Microsoft Microsoft Certifications AZ-600 Questions & Answers

• Question 121:

  You have an Azure Stack Hub integrated system that connects to the Internet. The integrated system uses an Enterprise Agreement (EA) for licensing. You are creating an Azure Resource Manager template to generate a marketplace item

  for a virtual machine that runs Windows Server 2019 Datacenter and a custom application.

  You need to ensure that Windows Server is licensed by using the bring-your-own-license model.

  Solution: You add licenseType: Windows_Server to the Azure Resource Manager template.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

• Question 122:

  You have an Azure Stack Hub integrated system that connects to the Internet.

  You need to enable multitenant billing.

  What should you do first?

  A. Generate a service principal to connect the Azure Billing API to Azure Commerce

  B. Run the New-AzResource cmdlet

  C. Create a blob storage account named AzSCommerceStaging that stores CSV usage metadata before you send the metadata to Azure Commerce

  D. Email the registration subscription ID, resource group name, and registration name to [email protected]

  Correct Answer: D

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-csp-howto-register- tenants?view=azs-2008andtabs=az

• Question 123:

  You have an Azure Stack Hub integrated system.

  A scale unit node has a hardware failure.

  You replace the physical server based on the field replacement unit (FRU) documentation of the OEM hardware vendor.

  You need to reintroduce the node to the scale unit.

  Which PowerShell cmdlet should you run?

  A. Enable-AzsScaleUnitNode

  B. Repair-AzsScaleUnitNode

  C. Start-AzsScaleUnitNode

  D. Restart-AzsInfrastructureRole

  E. Add-AzsScaleUnitNode

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-node-actions?view=azs

  2008andtabs=az1#repair

• Question 124:

  You plan to deploy an Azure Stack Hub integrated system that will connect to the internet.

  You are planning the network design. You plan the address space for the public VIP network and the private network.

  Which three additional networks are required for the Azure Stack Hub deployment? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a switch infrastructure network

  B. a DNS network

  C. a storage network

  D. a hypervisor network

  E. a BMC network

  F. an infrastructure network

  Correct Answer: AEF

  Reference: https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-network?view=azs-2008

• Question 125:

  You have an Azure Stack Hub integrated system that is disconnected from the internet. The integrated system has an Azure App Service resource provider.

  You generate a new certificate.

  You need to rotate the certificate of the App Service identity application to use the new certificate.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the administrator portal, get the value of the default provider subscription object ID.

  B. From a privileged endpoint (PEP) session, run the Export-Cercificace cmdlet. and then run the Import-Certificace cmdlet

  C. From a privileged endpoint (PEP) session, run the New-Object cmdlet. and then run the import-PfxCertificace cmdlet

  D. From a privileged endpoint (PEP) session, run the New-Objecc cmdlet, and then run the Sec-GraphApplicacion cmdlet

  E. From the administrator portal, get the value of the AzureStack-AppService object ID.

  Correct Answer: DE

  Your choice of either Azure AD or AD FS is determined by the mode in which you deploy Azure Stack Hub:

  When you deploy it in a connected mode, you can use either Azure AD or AD FS. When you deploy it in a disconnected mode, without a connection to the internet, only AD FS is supported.

  E:

  Rotate certificate for AD FS identity application The identity application is created by the operator before deployment of Azure App Service on Azure Stack Hub. If the application's object ID is unknown, follow these steps to discover it:

  Go to the Azure Stack Hub administrator portal.

  Go to Subscriptions and select Default Provider Subscription. Select Access Control (IAM) and select the AzureStack-AppService- application.

  Take a note of the Object ID, this value is the ID of the Service Principal that must be updated in AD FS.

  D: To rotate the certificate for the application in AD FS, you need to have access to the privileged endpoint (PEP). Then you update the certificate credential using PowerShell.

  # Sign in to PowerShell interactively, using credentials that have access to the VM running the Privileged Endpoint $Creds = Get-Credential

  # Create a new Certificate object from the identity application certificate exported as .cer file $Cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("")

  # Create a new PSSession to the PrivelegedEndpoint VM $Session = New-PSSession -ComputerName "" -ConfigurationName PrivilegedEndpoint -Credential $Creds -SessionOption (New-PSSessionOption -Culture en-US -UICulture en-US)

  # Use the privileged endpoint to update the certificate thumbprint, used by the service principal associated with the App Service identity application $SpObject = Invoke-Command -Session $Session -ScriptBlock {Set-GraphApplication -ApplicationIdentifier "" -ClientCertificates $using:Cert} $Session | Remove-PSSession

  # Output the updated service principal details $SpObject Reference:

  https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-identity-overview

  https://learn.microsoft.com/en-us/azure-stack/operator/app-service-rotate-certificates

• Question 126:

  You have a disconnected Azure Stack Hub integrated system that contains a user named User1.

  You need to ensure that User1 can assign role-based access control (RBAC) roles in Azure Stack Hub. The solution must use the principle of least privilege.

  Which Azure Stack Hub built-in role should you assign to User1?

  A. Owner

  B. User Access Administrator

  C. Security Admin

  D. Managed Identity Contributor

  Correct Answer: B

  User Access Administrator Lets you manage user access to Azure resources. */read Read resources of all types, except secrets. Microsoft.Authorization/* Manage authorization Microsoft.Support/* Create and update a support ticket

  Reference:

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 127:

  You have an Azure Stack Hub integrated system.

  The retention period for storage accounts is set to 10 days.

  In a user subscription, a user deletes a virtual machine that has four 500-GB unmanaged disks attached.

  How will the storage be reclaimed?

  A. The deleted storage can be reclaimed immediately by using the administrator portal.

  B. The deleted storage can be reclaimed immediately by using the user portal.

  C. The deleted storage can be reclaimed only after 10 days.

  D. The deleted storage will be reclaimed automatically in 10 hours.

  Correct Answer: A

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-manage-storage- accounts?view=azs-2008

• Question 128:

  You have an Azure Stack Hub integrated system that connects to the Internet.

  You need to update the Azure Event Hubs service.

  Solution: From the Updates blade of the administrator portal, you select the latest update in the infrastructure section.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/resource-provider-apply- updates?view=azs-2008

• Question 129:

  You are troubleshooting an Azure Stack Hub integrated system.

  A Microsoft Support Engineer needs to review automatically uploaded logs. What should you provide to the Microsoft Support Engineer?

  A. the Azure AD tenant ID

  B. the metering subscription ID

  C. the Microsoft Partner Network (MPN) number

  D. the Azure Stack Hub Cloud ID

  E. the default service provider subscription ID

  Correct Answer: D

  The Cloud ID is the unique ID for tracking support data uploaded from a specific scale unit. When diagnostic logs are uploaded for support analysis, the Cloud ID is how the logs are associated with that scale unit. Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-find-cloud- id?

• Question 130:

  You have an Azure Stack Hub integrated system that uses an Azure Active Directory (Azure AD) identity provider.

  You have a computer that runs Windows 10. You use the computer to manage the integrated system.

  You create a custom marketplace item on the computer.

  You need to publish the item to Azure Stack Hub Marketplace.

  You create a storage account.

  What should you create next?

  A. a container that has a public access level of private

  B. a file share that has the performance tier set to Hot

  C. a container that has a public access level of blob

  D. a file share that has the performance tier set to Transaction optimized

  Correct Answer: C

  Reference:

  https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-create-and-publish- marketplace-item?view=azs-2008andtabs=az#publish-a-marketplace-item