Microsoft Microsoft Certifications AZ-600 Questions & Answers

• Question 51:

  DRAG DROP

  You have an Azure Stack Hub integrated system that is enabled for multi-tenancy and contains a user subscription. The subscription contains a user named User1.

  The integrated system has the following configurations:

  Region name: region1

  Fully qualified domain name (FQDN): contoso.com

  You need to identify which gallery endpoint URI User1 must use.

  How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or net at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: portal.

  A DNS entry is created for each endpoint in the external DNS zone that's specified at deployment time. For example, the user portal is assigned the DNS host entry of portal...

  * Portal (user) Portal..

  Box 2: region1.

  Note: Once your item has been successfully published to the marketplace, you can delete the content from the storage account.

  All default gallery artifacts and your custom gallery artifacts are now accessible without authentication under the following URLs: https://galleryartifacts.adminhosting.[Region].[externalFQDN]/artifact/20161101/[TemplateN ame]/DeploymentTemplates/Template.json https://galleryartifacts.hosting.[Region].[externalFQDN]/artifact/20161101/[TemplateName]/ DeploymentTemplates/Template.json

• Question 52:

  

  DRAG DROP

  You plan to deploy a disconnected Azure Stack Hub integrated system that has the following configurations:

  FQDN: contoso.local

  Region name: region1

  Internal domain name: contoso.com

  You need to generate a certificate signing request (CSR) for the new deployment. The solution must prevent the common name (CN) value from being included in the certificate subject.

  How should you complete the script? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

• Question 53:

  DRAG DROP

  You have a corrected Azure Stack Hub integrated system.

  You need to query the health status of the Key Vault resource provider by using PowerShell

  Which three actions should you perform in sequence? To answer move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

• Question 54:

  DRAG DROP

  You have an Azure Stack Hub integrated system that contains a user named User1.

  You have a JSON file that contains the definition of the Reader role.

  You need to create a custom role to enable User1 to manage updates for the integrated system.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  

  Step 1: Modify the permissions section of the JSON file

  Step 2: Modify the assignableScopes section of the JSON file. Replace with your Azure subscription ID.

  Sample JSON file:

  {

  "Name": "Azure Stack Hub registration role",

  "Id": null,

  "IsCustom": true,

  "Description": "Allows access to register Azure Stack Hub", "Actions": [

  "Microsoft.Resources/subscriptions/resourceGroups/write", "Microsoft.Resources/subscriptions/resourceGroups/read", "Microsoft.AzureStack/registrations/*",

  "Microsoft.AzureStack/register/action",

  "Microsoft.Authorization/roleAssignments/read",

  "Microsoft.Authorization/roleAssignments/write", "Microsoft.Authorization/roleAssignments/delete", "Microsoft.Authorization/permissions/read",

  "Microsoft.Authorization/locks/read",

  "Microsoft.Authorization/locks/write"

  ],

  "NotActions": [

  ],

  "AssignableScopes": [

  "/subscriptions/"

  ]

  }

  Step 3: Connect to the administrator Azure Resource Manager (ARM) endpoint. In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or

  User Access Administrator.

  Connect-AzAccount

  Step 4: Run the New-AzRoleDefinition cmdlet.

  To create the custom role, use New-AzRoleDefinition specifying the JSON template file.

  New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json

• Question 55:

  You need to support the planned changes for User1. Which service should you include?

  A. Microsoft.Subscriptions

  B. Microsoft.KeyVault

  C. Microsoft.Storage

  D. Microsoft.Compute

  Correct Answer: A

  Assign the delegated provider role to User1.

  Delegation steps

  There are two steps to setting up delegation:

  1.

  Create a delegated provider subscription: Subscribe a user to an offer containing only the subscription service. Users who subscribe to this offer can then extend the delegated offers to other users by signing them up for those offers.

  2.

  Delegate an offer to the delegated provider: This offer enables the delegated provider to create subscriptions or to extend the offer to their users. The delegated provider can now take the offer and extend it to other users.

  Note:

  Move subscriptions between delegated providers

  If needed, a subscription can be moved between new or existing delegated provider subscriptions that belong to the same directory tenant. You can move them using the PowerShell cmdlet Move-AzsSubscription.

  Moving subscriptions is useful when:

  *

  You onboard a new team member that will take on the delegated provider role and you want to assign to this team member user subscriptions that were previously created in the default provider subscription.

  *

  You have multiple delegated providers subscriptions in the same directory tenant (Azure AD) and need to move user subscriptions between them. This scenario could occur when a team member moves between teams and their

  subscription must be allocated to the new team.

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-delegated-provider

• Question 56:

  You need to configure the log forwarding. The solution must meet the Azure Stack Hub requirements. What should you do?

  A. Connect to 192.168.101.101 and run the Set-EventLogLevel and Add-AzLogProfile cmdlets.

  B. Connect to 192.168.100.224 and run the Set-SyslogServer and Set-SyslogClient cmdlets.

  C. Connect to 192.168.100.224 and run the Set-EventLogLevel and Add-AzLogProfile cmdlets.

  D. Connect to 192.168.101.101 and run the Set-SyslogServer and Set-SyslogClient cmdlets.

  Correct Answer: D

  Integrate Azure Stack Hub with monitoring solutions using syslog forwarding The syslog channel exposes audits, alerts, and security logs from all the components of the Azure Stack Hub infrastructure. Use syslog forwarding to integrate with security monitoring solutions and to retrieve all audits, alerts, and security logs to store them for retention. Cmdlets to configure syslog forwarding Configuring syslog forwarding requires access to the privileged endpoint (PEP). Two PowerShell cmdlets have been added to the PEP to configure the syslog forwarding: ### cmdlet to pass the syslog server information to the client and to configure the transport protocol, the encryption and the authentication between the client and the server Set-SyslogServer [-ServerName ] [-ServerPort ] [-NoEncryption] [-SkipCertificateCheck] [-SkipCNCheck] [-UseUDP] [-Remove]### cmdlet to configure the certificate for the syslog client to authenticate with the server Set-SyslogClient [-pfxBinary ] [-CertPassword ]

  Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-integrate-security

• Question 57:

  You need to implement the management app. The solution must meet the technical requirements. What should you use?

  A. a PowerShell session to litwareinc.com

  B. a browser session to litwareinc.com

  C. a PowerShell remoting session to the PEP

  D. a browser session to the administrator portal

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-manage-portals?view=azs-2008

• Question 58:

  You need to identify the PEP information for the integrated system in Chicago. The solution must meet the technical requirements. What should you use?

  A. the HLH configuration file

  B. the Get-AzsRegistrationToken cmdlet

  C. Properties on the Region management blade of the administrator portal

  D. the Help + support blade of the administrator portal

  Correct Answer: C

  Reference: https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-privileged-endpoint?view=azs-2008

• Question 59:

  You need to implement disaster recovery for the priv1 region to meet the technical requirements. Which main components should you include in the disaster recovery plan?

  

  A. Option A

  B. Option B

  C. Option C

  D. Option D

  Correct Answer: B

• Question 60:

  As part of the planned changes for the int1 region, you need to remove all the user subscriptions and the associated resources. The solution must meet the technical requirements.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Run the Set-AzsuserSubscription cmdlet against to the administrator management endpoint.

  B. From the Azure portal, remove all the guest user accounts.

  C. From the administrator portal, delete all the user subscriptions.

  D. From the user portal delete all the resources in the user subscriptions.

  Correct Answer: BC