Microsoft Role-based AZ-600 Questions & Answers

• Question 1:

  DRAG DROP

  You have a connected Azure Stack Hub integrated system.

  You need to deploy an Operator Access Workstation (OAW) virtual machine image.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Connect to the Hardware Lifecycle Host (HLH) Create the OAW VM using a script

  The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub.

  Sign in to the HLH with your credentials. (Step 1) Download OAW.zip and extract the files. (Step 2) Open an elevated PowerShell session. (Step 3)

  Navigate to the extracted contents of the OAW.zip file.

  Run the New-OAW.ps1 script.

  Step 2: From microsoft.com, download the OAW.zip file and extract the contents Download files

  Because of the stateless nature of the solution, there are no updates for the OAW VM. For each milestone, a new version of the VM image file is released. Use the latest version to create a new OAW VM. The image file is based on the latest

  Windows Server 2019 version. After installation, you can apply updates, including any critical updates, using Windows Update.

  Validate the hash of the downloaded OAW.zip file to make sure it hasn't been modified before using it to create the OAW VM.

  Step 3: From an elevated PowerShell session, run the New-OAW.ps1 script.

• Question 2:

  DRAG DROP

  You have an Azure Stack Hub integrated system linked to an Azure AD tenant named contoso.onmicrosoft.com.

  You need to allow users in an Azure AD tenant named adatum.onmicrosoft.com to access Azure Stack Hub resources.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Register a guest directory

  To register a guest directory for multi-tenancy, you need to configure both the home Azure Stack Hub directory and the guest directory.

  Configure Azure Stack Hub directory

  The first step is to make your Azure Stack Hub system aware of the guest directory. In this example, the directory from Mary's company, Adatum, is called adatum.onmicrosoft.com.

  1.

  Sign in to the Azure Stack Hub administrator portal and go to All services - Directories.

  2.

  Select Add to start the onboarding process. Enter the guest directory name "adatum.onmicrosoft.com", and then select Add. (Step 1)

  3.

  The guest directory appears in the list view, with a status of unregistered.

  4.

  Only Mary has the credentials to authenticate to the guest directory, so you must send her the link to complete the registration. Select the adatum.onmicrosoft.com checkbox, and then select Register. (Step 2)

  5.

  A new browser tab opens. Select Copy link at the bottom of the page, and provide it to Mary. (Step 3)

  6.

  If you have the credentials for the guest directory, you can complete the registration yourself by selecting Sign in.

• Question 3:

  DRAG DROP

  You have an Azure Stack Hub integrated system that is enabled for mufti-tenancy. The integrated system is configured as shown in the following table.

  

  You need lo onboard fabrikam.com as a guest Azure AD tenant to the integrated system.

  How should you complete the Power Shell script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  

• Question 4:

  DRAG DROP

  You have an Azure Stack Hub integrated system.

  The retention period for storage accounts is set to 7 days.

  A user reports that a storage account named hr12943 was deleted accidentally two days ago.

  You need to restore hr12943.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Connect to the administrator portal Find a storage account The list of storage accounts in the region can be viewed in Azure Stack Hub by following these steps:

  1.

  Sign in to the administrator portal https://adminportal.local.azurestack.external.

  2.

  Select All services > Storage > Storage accounts.

  

  By default, the first 10 accounts are displayed. You can choose to fetch more by clicking the Load more link at the bottom of the list.

  Step 2: Open the Storage accounts blade.

  Step 3: Select hr12943.

  Once you've located the accounts you're interested in viewing, you can select the particular account to view certain details. A new pane opens with the account details. These details include the kind of account, creation time, location, and so

  on.

  Step 4: Select Recover.

  Recover a deleted account

  You may be in a situation where you need to recover a deleted account.

  In Azure Stack Hub, there's a simple way to do that:

  Browse to the storage accounts list. For more information, see Find a storage account at the top of this article.

  Locate that particular account in the list. You may need to filter. Check the state of the account. It should say Deleted. Select the account, which opens the account details pane. (Step 3 above) On top of this pane, locate the Recover button

  and select it. (Step 4) Select Yes to confirm.

• Question 5:

  DRAG DROP

  You have an Azure Stack Hub integrated system. The current VIP pool uses a subnet of 192.168.203.0/24 and has routing configured to use BGP.

  In the administrator portal, you receive an alert that the public IP addresses are at 95 percent utilization.

  You need to add 192.168.204.0/24 to the public IP address pool.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 6:

  DRAG DROP

  You have an Azure subscription named sub1 linked to an Azure Active Directory (Azure AD) tenant named contoso.com

  You have an Azure Stack Hub integrated system that is registered to sub1.

  You need to delegate registering the Azure Stack Hub integrated system to an Azure Stack Hub operator. The solution must use the Principle of least privilege.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a JSON file that contains the role definition. Rather than using an account that has Owner permissions in the Azure subscription, you can create a custom role to assign permissions to a less-privileged user account. This

  account can then be used to register your Azure Stack Hub.

  Create a custom role using PowerShell

  Use the following JSON template to simplify creation of the custom role. The template creates a custom role that allows the required read and write access for Azure Stack Hub registration.

  1.

  Create a JSON file. For example, C:\CustomRoles\registrationrole.json.

  2.

  Add the following JSON to the file. Replace with your Azure subscription ID.

  {

  "Name": "Azure Stack Hub registration role",

  "Id": null,

  "IsCustom": true,

  "Description": "Allows access to register Azure Stack Hub", "Actions": [

  "Microsoft.Resources/subscriptions/resourceGroups/write", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.AzureStack/registrations/*",

  "Microsoft.AzureStack/register/action",

  "Microsoft.Authorization/roleAssignments/read",

  "Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete", "Microsoft.Authorization/permissions/read",

  "Microsoft.Authorization/locks/read",

  "Microsoft.Authorization/locks/write"

  ],

  "NotActions": [

  ],

  "AssignableScopes": [

  "/subscriptions/"

  ]

  }

  3.

  In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or User Access Administrator.

  Connect-AzAccount

  4.

  To create the custom role, use New-AzRoleDefinition specifying the JSON template file.

  New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"

  Step 2: From Azure Cloud shell, run the New-AzRoleDefinition cmdlet.

  Step 3: From the Azure portal, add a role assignment to sub1.

  Assign a user to registration role

  After the registration custom role is created, assign the role to the user account that will be used for registering Azure Stack Hub.

  Sign in with the account with sufficient permission on the Azure subscription to delegate rights - such as Owner or User Access Administrator.

  In Subscriptions, select Access control (IAM) > Add role assignment.

  In Role, choose the custom role you created: Azure Stack Hub registration role.

  Select the users you want to assign to the role. Select Save to assign the selected users to the role.

• Question 7:

  DRAG DROP

  You have an Azure Stack Hub integrated system that contains a guest Azure AD tenant named fabrikam.com.

  You need to unregister fabrikam.com.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Connect to the Azure Resource Manager (ARM) endpoint Compare to the steps in the note below.

  Use https://adminmanagement..

  Azure Resource Manager (administrator)

  Adminmanagement..

  Azure Resource Manager (user)

  Management..

  Step 2: Run the register-AzSGuestDirectoryTenant cmdlet.

  Unregister a guest directory

  If you no longer want to allow sign-ins to Azure Stack Hub services from a guest directory tenant, you can unregister the directory. Again, both the home Azure Stack Hub directory and guest directory need to be configured.

  Configure guest directory Step 3: Instruct the global administrator of fabrikam.com to run the register- AzsWithMyDirectoryTenant cmdlet. Configure guest directory Note: Enabling AAD Multi-Tenancy in Azure Stack

  Allowing users and service principals from multiple AAD directory tenants to sign in and create resources on Azure Stack. There are two personas involved in implementing this scenario.

  1. The Administrator of the Azure Stack installation

  2. The Directory Tenant Administrator of the directory that needs to be onboarded to Azure Stack

  Step 1: Onboard the Guest Directory Tenant to Azure Stack This step will let Azure Resource manager know that it can accept users and service principals from the guest directory tenant.

  $adminARMEndpoint = "https://adminmanagement.." $azureStackDirectoryTenant = ".onmicrosoft.com" # this is the primary tenant Azure Stack is registered to

  $guestDirectoryTenantToBeOnboarded = ".onmicrosoft.com" # this is the new tenant that needs to be onboarded to Azure Stack $location = "local"

  Register-AzsGuestDirectoryTenant -AdminResourceManagerEndpoint $adminARMEndpoint `

  -DirectoryTenantName $azureStackDirectoryTenant ` -GuestDirectoryTenantName $guestDirectoryTenantToBeOnboarded ` -ResourceGroupName "system.local" `

  -Location $location

  With this step, the work of the Azure Stack administrator is done.

  Guest Directory Tenant Administrator

  Step 2: Registering Azure Stack applications with the Guest Directory Execute the following cmdlet as the administrator of the directory that needs to be onboarded, replacing $guestDirectoryTenantName with your directory domain name

  $tenantARMEndpoint = "https://management.." $guestDirectoryTenantName = ".onmicrosoft.com" # this is the new tenant that needs to be onboarded to Azure Stack

  Register-AzsWithMyDirectoryTenant -TenantResourceManagerEndpoint $tenantARMEndpoint ` -DirectoryTenantName $guestDirectoryTenantName

• Question 8:

  DRAG DROP

  You have two Azure subscriptions named sub1 and sub2. The subscriptions are linked to an Azure AD tenant named contoso.com.

  You deploy on Azure Stack Hub integrated system and register the system with sub1.

  You open a new PowerShell session and connect to sub1.

  You need to register the Azure Stack Hub integrated system with sub2.

  Which three PowerShell cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  

• Question 9:

  DRAG DROP

  You have an Azure Stack Hub integrated system.

  You install the Azure Gallery Packager (.azpkg) tool on a management workstation.

  You need to define a custom Azure Stack Hub Marketplace item that will provision a virtual machine from a base image.

  Which file should you configure for each requirement? To answer, drag the appropriate files to the correct requirements.

  Each file may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  Select and Place:

  

  Correct Answer:

  

• Question 10:

  DRAG DROP

  You have an Azure Stack Hub integrated system.

  You plan to enable Azure Command-Line Interface (CLI) for Azure Stack Hub users.

  You create an alias template file.

  You need to configure the virtual machine aliases endpoint. The solution must use the principle of least privilege.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Create a storage account A sample alias file with many common image aliases is available. You can use that as a starting point. Host this file in a space where your CLI clients can reach it. One way is to host the file in a blob storage account and share the URL with your users:

  1.

  Download the sample file from GitHub.

  2.

  Create a storage account in Azure Stack Hub (Step 1). When that's done, create a blob container. Set the access policy to "public." (Step 2)

  3.

  Upload the JSON file to the new container (Step 3). When that's done, you can view the URL of the blob. Select the blob name and then select the URL from the blob properties.

  Step 2: Create a blob container and set the Public access to Blob. Set up the VM aliases endpoint

  Azure Stack Hub operators should set up a publicly accessible endpoint that hosts a VM alias file. The VM alias file is a JSON file that provides a common name for an image. You use the name when you deploy a VM as an Azure CLI parameter.

  Note: When public access is allowed for a storage account, you can configure a container with the following permissions:

  *

  Public read access for blobs only: Blobs within the container can be read by anonymous request, but container data is not available anonymously. Anonymous clients cannot enumerate the blobs within the container.

  *

  Public read access for container and its blobs: Container and blob data can be read by anonymous request, except for container permission settings and container metadata. Clients can enumerate blobs within the container by anonymous request, but cannot enumerate containers within the storage account.

  *

  No public read access: The container and its blobs can be accessed only with an authorized request. This option is the default for all new containers. Step 3: To the container, upload the alias template as a JSON file.