Microsoft Microsoft Certifications AZ-600 Questions & Answers

• Question 101:

  You back up VM1 .

  You restore VM1 to the integrated system.

  You need to ensure that VM1 will start successfully and that users can connect to share!

  Which two actions should you perform after restoring VM1 from the backup? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Modify the disk layout.

  B. Set the hostname.

  C. Set the password of the local administrator.

  D. Set the IP address.

  E. Validate the MAC address.

  Correct Answer: BD

• Question 102:

  You have a connected Azure Stack Hub integrated system that contains a user named User1.

  You need to ensure that User1 can onboard a new guest tenant directory. The solution must use the principle of least privilege.

  Which role should you assign to User1?

  A. Owner

  B. Global administrator

  C. Hybrid identity administrator

  D. Domain name administrator

  Correct Answer: C

  Hybrid Identity Administrator role is now available with Cloud Provisioning Type: New feature Service category: Azure AD Cloud Provisioning Product capability: Identity Lifecycle Management

  IT Admins can start using the new "Hybrid Admin" role as the least privileged role for setting up Azure AD Connect Cloud Provisioning. With this new role, you no longer have to use the Global Admin role to set up and configure Cloud Provisioning.

  Note: Hybrid Identity Administrator Users in this role can create, manage and deploy provisioning configuration setup from AD to Azure AD using Cloud Provisioning as well as manage Azure AD Connect, Pass-through Authentication (PTA), Password hash synchronization (PHS), Seamless Single Sign-On (Seamless SSO), and federation settings. Users can also troubleshoot and monitor logs using this role.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/whats- new-archive

  https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions- reference#hybrid-identity-administrator

• Question 103:

  You have an Azure Stack Hub integrated system that has the following configurations:

  A deployment prefix of AzS A physical prefix of AzP You need to renew the certificates for the integrated system.

  To which virtual machine should you establish a PowerShell session?

  A. AzS-ERCS02

  B. AzS-CA01

  C. AzS-WAS01

  D. AzP-S1-N01

  Correct Answer: B

  Explanation: https://docs.microsoft.com/en-gb/learn/modules/manage-azure-stack-hub- use-privileged-endpoints/2-connect-privileged-endpoint

• Question 104:

  You plan to install an update to an Azure Stack Hub integrated system. You need to verify whether the integrated system is healthy, and whether you can apply the update. You must achieve the goal as quickly as possible.

  Solution: From the administrator management endpoint, you run

  Test-AzureStack-Group "UpdateReadiness".

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-diagnostic- test?view=azs-2008

• Question 105:

  You have an Azure Stack Hub integrated system.

  You need to give a new operator access to the privileged endpoint (PEP) as soon as possible.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Run the New-CloudAdminUser cmdlet.

  B. Run the New-AzureADUser cmdlet.

  C. Connect to the PEP.

  D. Connect to and unlock the PEP.

  E. Connect to the administrator management endpoint.

  Correct Answer: AC

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-privileged- endpoint?view=azs-2008

• Question 106:

  You have an Azure Slack Hub integrated system and a computer named Computer1 that runs Windows 11. You need to deploy the Azure Stack Hub PowerShell tools to Computer1. What should you do first?

  A. Connect to the privileged endpoint (PEP).

  B. Copy the AzureStack module from the Hardware Lifecycle Host (HLH).

  C. Download AzureStack-Tools from the GitHub repository.

  D. Download the AzureStack module from PowerShell Gallery.

  Correct Answer: C

  Download Azure Stack Hub tools from GitHub AzureStack-Tools is a GitHub repository that hosts PowerShell modules for managing and deploying resources to Azure Stack Hub. If you're planning to establish VPN connectivity, you can download these PowerShell modules to the Azure Stack Development Kit (ASDK), or to a Windows-based external client.

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-powershell- download

• Question 107:

  You have an Azure Stack Hub integrated system that uses the latest version.

  You discover an alert for an external certificate that will expire. You obtain new certificates.

  You need to validate that all the components required to change the certificates are in a healthy state, and then renew the certificates.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Run the Start-SecretRotation and specify the PfxFilePath parameter.

  B. Run Start-SecretRotation cmdlet and specify the Internal parameter.

  C. Copy the certificates to Azure Blob storage.

  D. Run the Test-AzureStack cmdlet and specify the -Group UpdateReadiness parameter.

  Correct Answer: BD

• Question 108:

  You are planning an Azure Slack Hub deployment for an enterprise customer.

  You need to identify an appropriate identity model for the customer. The solution must use capacity-based billing. Which two identity providers can you use for the customer? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Active Directory Federation Services (AD FS) in an Enterprise Agreement (EA)

  B. Azure Active Directory (Azure AD) in a Cloud Solution Provider (CSP) subscription

  C. Azure Active Directory (Azure AD) in an Enterprise Agreement (EA)

  D. Active Directory Federation Services (AD FS) in a Cloud Solution Provider (CSP) subscription

  Correct Answer: BD

  Choose an identity store

  With a connected deployment, you can choose between Azure AD or AD FS for your identity store. A disconnected deployment, with no internet connectivity, can only use AD FS.

  Capacity-based billing

  If you decide to use the capacity billing model, you must purchase an Azure Stack Hub Capacity Plan SKU based on the capacity of your system. You need to know the number of physical cores in your Azure Stack Hub to purchase the

  correct quantity.

  Capacity billing requires an Enterprise Agreement (EA) Azure subscription for registration. The reason is that registration sets up the availability of items in the Marketplace, which requires an Azure subscription. The subscription isn't used for

  Azure Stack Hub usage.

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-connected- deployment

• Question 109:

  You have an Azure Stack Hub integrated system that connects to the Internet. The integrated system uses an Enterprise Agreement (EA) for licensing. You are creating an Azure Resource Manager template to generate a marketplace item

  for a virtual machine that runs Windows Server 2019 Datacenter and a custom application.

  You need to ensure that Windows Server is licensed by using the bring-your-own-license model.

  Solution: You remove the licenseType section from the Azure Resource Manager template.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 110:

  You have 20 computers that run Linux.

  You deploy a disconnected Azure Stack Hub integrated system.

  You need to ensure that users on the Linux computers can manage their Azure Stack Hub resources by using Azure Command-Line Interface (CLI).

  What should you do first?

  A. Request a new certificate for the integrated system.

  B. For each Linux computer, request a certificate from the integrated system.

  C. Export the root certificate of the integrated system as a P7B file.

  D. Export the root certificate of the integrated system as a CER file.

  Correct Answer: D

  Add certificate

  Export and then import Azure Stack Hub certificate for disconnected integrated systems and for the ASDK.

  You need the CA root certificate for Azure Stack Hub to use Azure CLI on your development machine.

  Export the Azure Stack Hub CA root certificate

  Export the CA root certificate. To export the ASDK root certificate in PEM format:

  Get the name of your Azure Stack Hub Root Cert:

  1.

  Sign in to the Azure Stack Hub User or Azure Stack Hub Administrator portal.

  Select the lock in the browser address bar.

  In the pop-up window, select Connection is secure. In the Certificate window, select the Certification Path tab. Note down the name of your Azure Stack Hub Root Cert, for example, *..

  2.

  Sign in to the VM, open an elevated PowerShell prompt, and then run the following script:

  $label = "*.. from step 1"

  Write-Host "Getting certificate from the current user trusted store with subject CN=$label" $root = Get-ChildItem Cert:\CurrentUser\Root | Where-Object Subject -eq "CN=$label" | select -First 1 if (-not $root)

  {

  Write-Error "Certificate with subject CN=$label not found" return

  }

  Write-Host "Exporting certificate"

  Export-Certificate -Type CERT -FilePath root.cer -Cert $root

  Write-Host "Converting certificate to PEM format" certutil -encode root.cer root.pem

  Reference:

  https://learn.microsoft.com/en-us/azure-stack/asdk/asdk-cli

  https://learn.microsoft.com/en-us/azure-stack/user/azure-stack-version-profiles-azurecli2