-to-device messaging, Azure IoT Edge, and device twins.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-scaling

• Question 126:

  You have an existing Azure IoT hub.

  You need to connect physical IoT devices to the IoT hub.

  You are connecting the devices through a firewall that allows only port 443 and port 80.

  Which three communication protocols can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. MQTT over WebSocket

  B. AMQP

  C. AMQP over WebSocket

  D. MQTT

  E. HTTPS

  Correct Answer: ACE

  MQTT over WebSockets, AMQP over WebSocket, and HTTPS use port 443.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-protocols

• Question 127:

  You have an Azure IoT solution that includes an Azure IoT hub and 100 Azure IoT Edge devices.

  You plan to deploy the IoT Edge devices to external networks. The firewalls of the external networks only allow traffic on port 80 and port 443.

  You need to ensure that the devices can connect to the IoT hub. The solution must minimize costs.

  What should you do?

  A. Configure the upstream protocol of the devices to use MQTT over TCP.

  B. Configure the upstream protocol of the devices to use MQTT over WebSocket.

  C. Connect the external networks to the IoT solution by using ExpressRoute.

  D. Integrate cellular communication hardware onto the devices and avoid the use of the external networks.

  Correct Answer: B

  MQTT over WebSockets uses port 443.

  Note: Devices can communicate with IoT Hub in Azure using various protocols. Typically, the choice of protocol is driven by the specific requirements of the solution. The following table lists the outbound ports that must be open for a device to

  be able to use a specific protocol:

  

  Incorrect Answers:

  A: MQTT over TCP uses port 883.

  C: ExpressRoute uses BGP, which uses TCP port 179.

  D: HTTPS proxy also uses port 443, but it would be a more expensive solution.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-protocols

• Question 128:

  You have 100 devices that connect to an Azure IoT hub named Hub1. The devices connect by using a symmetric key.

  You deploy an IoT hub named Hub2.

  You need to migrate 10 devices from Hub1 to Hub2. The solution must ensure that the devices retain the existing symmetric key.

  What should you do?

  A. Add a desired property to the device twin of Hub2. Update the endpoint of the 10 devices to use Hub2.

  B. Add a desired property to the device twin of Hub1. Recreate the device identity on Hub2.

  C. Recreate the device identity on Hub2. Update the endpoint of the 10 devices to use Hub2.

  D. Disable the 10 devices on Hub1. Update the endpoint of the 10 devices to use Hub2.

  Correct Answer: B

  Desired properties. Used along with reported properties to synchronize device configuration or conditions. The solution back end can set desired properties, and the device app can read them. The device app can also receive notifications of changes in the desired properties.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-device-twins

• Question 129:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have devices that connect to an Azure IoT hub. Each device has a fixed GPS location that includes latitude and longitude.

  You discover that a device entry in the identity registry of the IoT hub is missing the GPS location.

  You need to configure the GPS location for the device entry. The solution must prevent the changes from being propagated to the physical device.

  Solution: You add the desired properties to the device twin.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Device Twins are used to synchronize state between an IoT solution's cloud service and its devices. Each device's twin exposes a set of desired properties and reported properties. The cloud service populates the desired properties with values it wishes to send to the device. When a device connects it requests and/or subscribes for its desired properties and acts on them.

  Reference: https://azure.microsoft.com/sv-se/blog/deep-dive-into-azure-iot-hub-notifications-and-device-twin/

• Question 130:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure IoT solution that includes an Azure IoT hub, a Device Provisioning Service instance, and 1,000 connected IoT devices.

  All the IoT devices are provisioned automatically by using one enrollment group. You need to temporarily disable the IoT devices from the connecting to the IoT hub.

  Solution: From the Device Provisioning Service, you disable the enrollment group, and you disable device entries in the identity registry of the IoT hub to which the IoT devices are provisioned.

  Does the solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  You may find it necessary to deprovision devices that were previously auto-provisioned through the Device Provisioning Service. In general, deprovisioning a device involves two steps:

  1.

  Disenroll the device from your provisioning service, to prevent future auto-provisioning. Depending on whether you want to revoke access temporarily or permanently, you may want to either disable or delete an enrollment entry.

  2.

  Deregister the device from your IoT Hub, to prevent future communications and data transfer. Again, you can temporarily disable or permanently delete the device's entry in the identity registry for the IoT Hub where it was provisioned.

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-unprovision-devices