Microsoft Microsoft Certifications AZ-220 Questions & Answers

• Question 71:

  You have an Azure IoT Central solution that includes multiple IoT devices. The devices report temperature, humidity, and pressure.

  You need to export the sensor data captured during a 48-hour period as a CSV file.

  What should you use in IoT Central?

  A. Devices

  B. Jobs

  C. Device groups

  D. Analytics

  Correct Answer: D

  Azure IoT Central provides rich analytics capabilities to analyze historical trends and correlate telemetry from your devices. To get started, select Analytics on the left pane.

  The analytics user interface has three main components:

  Data configuration panel: On the configuration panel, select the device group for which you want to analyze the data. Next, select the telemetry that you want to analyze and select the aggregation method for each telemetry. The Group By

  control helps to group the data by using device properties as dimensions.

  Time control: Use the time control to select the duration for which you want to analyze the data.

  Chart control: The chart control visualizes the data as a line chart.

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-central/core/howto-create-analytics

• Question 72:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have 20 IoT devices deployed across two floors of a building. The devices on the first floor must be set to 60 degrees. The devices on the second floor must be set to 80 degrees.

  The device twins are configured to use a tag that identifies the floor on which the twins are located.

  You create the following automatic configuration for the devices on the first floor.

  

  You create the following automatic configuration for the devices on the second floor.

  

  The IoT devices on the first floor report that the temperature is set to 80 degrees.

  You need to ensure that the first-floor devices are set to the correct temperature.

  Solution: In the automatic configuration for the second-floor devices, you set Version to 2.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/iot-edge/module-deployment-monitoring?view=iotedge-2020-11 https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-automatic-device-management-cli

• Question 73:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure IoT solution that includes an Azure IoT hub, a Device Provisioning Service instance, and 1,000 connected IoT devices.

  All the IoT devices are provisioned automatically by using one enrollment group.

  You need to temporarily disable the IoT devices from connecting to the IoT hub.

  Solution: You disconnect the Device Provisioning Service from the IoT hub.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead, from the Device Provisioning Service, you disable the enrollment group, and you disable device entries in the identity registry of the IoT hub to which the IoT devices are provisioned.

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-unprovision-devices

• Question 74:

  You have an existing Azure IoT hub.

  You need to connect physical IoT devices to the IoT hub.

  You are connecting the devices through a firewall that allows only port 443 and port 80.

  Which of following three communication protocols can you use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. HTTPS

  B. MQTT

  C. AMQP over WebSocket

  D. MQTT over WebSocket

  Correct Answer: ACD

• Question 75:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have 20 IoT devices deployed across two floors of a building. The devices on the first floor must be set to 60 degrees. The devices on the second floor must be set to 80 degrees.

  The device twins are configured to use a tag that identifies the floor on which the twins are located.

  You create the following automatic configuration for the devices on the first floor.

  

  You create the following automatic configuration for the devices on the second floor.

  

  The IoT devices on the first floor report that the temperature is set to 80 degrees.

  You need to ensure that the first-floor devices are set to the correct temperature.

  Solution: In the automatic configuration for the second-floor devices, you set targetCondition to "tags.floor='second'".

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/iot-edge/module-deployment-monitoring?view=iotedge-2020-11 https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-automatic-device-management-cli

• Question 76:

  You have an Azure IoT hub that has a hostname of contoso-hub.azure-devices.net and an MCU-based IoT device named Device1. Device1 does NOT support Azure IoT SDKs.

  You plan to connect Device1 to the IoT hub by using the Message Queuing Telemetry Transport (MQTT) protocol and to authenticate by using X.509 certificates.

  You need to ensure that Device1 can authenticate to the IoT hub.

  What should you do?

  A. Create an Azure key vault and enable the encryption of data at rest for the IoT hub by using a customer-managed key.

  B. Enable a hardware security module (HSM) on Device1.

  C. From the Azure portal, create an IoT Hub Device Provisioning Service (DPS) instance and add a certificate enrollment for Device1.

  D. Add the DigiCert Baltimore Root Certificate to Device1.

  Correct Answer: D

  The connection to Azure IoT Hub with MQTT is secured using TLS.

  The Azure IoT Hub library requires the provisioning of the following certificates and a private key for a successful TLS connection:

  1.

  Baltimore CyberTrust Root certificate - Server certificate, used to verify the server's certificate while connecting.

  2.

  Device certificate - generated by the procedures described in Creating Azure IoT Hub certificates , used by Azure IoT Hub to authenticate the device.

  3.

  Private key of the device.

  Reference: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/include/net/azure_iot_hub.html

• Question 77:

  From the Device Provisioning Service, you create an enrollment as shown in the exhibit.

  

  You need to deploy a new IoT device.

  What should you use as the device identity during attestation?

  A. a self-signed X.509 certificate

  B. the random string of alphanumeric characters

  C. the HMAC-SHA256 hash of the device's registration ID

  D. the endorsement key of the device's Trusted Platform Module (TPM)

  Correct Answer: C

  Each device uses its derived device key with your unique registration ID to perform symmetric key attestation with the enrollment during provisioning. To generate the device key, use the key you copied from your DPS enrollment to compute an HMAC-SHA256 of the unique registration ID for the device and convert the result into Base64 format.

  Reference: https://docs.microsoft.com/en-us/azure/iot-edge/how-to-auto-provision-symmetric-keys

• Question 78:

  You have an Azure IoT hub that uses a Device Provisioning Service instance.

  You have 1,000 legacy IoT devices that only support MAC address or serial number identities. The devices do NOT have a security feature that can be used to securely identify the device or a hardware security module (HSM).

  You plan to deploy the devices to a secure environment.

  You need to configure the Device Provisioning Service instance to ensure that all the devices are identified securely before they receive updates.

  Which attestation mechanism should you choose?

  A. Trusted Platform Module (TPM) 1.2 attestation

  B. symmetric key attestation

  C. X.509 certificates

  Correct Answer: B

  A common problem with many legacy devices is that they often have an identity that is composed of a single piece of information. This identity information is usually a MAC address or a serial number. Legacy devices may not have a certificate, TPM, or any other security feature that can be used to securely identify the device. The Device Provisioning Service for IoT hub includes symmetric key attestation. Symmetric key attestation can be used to identify a device based off information like the MAC address or a serial number.

  Reference: https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-legacy-device-symm-key

• Question 79:

  You have an Azure IoT hub that is being taken from prototype to production.

  You plan to connect IoT devices to the IoT hub. The devices have hardware security modules (HSMs).

  You need to use the most secure authentication method between the devices and the IoT hub. Company policy prohibits the use of internally generated certificates.

  Which authentication method should you use?

  A. an X.509 self-signed certificate

  B. a certificate thumbprint

  C. a symmetric key

  D. An X.509 certificate signed by a root certification authority (CA).

  Correct Answer: D

  Purchase X.509 certificates from a root certificate authority (CA). This method is recommended for production environments.

  The hardware security module, or HSM, is used for secure, hardware-based storage of device secrets, and is the most secure form of secret storage. Both X.509 certificates and SAS tokens can be stored in the HSM

  Reference:

  https://docs.microsoft.com/en-us/azure/iot-dps/concepts-security

• Question 80:

  You use Azure Security Center in an Azure IoT solution.

  You need to exclude some security events. The solution must minimize development effort.

  What should you do?

  A. Create an Azure function to filter security messages.

  B. Add a configuration to the code of the physical IoT device.

  C. Add configuration details to the device twin object.

  D. Create an azureiotsecurity module twin and add configuration details to the module twin object.

  Correct Answer: D

  Properties related to every Azure Security Center for IoT security agent are located in the agent configuration object, within the desired properties section, of the azureiotsecurity module.

  To modify the configuration, create and modify this object inside the azureiotsecurity module twin identity.

  Note: Azure Security Center for IoT's security agent twin configuration object is a JSON format object. The configuration object is a set of controllable properties that you can define to control the behavior of the agent.

  These configurations help you customize the agent for each scenario required. For example, automatically excluding some events, or keeping power consumption to a minimal level are possible by configuring these properties.

  Reference:

  https://docs.microsoft.com/en-us/azure/asc-for-iot/how-to-agent-configuration