Microsoft Microsoft Certifications AZ-600 Questions & Answers

• Question 111:

  You have a disconnected Azure Stack Hub integrated system.

  You plan to implement an app named App1.

  You need to create a new service principal for App1. The solution must maximize security.

  What should you do first?

  A. Create an app registration in Azure AD.

  B. Create a group managed service account (gMSA)

  C. Generate an Azure Key Vault secret.

  D. Generate an X.509 certificate.

  Correct Answer: D

  You start by creating a new app registration in your directory, which creates an associated service principal object to represent the app's identity within the directory.

  Your choice of either Azure AD or AD FS is determined by the mode in which you deploy Azure Stack Hub:

  When you deploy it in a connected mode, you can use either Azure AD or AD FS. When you deploy it in a disconnected mode, without a connection to the internet, only AD FS is supported.

  Manage an AD FS app

  If you deployed Azure Stack Hub with AD FS as your identity management service, you must use PowerShell to manage your app's identity. The following examples demonstrate both an X509 certificate and a client secret credential.

  Once you have a certificate, use a PowerShell script to register your app and sign in using the app's identity.

  Reference:

  https://learn.microsoft.com/en-us/azure-stack/operator/give-app-access-to-resources

• Question 112:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy a disconnected Azure Stack Hub integrated system.

  You need to identify the IP address of the privileged endpoint (PEP).

  Solution: You run the nslookup AzS-ERCS01.azurestack.local command.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  nslookup is a network administration command-line tool for querying the Domain Name System to obtain the mapping between domain name and IP address, or other DNS records.

  ASDK architecture, Virtual machine roles

  The ASDK offers services using the following VMs hosted on the development kit host computer:

  * AzS-ERCS01 - Emergency Recovery Console VM.

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/asdk/asdk-architecture?view=azs-2008

• Question 113:

  You have an Azure Stack Hub integrated system.

  You need to create a new offer that can be used only by an operator to provision user subscriptions. The solution must simplify the process for users to create resources.

  Which type of offer should you create?

  A. public with a base plan only

  B. delegated with a base plan only

  C. private with a base plan only

  D. decommissioned

  Correct Answer: B

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-delegated- provider?view=azs-2008

• Question 114:

  You plan to install an update to an Azure Stack Hub integrated system.

  You need to verify whether the integrated system is healthy, and whether you can apply the update. You must achieve the goal as quickly as possible.

  Solution: From a privileged endpoint (PEP) session, you run TesT-AzureStack -Group "Default".

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 115:

  You plan to deploy an Azure Stack Hub integrated system that will be disconnected from the internet. The integrated system region name is region1, and the external domain is name is contoso.local. You need to ensure that the generated certificate signing request (CSR) has the correct subjects and subject alternative names (SAN).

  Which name must you include in the CSR?

  A. graph.region1.contoso.local

  B. graph.local.azurestack.external

  C. *.hosting.region1.azurestack.local

  D. *.adminhosting.region 1.azurestack.local

  Correct Answer: D

  You can deploy and use Azure Stack Hub without a connection to the internet. However, with a disconnected deployment, you're limited to an Active Directory Federation Services (AD FS) identity store and the capacity-based billing model. Because multitenancy requires the use of Azure Active Directory (Azure AD), multitenancy isn't supported for disconnected deployments.

  The implementation of Extension Host requires two wild card SSL certificates, one for the Admin portal and one for the Tenant portal.

  Note: Certificate requirements

  The extension host implements two new domain namespaces to guarantee unique host entries for each portal extension. The new domain namespaces require two additional wildcard certificates to ensure secure communication.

  The table shows the new namespaces and the associated certificates:

  

  Table

  Example:

  $regionName = 'east' # The region name for your Azure Stack Hub deployment $externalFQDN = 'azurestack.contoso.com' # The external FQDN for your Azure Stack Hub deployment

  Starting Certificate Request Process for Deployment CSR generating for following SAN(s):

  *.adminhosting.east.azurestack.contoso.com,*.adminvault.east.azurestack.contoso.com,*.b lob.east.azurestack.contoso.com,*.hosting.east.azurestack.contoso.com,*.queue.east.azur

  estack.contoso.com,*.table.east.azurestack.contoso.com,*.vault.east.azurestack.contoso.c om,adminmanagement.east.azurestack.contoso.com,adminportal.east.azurestack.contoso.

  com,management.east.azurestack.contoso.com,portal.east.azurestack.contoso.com Present this CSR to your Certificate Authority for Certificate Generation:

  C:\Users\username\Documents\AzureStackCSR\Deployment_east_azurestack_contoso_c om_SingleCSR_CertRequest_20200710165538.req

  Certreq.exe output: CertReq: Request Created

  Reference:

  https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-disconnected- deployment

  https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-extension-host-prepare

  https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-get-pki-certs

• Question 116:

  You have an Azure Stack Hub integrated system that is enabled for multi-tenancy.

  You receive an alert that one or more guest Azure Active Directory (Azure AD) tenants requires updates to support new features.

  You need to identify which Azure AD tenants you must update.

  Which two options can you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. the App registrations blade of the public Azure portal

  B. the Get-AzureADTenancDecail cmdlet

  C. the User subscriptions blade of the administrator portal in Azure Stack Hub

  D. the Gec-AzsDireccoryTenancidentif ier cmdlet

  E. the Directories blade of the administrator portal in Azure Stack Hub

  F. the Gec-AzsHealchReporc cmdlet

  G. the Gec-AzsAlercs cmdlet

  Correct Answer: EF

  E: You can determine whether an update is required for home or guest directories by viewing the directories pane in the admin portal. Each directory listing shows the type of directory. The type can be a home or guest directory, and its status is shown.

  F: .Synopsis Gets the health report of identity application in the Azure Stack home and guest directories DESCRIPTION Gets the health report for Azure Stack identity applications in the home directory as well as guest directories of Azure Stack. Any directories with an unhealthy status need to have their permissions updated. EXAMPLE $adminResourceManagerEndpoint = "https://adminmanagement.local.azurestack.external" $homeDirectoryTenantName = ".onmicrosoft.com" Get-AzsHealthReport -AdminResourceManagerEndpoint $adminResourceManagerEndpoint ` -DirectoryTenantName $homeDirectoryTenantName -Verbose

  Examples.

  Example 1: Get details for a tenant

  PS C:\>Get-AzureADTenantDetail

  ObjectId DisplayName VerifiedDomains

  85b5ff1e-0402-400c-9e3c-0f9e965325d1 Coho Vineyard and Winery {class VerifiedDomain {..

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/enable-multitenancy

  https://github.com/Azure/AzureStack-Tools/blob/master/Identity/AzureStack.Identity.psm1

• Question 117:

  You have an Azure Stack Hub integrated system that uses an Active Directory Federation Services (AD FS) identity provider and capacity-based billing.

  You have a plan named Plan1 that has the following quota configurations for Microsoft.Compute:

  Maximum number of Availability Sets: 10

  Maximum number of virtual machines: 50 Maximum number of virtual machine cores: 100 Maximum number of virtual machine scale sets: 10 You link two offers named Offer1 and Offer2 to Plan1.

  Two user subscriptions named Customer1 and Customer2 are created based on Offer1. A user subscription named Customer3 is created based on Offer2.

  Customer1 receives a warning that it provisioned 50 virtual machines.

  You need to ensure that Customer1 can provision an additional 25 virtual machines within its existing subscription. The solution must NOT affect the quotas of the other user subscriptions.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add NewPlan as an add-on to Offer1

  B. Create a new plan named NewPlan that has the maximum number of virtual machines quota set to 75

  C. Add NewPlan to the Customer1 user subscription

  D. Create a new plan named NewPlan that has the maximum number of virtual machines quota set to 25

  E. Update the quota for Microsoft.Compute in Plan1 to have the maximum number of virtual machines set to 75

  F. Create a new offer named Offer3 based on Plan1 and create a new user subscription for Customer1 by using Offer3

  Correct Answer: AD

  Reference: https://docs.microsoft.com/en-us/azure-stack/operator/service-plan-offer-subscription- overview?view=azs-2008 https://docs.microsoft.com/en-us/azure-stack/operator/create-add-on-plan?view=azs-2008

• Question 118:

  You have an Azure Slack Hub integrated system that uses the latest version.

  You discover an alert for an external certificate that will expire. You obtain new certificates.

  You need to validate that all the components required to change the certificates are in a healthy state, and then renew the certificates.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Run the Start -Sec ret Rot at Ion and specify the PfxFilePath parameter.

  B. Copy the certificates to Azure Blob storage.

  C. Copy the certificates to an SMB file share that is accessible from the privilege endpoint (PEP).

  D. Run the Test-AzureStack cmdlet and Specify the -Group UpdateReadiness parameter.

  E. Run the Test-AzureStaek cmdlet and Specify the -Group SecretRotationReadiness parameter.

  F. Run Start-SecretRotation cmdlet and Specify the Internal parameter.

  Correct Answer: CEF

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-rotate- secrets

• Question 119:

  In which three situations should you update the registration of an Azure Stack Hub integrated system? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. when you add or remove nodes for capacity-based billing

  B. when you change the billing model

  C. when you add or remove nodes for consumption-based billing

  D. when you renew an annual capacity subscription

  E. when you enable Azure Stack Hub for multitenancy

  F. when you update the Azure Active Directory (Azure AD) home directory

  Correct Answer: ABD

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-registration?view=azs- 2008andtabs=az1%2Caz2%2Caz3%2Caz4andpivots=state-connected#renew-or-change- registration

• Question 120:

  You have an Azure Stack Hub integrated system that was recently moved to a new datacenter and powered on.

  You need to verify whether the infrastructure components are fully operational.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Run the Start-AzureStack cmdlet

  B. Run the Test-AzureStack cmdlet

  C. Connect to the privileged endpoint (PEP)

  D. Connect to the administrator portal

  E. Run the Get-AzureStackStampInformation cmdlet

  Correct Answer: ABC

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-diagnostic- test?view=azs-2008