Microsoft Microsoft Certifications AZ-220 Questions & Answers

• Question 151:

  DRAG DROP

  You have an Azure IoT Central application that includes a Device Provisioning Service instance.

  You need to connect IoT devices to the application without first registering the devices.

  In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step: With DPS (Device Provisioning Service) you can generate device credentials and configure the devices offline without registering the devices through IoT Central UI. Connect devices that use SAS tokens without registering

  1.

  Copy the IoT Central application's group primary key

  2.

  Use the dps-keygen tool to generate the device SAS keys. Use the group primary key from the previous step. The device IDs must be lower-case: dps-keygen -mk: -di:

  3.

  The OEM flashes each device with a device ID, a generated device SAS key, and the application ID scope value.

  4.

  When you switch on a device, it first connects to DPS to retrieve its IoT Central registration information.

  The device initially has a device status Unassociated on the Devices page and isn't assigned to a device template. On the Devices page, Migrate the device to the appropriate device template. Device provisioning is now complete, the device

  status is now Provisioned, and the device can start sending data.

  On the Administration > Device connection page, the Auto approve option controls whether you need to manually approve the device before it can start sending data.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-central/core/concepts-get-connected

• Question 152:

  DRAG DROP

  You have an instance of Azure Time Series Insights and an Azure IoT hub that receives streaming telemetry from IoT devices.

  You need to configure Time Series Insights to receive telemetry from the devices.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a dedicated consumer group..

  Add a consumer group to your IoT hub.

  Applications use consumer groups to pull data from Azure IoT Hub. To reliably read data from your IoT hub, provide a dedicated consumer group that's used only by this Time Series Insights environment.

  Step 2: Add a new Time Series Insights event source.

  Add a new event source

  Sign in to the Azure portal.

  In the left menu, select All resources. Select your Time Series Insights environment.

  Under Settings, select Event Sources, and then select Add.

  In the New event source pane, for Event source name, enter a name that's unique to this Time Series Insights environment. For example, enter event-stream.

  Step 3: Configure the Time Series event source to connect to an existing IOT hub

  Step 4: For Source, select IoT Hub.

  Step 5: Select a value for Import option:

  If you already have an IoT hub in one of your subscriptions, select Use IoT Hub from available subscriptions. This option is the easiest approach.

  Reference:

  https://docs.microsoft.com/en-us/azure/time-series-insights/time-series-insights-how-to-add-an-event-source-iothub

• Question 153:

  DRAG DROP

  You have an Azure IoT hub named Hub1 and a root certification authority (CA) named CA1. Hub1 is configured to use X.509 certificate device authentication.

  You and a custom manufacturing partner complete a proof of possession flow.

  You plan to deploy IoT devices manufactured by the custom manufacturing partner. Each device will have a certificate generated by an intermediate CA. The devices will authenticate by using device certificates signed by the partner.

  You need to ensure that the custom devices can connect successfully to Hub1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Sign the intermediate CA certificate by using the CA1 certificate.

  X.509 certificates are typically arranged in a certificate chain of trust in which each certificate in the chain is signed by the private key of the next higher certificate, and so on, terminating in a self-signed root certificate. This arrangement establishes a delegated chain of trust from the root certificate generated by a trusted root certificate authority (CA) down through each intermediate CA to the end-entity "leaf" certificate installed on a device.

  Box 2: Sign the device certificate by using the intermediate CA

  An intermediate certificate is an X.509 certificate, which has been signed by the root certificate (or by another intermediate certificate with the root certificate in its chain). The last intermediate certificate in a chain is used to sign the leaf

  certificate. An intermediate certificate can also be referred to as an intermediate CA certificate.

  Box 3: Deploy the certificate chain to the device.

  The leaf certificate, or end-entity certificate, identifies the certificate holder. It has the root certificate in its certificate chain as well as zero or more intermediate certificates. The leaf certificate is not used to sign any other certificates. It uniquely

  identifies the device to the provisioning service and is sometimes referred to as the device certificate. During authentication, the device uses the private key associated with this certificate to respond to a proof of possession challenge from the

  service.

  Reference: https://docs.microsoft.com/en-us/azure/iot-dps/concepts-x509-attestation

• Question 154:

  DRAG DROP

  You have 100 devices that connect to an Azure IoT hub.

  You need to be notified about failed local logins to a subnet of the devices.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Enable Azure Security Center for IoT

  Security alerts, such as failed local IoT hub logins, are stored in AzureSecurityOfThings.SecurityAlert table in the Log Analytics workspace configured for the Azure Security Center for IoT solution.

  Step 2: Select a device security group

  Update a device security group..

  Step 3: Create a custom alert rule

  ..by creating a custom alert rule

  Reference:

  https://docs.microsoft.com/bs-latn-ba/azure/asc-for-iot/how-to-security-data-access

  https://docs.microsoft.com/en-us/rest/api/securitycenter/devicesecuritygroups/createorupdate

• Question 155:

  DRAG DROP

  You are troubleshooting device connections to and disconnections from an Azure IoT hub.

  You configure diagnostic logging for the IoT hub to send to Log Analytics.

  You need to generate a report that displays the device connection and disconnection events.

  How should you complete the query? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: ResourceProvider ==

  Query to monitor your IoT hub connectivity Errors: Identify device connection errors.

  AzureDiagnostics

  | where ResourceProvider == "MICROSOFT.DEVICES" and ResourceType == "IOTHUBS"

  | where Category == "Connections" and Level == "Error"

  Box 2: ResourceType ==

  Box 3: Category ==

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-hub/monitor-iot-hub

• Question 156:

  DRAG DROP

  You need to install the Azure IoT Edge runtime on a new device that runs Windows 10 IoT Enterprise.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From Azure IoT Hub, create an IoT Edge Device

  Step 2: Deploy-IoTEdge

  The Deploy-IoTEdge command checks that your Windows machine is on a supported version, turns on the containers feature, and then downloads the moby runtime and the IoT Edge runtime. The command defaults to using Windows

  containers.

  {Invoke-WebRequest -useb https://aka.ms/iotedge-win} | Invoke-Expression; `

  Deploy-IoTEdge

  Step 3: Initialize-IoTEdge

  The Initialize-IoTEdge command configures the IoT Edge runtime on your machine. The command defaults to manual provisioning with Windows containers.

  {Invoke-WebRequest -useb https://aka.ms/iotedge

  Step 4: Enter the IoT Edge device connection string.

  When prompted, provide the device connection string that you retrieved in step 1. The device connection string associates the physical device with a device ID in IoT Hub.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-edge/module-composition

• Question 157:

  DRAG DROP

  Your company is creating a new camera security system that will use Azure IoT Hub.

  You plan to use an Azure IoT Edge device that will run Ubuntu Server 18.04.

  You need to configure the IoT Edge device.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Run the following commands

  Install the container runtime.

  Azure IoT Edge relies on an OCI-compatible container runtime. For production scenarios, we recommended that you use the Moby-based engine provided below. The Moby engine is the only container engine officially supported with Azure

  IoT Edge. Docker CE/EE container images are compatible with the Moby runtime.

  Install the Moby engine.

  sudo apt-get install moby-engine

  Install the Moby command-line interface (CLI). The CLI is useful for development but optional for production deployments.

  sudo apt-get install moby-cli

  Install the security daemon. The package is installed at /etc/iotedge/.

  sudo apt-get install iotedge

  Step 2: From Iot Hub,create an IoT Edge device registry entry.

  Note: In your IoT Hub in the Azure portal, IoT Edge devices are created and managed separately from IOT devices that are not edge enabled.

  Sign in to the Azure portal and navigate to your IoT hub.

  In the left pane, select IoT Edge from the menu.

  Select Add an IoT Edge device.

  Provide a descriptive device ID. Use the default settings to auto-generate authentication keys and connect the new device to your hub.

  Select Save.

  Retrieve the connection string in the Azure portal

  1.

  When you're ready to set up your device, you need the connection string that links your physical device with its identity in the IoT hub.

  2.

  From the IoT Edge page in the portal, click on the device ID from the list of IoT Edge devices.

  3.

  Copy the value of either Primary Connection String or Secondary Connection String.

  Step 3: Add the connection string to..

  To manually provision a device, you need to provide it with a device connection string that you can create by registering a new device in your IoT hub.

  Open the configuration file.

  sudo nano /etc/iotedge/config.yaml

  Find the provisioning configurations of the file and uncomment the Manual provisioning configuration section. Update the value of device_connection_string with the connection string from your IoT Edge device.

  Save and close the file.

  After entering the provisioning information in the configuration file, restart the daemon:

  sudo systemctl restart iotedge

  Reference: https://docs.microsoft.com/en-us/azure/iot-edge/how-to-install-iot-edge-linux

• Question 158:

  DRAG DROP

  You have an Azure IoT solution that includes an Azure IoT hub.

  You receive a root certification authority (CA) certificate from the security department at your company.

  You need to configure the IoT hub to use the root CA certificate.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/iot-hub/iot-hub-security-x509-get-started

• Question 159:

  DRAG DROP

  You have an Azure IoT Edge solution.

  You plan to deploy an Azure Security Center for IoT security agent. You need to configure the security agent to meet the following requirements:

  1.

  Connection events must be reported as high priority.

  2.

  High priority events must be collected every seven minutes.

  How should you configure the azureiotsecurity module twin? To answer, drag the appropriate values to the correct locations. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or

  scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: "desired": {

  To configure connection events as high priority and collect high priority events every 7 minutes, use the following configuration.

  "desired": { "ms_iotn:urn_azureiot_Security_SecurityAgentConfiguration": { "highPriorityMessageFrequency": {

  "value": "PT7M"

  },

  "eventPriorityConnectionCreate": {

  "value": "High"

  }

  Box 2: "highPriorityMessageFrequency ": { Box 3: "eventPriorityConnectionCreate": { Reference:

  https://docs.microsoft.com/en-us/azure/defender-for-iot/how-to-agent-configuration

• Question 160:

  DRAG DROP

  Your company develops a custom module and exports the module as a Linux Dockerfile.

  You need to deploy the module to an Azure IoT Edge device that runs Ubuntu Server 18.04.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: From Microsoft Visual Studio Code

  The Azure IoT Tools extension provides project templates for all supported IoT Edge module languages in Visual Studio Code. These templates have all the files and code that you need to deploy a working module to test IoT Edge, or give

  you a starting point to customize the template with your own business logic.

  Step 2: Build and push the module to Azure Container Registry

  Build and push your solution. Review the module code and the deployment. Then build the SampleModule container image and push it to your container registry.

  Step 3: Create a deployment for the IoT Edge device.

  Verify that the built container images are stored in your container registry, then deploy the modules to the device.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-edge/tutorial-develop-for-linux?view=iotedge-2020-11