You have an Azure Stack Hub integrated system and an offer to which users can subscribe.

You need to prevent users and operators from creating new user subscriptions based on the offer without affecting the existing user subscriptions.

What should you do?

Reveal Solution Hide Solution

You have an Azure Slack Hub integrated system.

You receive the following alert: "One or more guest Azure AD tenants must be configured."

You need to identify which Azure AD tenants require configuration.

Which PowerShell cmdlet should you run?

Reveal Solution Hide Solution

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You plan to install an update to an Azure Stack Hub integrated system.

You need to verify whether the integrated system is healthy, and whether you can apply the update. You must achieve the goal as quickly as possible.

Solution: From a privileged endpoint (PEP) session, you run

Test-AzureStack CGroup "Default".

Does this meet the goal?

Reveal Solution Hide Solution

HOTSPOT

You plan to deploy a disconnected Azure Stack Hub integrated system.

You need to identify which type of certificate to use for the deployment and the file format for the certificate.

The solution must meet the following requirements:

• Minimize administrative effort.

• Maximize security.

What should identify? To answer, select the appropriate options in the answer area. NOTE:

Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Azure Stack Hub public key infrastructure (PKI) certificate requirements

Azure Stack Hub has a public infrastructure network using externally accessible public IP addresses assigned to a small set of Azure Stack Hub services and possibly tenant VMs. PKI certificates with the appropriate DNS names for these Azure Stack Hub public infrastructure endpoints are required during Azure Stack Hub deployment.

Box 1: A certificate from an internal certification authority (CA)

Your Azure Stack Hub infrastructure must have network access to the certificate authority’s Certificate Revocation List (CRL) location published in the certificate. This CRL must be an http endpoint. Note: for disconnected deployments, certificates issued by a public certificate authority (CA) are not supported, if the CRL endpoint is not accessible.

Features that are impaired or unavailable in disconnected deployments

Azure Stack Hub was designed to work best when connected to Azure, so it’s important to note that there are some features and functionality that are either impaired or completely unavailable in the disconnected mode.

Private/internal Certificate Authority (CA)

No impact – In cases where the deployment uses certificates issued by a private CA, such as an internal CA within an organization, only internal network access to the CRL endpoint is required. Internet connectivity is not required, but you should verify that your Azure Stack Hub infrastructure has the required network access to contact the CRL endpoint defined in the certificates CDP extension.

Box 2: PFX

The certificate format must be PFX, as both the public and private keys are required for Azure Stack Hub installation. The private key must have the local machine key attribute set.

DRAG DROP

You have an Azure Stack Hub integrated system that is disconnected from the Internet.

You need to collect diagnostic logs, but do not have access to an SMB share.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

You have an Azure Stack Hub integrated system that is disconnected from the internet.

The integrated system has an Azure App Service resource provider.

You generate a new certificate.

You need to rotate the certificate of the App Service identity application to use the new certificate.

Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

HOTSPOT

You have an Azure Stack Hub Integrated system that has the following configurations:

• Deployment virtual machine (DVM) IP address: 10.30.1.253

• First host IP address: 10.30.1.193

• Last host IP address: 10.30.1.254

• Subnet mask: 255.255.255.192

• BMC network: 10.30.1.192/26

• Default gateway: 10.30.1.193

• NTP: 10.31.1.2

• DNS: 8.8.8.8

You need to deploy an Operator Access Workstation (OAW) to the Hardware Lifecycle Host (HLH) and configure the network settings for the OAW.

How should you complete the script? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1: .New-OAW.ps1

Create the OAW VM using a script

The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub.

✑ Sign in to the HLH with your credentials.

✑ Download OAW.zip and extract the files.

✑ Open an elevated PowerShell session.

✑ Navigate to the extracted contents of the OAW.zip file.

✑ Run the New-OAW.ps1 script.

Example: Example: Deploy on HLH using a Microsoft Image $oawRootPath = "D:oawtest"

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW’s local administrator" -AsSecureString

if (Get-ChildItem -Path $oawRootPath -Recurse | Get-Item -Stream Zone* -ErrorAction SilentlyContinue | Select-Object FileName)

{ Write-Host "Execution failed, unblock the script files first" }

else { .New-OAW.ps1 -LocalAdministratorPassword $securePassword }

Syntax:

New-OAW

-LocalAdministratorPassword <Security.SecureString> ` -IPAddress <String> `

-SubnetMask <String> `

-DefaultGateway <String> `

-DNS <String[]> `

-TimeServer<String> `

[-AzureStackCertificatePath <String>] `

[-AzSStampInfoFilePath <String>] `

[-CertificatePassword <Security.SecureString>] `

[-ERCSVMIP <String[]>] `

[-ImageFilePath <String>] `

[-VirtualMachineName <String>] `

[-VirtualMachineMemory <int64>] `

[-VirtualProcessorCount <int>] `

[-VirtualMachineDiffDiskPath <String>] `

[-PhysicalAdapterMACAddress <String>] `

[-VirtualSwitchName <String>] `

[-ReCreate] `

[-AsJob] `

[-Passthru] `

[-WhatIf] `

[-Confirm] `

[<CommonParameters>]

Box 2: 10.30.1.253

Deployment virtual machine (DVM) IP address: 10.30.1.253

Note:

Parameter:

IPAddress (Required)

The static IPv4 address to configure TCP/IP on the virtual machine.

HOTSPOT

You have an Azure Stack Hub integrated system that is enabled for multitenancy and uses an Azure Active Directory (Azure AD) tenant named fabrikam.com as an identity provider.

The integrated system has the following guest directory tenants onboarded and enabled for multitenancy:

✑ com

✑ onmicrosoft.com

✑ onmicrosoft.com

You need to verify whether all the guest directory tenants are registered properly.

How should you complete the PowerShell script? To answer, drag the appropriate cmdlet to the correct targets. Each cmdlet may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

DRAG DROP

Your company is a Cloud Solution Provider (CSP).

You plan to create an Azure subscription for a new Azure Stack Hub integrated system and configure Azure Stack Hub to be available to multiple customers. Your company will also have its own workloads deployed to the Azure Stack Hub.

You need to perform the deployment so that usage data for future customers is directed to their Azure subscription.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

A picture containing text

Description automatically generated

HOTSPOT

You deploy an App Service resource provider to an Azure Stack Hub integrated system.

You need to create an offer to deploy an Azure Functions app by using the resource provider.

Which resource provider should you specify in the offer, and which type of subscription should you use to test the functionality of the offer? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Graphical user interface, text, application, chat or text message

Description automatically generated

Box 1: Microsoft.Web

Resource providers for Azure services

Match resource provider to service (Resource provider namespace, Azure service)

* Microsoft.Web App Service Azure Functions

Box 2: Default Provider Subscription

In Azure Stack Hub Subscriptions, select the Default Provider Subscription. Azure App Service on Azure Stack Hub must be deployed in the Default Provider Subscription.