Microsoft Microsoft Certifications AZ-220 Questions & Answers

• Question 51:

  You have an Azure IoT solution that contains an Azure IoT hub and 100 IoT devices. The devices run Windows Server 2016.

  You need to deploy the Azure Defender for IoT C#-based security agent to the devices.

  What should you do first?

  A. On the devices, initialize Trusted Platform Module (TPM).

  B. From the IoT hub, create a system-assigned managed identity.

  C. From the IoT hub, create a security module for the devices.

  D. On the devices, set the PowerShell execution policy to Restricted.

  Correct Answer: C

  The IoT Edge security manager provides a safe framework for security service extensions through host-level modules. The IoT Edge security manager include Ensure safe operation of client agents for services including Device Update for IoT Hub and Azure Defender for IoT.

  Reference: https://docs.microsoft.com/en-us/azure/iot-edge/iot-edge-security-manager

• Question 52:

  You deploy an Azure Digital Twins instance.

  You are developing client code that will modify digital twin data.

  You run the client code and receive the following response for an Azure Digital Twins API.

  403 (Forbidden)

  You need to configure access control for the Azure Digital Twins instance to ensure that the client code can modify the data.

  Which role should you assign?

  A. Contributor

  B. Azure Digital Twins Data Owner

  C. Owner

  D. Managed Application Operator Role

  Correct Answer: B

  Most often, this error indicates that your Azure role-based access control (Azure RBAC) permissions for the service aren't set up correctly. Many actions for an Azure Digital Twins instance require you to have the Azure Digital Twins Data Owner role on the instance you are trying to manage.

  Reference: https://docs.microsoft.com/en-us/azure/digital-twins/troubleshoot-error-403

• Question 53:

  You have an Azure IoT hub.

  You need to enable Azure Defender for IoT on the IoT hub.

  What should you do?

  A. From the Security settings of the IoT hub, select Secure your IoT solution.

  B. From the Diagnostics settings of the IoT hub, select Add diagnostic setting.

  C. From Defender, add a security policy.

  D. From Defender, configure security alerts.

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-iot/device-builders/quickstart-onboard-iot-hub

• Question 54:

  You have an Azure subscription that contains an Azure IoT hub and two Azure IoT Edge devices named Device1 and Device2.

  You need to ensure that the IoT hub only accepts connections from Device1 and Device2.

  What should you configure?

  A. a private endpoint connection

  B. Azure API Management

  C. Azure Active Directory (Azure AD) Identity Protection

  D. a gateway device

  Correct Answer: A

  Ingress connectivity to IoT Hub using Azure Private Link. A private endpoint is a private IP address allocated inside a customer-owned VNet via which an Azure resource is reachable. Through Azure Private Link, you can set up a private endpoint for your IoT hub to allow services inside your VNet to reach IoT Hub without requiring traffic to be sent to IoT Hub's public endpoint. Similarly, your on-premises devices can use Virtual Private Network (VPN) or ExpressRoute peering to gain connectivity to your VNet and your IoT Hub (via its private endpoint). As a result, you can restrict or completely block off connectivity to your IoT hub's public endpoints by using IoT Hub IP filter or the public network access toggle. This approach keeps connectivity to your Hub using the private endpoint for devices.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/virtual-network-support

• Question 55:

  You have an Azure IoT hub and 15,000 IoT devices that monitor temperature. The IoT hub has four partitions. Each IoT device sends a 1-KB message every five seconds.

  You plan to use Azure Stream Analytics to process the telemetry stream and generate an alert when temperatures exceed a defined threshold.

  You need to recommend the minimum number of streaming units to configure for Stream Analytics.

  What should you recommend?

  A. 1

  B. 3

  C. 6

  D. 12

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/stream-analytics/stream-analytics-parallelization#calculate-the-maximum-streaming-units-of-a-job

• Question 56:

  You have an Azure IoT solution that contains an Azure IoT hub.

  You need to ensure that the IoT hub configuration is compliant with the Health Insurance Portability and Accountability Act (HIPAA) audit logging requirements.

  What should you use?

  A. Azure Advisor recommendations

  B. an Azure Policy definition

  C. Azure Monitor alerts

  D. an Azure Sentinel workspace

  Correct Answer: B

  Regulatory Compliance in Azure Policy provides Microsoft created and managed initiative definitions, known as built-ins, for the compliance domains and security controls related to different compliance standards, including HIPAA auditing logging.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/security-controls-policy

• Question 57:

  You have an Azure subscription that contains an Azure IoT hub, 500 IoT devices, and an Azure Time Series Insights Gen2 environment named Environment1.

  You need to add calculated values to the Time Series Model.

  What should you use?

  A. instances

  B. types

  C. hierarchies

  Correct Answer: B

  Time Series Model types help you define variables or formulas for doing computations. Types are associated with a specific instance.

  A type can have one or more variables. For example, a Time Series Model instance might be of type Temperature Sensor, which consists of the variables avg temperature, min temperature, and max temperature.

  Incorrect Answers:

  A: Time Series Model instances are virtual representations of the time series themselves.

  In most cases, instances are uniquely identified by deviceId or assetId, which are saved as time series IDs.

  C: Time Series Model hierarchies organize instances by specifying property names and their relationships.

  Reference:

  https://docs.microsoft.com/en-us/azure/time-series-insights/concepts-model-overview

• Question 58:

  You have an Azure IoT hub that has 1,000 registered devices.

  You create an Azure logic app.

  You need to send Device Connected and Device Disconnected events in real time to the logic app.

  What should you do?

  A. From the Message routing blade of the IoT hub, add a route, Route DeviceLifecycleEvents to an Azure Service Bus queue.

  B. From the Diagnostic settings blade of the IoT hub, add a diagnostic setting. Route the connection logs to a Log Analytics workspace.

  C. From the Events blade of the IoT hub, add an event subscription. Configure the Filter to Event Types setting and route the events to a webhook.

  Correct Answer: C

  Reference:

  https://sandervandevelde.wordpress.com/2019/12/20/subscribe-your-iothub-to-eventgrid- as-event-source/

• Question 59:

  You have an Azure IoT hub.

  You need to check whether the IoT hub was affected by an outage.

  What should you select in the Azure portal? To answer, select the appropriate option in the answer area.

  NOTE: Each correct selection is worth one point.

  A. Resource health

  B. Metrics

  C. Alerts

  D. Diagnostic settings

  Correct Answer: A

  https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-azure-service-health-integration

• Question 60:

  You have an Azure IoT solution.

  You need to test that the solution remains functional if IoT Hub is affected by a regional outage.

  What should you do?

  A. From the IoT hub, set Allow public network access to Disabled.

  B. From the IoT hub, start a manual failover.

  C. From the Device Provisioning Service (DPS), unlink the IoT hub.

  D. From the IoT hub, select Disable fallback route.

  Correct Answer: B

  Manual failover is a feature of the IoT Hub service that allows customers to failover their hub's operations from a primary region to the corresponding Azure geo-paired region. Manual failover can be done in the event of a regional disaster or an extended service outage. You can also perform a planned failover to test your disaster recovery capabilities, although we recommend using a test IoT hub rather than one running in production.

  Reference: https://docs.microsoft.com/en-us/azure/iot-hub/tutorial-manual-failover