AZ-600 Sample Questions Answers

Step 1: Notify all the users in the int1 region and schedule a maintenance window.

Step 2: Select the subscription that was used to perform the initial registration.

Note: You need to change the int1 region to use the capacity model.

Change the billing model and registration name of the int1 region.

The int1 region runs a high number of Windows virtual machines that use pay-as-you-use images.

Change billing model, how features are offered, or re-register your instance

This section applies if you want to change the billing model, how features are offered, or you want to re-register your instance. For all of these cases, you call the registration function to set the new values. You don't need to first remove the current registration.

# select the subscription used during the registration

Select-AzSubscription -Subscription ''

# rerun registration with new BillingModel (or same billing model in case of re-registration) but using other parameters values from portal

Set-AzsRegistration -PrivilegedEndpointCredential $YourCloudAdminCredential -PrivilegedEndpoint $YourPrivilegedEndpoint -BillingModel '' -RegistrationName '' -ResourceGroupName ''

Step 3: Run the Set-AzsRegistration cmdlet.

You can use Set-AzsRegistration to register Azure Stack Hub with Azure and enable or disable the offer of items in the marketplace and usage reporting.

To run the cmdlet, you need:

A global Azure subscription of any type.

To be signed in to Azure PowerShell with an account that's an owner or contributor to that subscription.

Graphical user interface, text, application, chat or text message Description automatically generated

Box 1: The Default Provider Subscription

A default Microsoft SQL Server instance will host the database of the App Service resource provider.

In Azure Stack Hub Subscriptions, select the Default Provider Subscription. Azure App Service on Azure Stack Hub must be deployed in the Default Provider Subscription.

Box 2:

Enter the SQL Server details for the server instance used to host the App Service resource provider database and then select Next. The installer validates the SQL connection properties.

Graphical user interface, website Description automatically generated

User account policy

The following user account policy is applied to the OAW VM:

Built-in Administrator username: AdminUser

MinimumPasswordLength = 14

PasswordComplexity is enabled

MinimumPasswordAge = 1 (day)

MaximumPasswordAge = 42 (days)

NewGuestName = GUser (disabled by default)

Table Description automatically generated

Box 1: 30 days

We cannot tell for sure without the exhibit. It would likely be either 30 or 90 days.

The Azure Stack Hub root certificate is provisioned during deployment with an expiration of five years. Starting with 2108, internal secret rotation also rotates the root certificate. The standard secret expiration alert identifies the expiry of the root certificate and generates alerts at both 90 (warning) and 30 (critical) days.

Note: Manual remediation

If the Repair option is not supported, be sure to follow the complete set of remediation instructions provided in the alert. As an example, the internal certificate expiration remediation steps will guide you through the process of secret rotation:

Graphical user interface, text, application Description automatically generated

Box 2: running the Start-SecreatRotation –Internal PowerShell cmdlet from the priveged endpoint (PEP) session

Start-SecretRotation cmdlet rotates the infrastructure secrets of an Azure Stack Hub system. This cmdlet can only be executed against the Azure Stack Hub privileged endpoint, by using an Invoke-Command script block passing the PEP session in the -Session parameter. By default, it rotates only the certificates of all external network infrastructure endpoints.

For multinode systems, the user portal URL is formatted as https://portal. .. For an ASDK deployment, the URL is https://portal.local.azurestack.external.

In our case we must also direct any foreign principals (users in the Adatum directory without the suffix of adatum.onmicrosoft.com) to sign in using https:// /adatum.onmicrosoft.com. If they don't specify the /adatum.onmicrosoft.com directory tenant in the URL, they're sent to their default directory and receive an error that says their administrator hasn't consented.

Box 1: 4

The infrastructure of the integrated system must be backed up as frequently as possible.

Enable backup for Azure Stack Hub from the administrator portal

The frequency in hours determines how often backups are created. The default value is 12. Scheduler supports a maximum of 12 and a minimum of 4.

Box 2: Azure key vault

The integrated system backups must be retained for 28 days.

Online retention policy. This specifies the time period during which daily, weekly, monthly, and yearly backups are retained in the Azure Site Recovery vault that's associated with the local MABS instance.

Graphical user interface, text, application Description automatically generated

Step 1: Run Get-AzsRegistrationToken

Change the Azure Stack Hub integrated system registration to use an Azure subscription named Subscription3 that has a GUID of 12345678-1234-1234-1234-222222222222.

Get-AzsRegistrationToken

Get-AzsRegistrationToken generates a registration token from the input parameters.

To register the Azure Stack Hub resource provider with Azure, start PowerShell ISE as an administrator and use PowerShell cmdlets with the EnvironmentName parameter set to the appropriate Azure subscription type.

Step 2: Run the Register-AszEnvironment cmdlet and specify the –RegistrationToken $Token parameter.

Step 3: Run the Select-AzSubscription cmdlet and specify the –Subscription 12345678-1234-1234-1234-222222222222 parameter.

To change the azure subscription using PowerShell, we can use the Select-AZSubscription command. When you use this command, you can use either the subscription ID, Subscription Name, or the Tenant ID.

Step 4: Run Set-AszRegistration.

Before proceeding, in the same PowerShell session, verify again that you're signed in to the correct Azure PowerShell context.

This context is the Azure account that was used to register the Azure Stack Hub resource provider. In the same PowerShell session, run the Set-AzsRegistration cmdlet:

$CloudAdminCred = Get-Credential -UserName -Message "Enter the cloud domain credentials to access the privileged endpoint."

$RegistrationName = ""

Set-AzsRegistration `

-PrivilegedEndpointCredential $CloudAdminCred `

-PrivilegedEndpoint `

-AgreementNumber `

-BillingModel Capacity `

-RegistrationName $RegistrationName

Box 1: Subject Alternative Name

Implement the App Service resource provider and the Event Hubs resource provider on the integrated system/

Only the Subject Alternative Name is used.

Box 2: DNS Name = =*.eventhub.east.azurestack.treyresearch.net

Event Hubs prerequisites

Procure public key infrastructure (PKI) SSL certificates for Event Hubs. The Subject Alternative Name (SAN) must adhere to the following naming pattern: CN=*.eventhub... Subject Name may be specified, but it's not used by Event Hubs when handling certificates. Only the Subject Alternative Name is used. See PKI certificate requirements for the full list of detailed requirements.

Configure the integrated system to resolve external names by using a DNS Server that has an IP address of 10.100.100.100.

Resolving external DNS names from Azure Stack Hub

To resolve DNS names for endpoints outside Azure Stack Hub (for example: www.bing.com), you need to provide DNS servers that Azure Stack Hub can use to forward DNS requests for which Azure Stack Hub isn 't authoritative. For deployment, DNS servers that Azure Stack Hub forwards requests to are required in the Deployment Worksheet (in the DNS Forwarder field). Provide at least two servers in this field for fault tolerance. Without these values, Azure Stack Hub deployment fails. You can edit the DNS Forwarder values with the Set-AzSDnsForwarder cmdlet after deployment.

Configure conditional DNS forwarding

Important

This only applies to an AD FS deployment.

To enable name resolution with your existing DNS infrastructure, configure conditional forwarding.

To add a conditional forwarder, you must use the privileged endpoint.

For this procedure, use a computer in your datacenter network that can communicate with the privileged endpoint in Azure Stack Hub.

1. Open an elevated Windows PowerShell session (run as administrator), and connect to the IP address of the privileged endpoint. Use the credentials for CloudAdmin authentication.

$cred=Get-Credential

Enter-PSSession -ComputerName -ConfigurationName PrivilegedEndpoint -Credential $cred

2. After you connect to the privileged endpoint, run the following PowerShell command. Substitute the sample values provided with your domain name and IP addresses of the DNS servers you want to use.

Register-CustomDnsServer -CustomDomainName "contoso.com" -Custom

Step 1: Create a config.file and save the file as Sloud-init.txt file.

Publish a custom cloud-init built image of a Linux virtual machine to Azure Stack Hub Marketplace on the integrated system.

Add Linux images to the Azure Stack Hub Marketplace

1: Create a cloud-init.txt file with your cloud-config

Step 2: Upload the file to Azure Stack Hub storage account.

2: Reference cloud-init.txt during the Linux VM deployment

Upload the file to an Azure storage account, Azure Stack Hub storage account, or GitHub repository reachable by your Azure Stack Hub Linux VM.

Step 3: Provision on Azure Stack Hub virtual machine by using Az PowerShell moduel.

You can create an Ubuntu Server 16.04 LTS virtual machine (VM) by using Azure Stack Hub PowerShell.

Make sure to reference the cloud-init.txt as a part of the -CustomData flag:

$VirtualMachine =Set-AzVMOperatingSystem -VM $VirtualMachine `

-Linux `

-ComputerName "MainComputer" `

-Credential $cred -CustomData "#include https://cloudinitstrg.blob.core.windows.net/strg/cloud-init.txt "

Assign the delegated provider role to User1.

Delegation steps

There are two steps to setting up delegation:

1. Create a delegated provider subscription: Subscribe a user to an offer containing only the subscription service. Users who subscribe to this offer can then extend the delegated offers to other users by signing them up for those offers.

2. Delegate an offer to the delegated provider: This offer enables the delegated provider to create subscriptions or to extend the offer to their users. The delegated provider can now take the offer and extend it to other users.

Note:

Move subscriptions between delegated providers

If needed, a subscription can be moved between new or existing delegated provider subscriptions that belong to the same directory tenant. You can move them using the PowerShell cmdlet Move-AzsSubscription.

Moving subscriptions is useful when:

* You onboard a new team member that will take on the delegated provider role and you want to assign to this team member user subscriptions that were previously created in the default provider subscription.

* You have multiple delegated providers subscriptions in the same directory tenant (Azure AD) and need to move user subscriptions between them. This scenario could occur when a team member moves between teams and their subscription must be allocated to the new team.