Microsoft AZ-600 Configuring and Operating a Hybrid Cloud with Microsoft Azure Stack Hub Exam Practice Test

Instead: Solution: You run the nslookup AzS-ERCS01.azurestack.local command.

Note: nslookup is a network administration command-line tool for querying the Domain Name System to obtain the mapping between domain name and IP address, or other DNS records.

ASDK architecture, Virtual machine roles

The ASDK offers services using the following VMs hosted on the development kit host computer:

* AzS-ERCS01 - Emergency Recovery Console VM.

Graphical user interface, text, application, email Description automatically generated

Step 1: Create a storage account

A sample alias file with many common image aliases is available. You can use that as a starting point. Host this file in a space where your CLI clients can reach it. One way is to host the file in a blob storage account and share the URL with your users:

1. Download the sample file from GitHub.

2. Create a storage account in Azure Stack Hub (Step 1). When that's done, create a blob container. Set the access policy to "public." (Step 2)

3. Upload the JSON file to the new container (Step 3). When that's done, you can view the URL of the blob. Select the blob name and then select the URL from the blob properties.

Step 2: Create a blob container and set the Public access to Blob.

Set up the VM aliases endpoint

Azure Stack Hub operators should set up a publicly accessible endpoint that hosts a VM alias file. The VM alias file is a JSON file that provides a common name for an image. You use the name when you deploy a VM as an Azure CLI parameter.

Note: When public access is allowed for a storage account, you can configure a container with the following permissions:

* Public read access for blobs only: Blobs within the container can be read by anonymous request, but container data is not available anonymously. Anonymous clients cannot enumerate the blobs within the container.

* Public read access for container and its blobs: Container and blob data can be read by anonymous request, except for container permission settings and container metadata. Clients can enumerate blobs within the container by anonymous request, but cannot enumerate containers within the storage account.

* No public read access: The container and its blobs can be accessed only with an authorized request. This option is the default for all new containers.

Step 3: To the container, upload the alias template as a JSON file.

Box 1: .\New-OAW.ps1

Create the OAW VM using a script

The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub.

• Sign in to the HLH with your credentials.
• Download OAW.zip and extract the files.
• Open an elevated PowerShell session.
• Navigate to the extracted contents of the OAW.zip file.
• Run the New-OAW.ps1 script.

Example: Example: Deploy on HLH using a Microsoft Image

$oawRootPath = "D:\oawtest"

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" -AsSecureString

if (Get-ChildItem -Path $oawRootPath -Recurse | Get-Item -Stream Zone* -ErrorAction SilentlyContinue | Select-Object FileName)

{ Write-Host "Execution failed, unblock the script files first" }

else { .\New-OAW.ps1 -LocalAdministratorPassword $securePassword }

Syntax:

New-OAW

-LocalAdministratorPassword `

-IPAddress `

-SubnetMask `

-DefaultGateway `

-DNS `

-TimeServer `

[-AzureStackCertificatePath ] `

[-AzSStampInfoFilePath ] `

[-CertificatePassword ] `

[-ERCSVMIP ] `

[-ImageFilePath ] `

[-VirtualMachineName ] `

[-VirtualMachineMemory ] `

[-VirtualProcessorCount ] `

[-VirtualMachineDiffDiskPath ] `

[-PhysicalAdapterMACAddress ] `

[-VirtualSwitchName ] `

[-ReCreate] `

[-AsJob] `

[-Passthru] `

[-WhatIf] `

[-Confirm] `

[]

Box 2: 10.30.1.253

Deployment virtual machine (DVM) IP address: 10.30.1.253

Note:

Parameter:

IPAddress (Required)

The static IPv4 address to configure TCP/IP on the virtual machine.

Graphical user interface, text, application, email Description automatically generated

Step 1: Create a JSON file that contains the role definition.

Rather than using an account that has Owner permissions in the Azure subscription, you can create a custom role to assign permissions to a less-privileged user account. This account can then be used to register your Azure Stack Hub.

Create a custom role using PowerShell

Use the following JSON template to simplify creation of the custom role. The template creates a custom role that allows the required read and write access for Azure Stack Hub registration.

1. Create a JSON file. For example, C:\CustomRoles\registrationrole.json.

2. Add the following JSON to the file. Replace with your Azure subscription ID.

{

"Name": "Azure Stack Hub registration role",

"Id": null,

"IsCustom": true,

"Description": "Allows access to register Azure Stack Hub",

"Actions": [

"Microsoft.Resources/subscriptions/resourceGroups/write",

"Microsoft.Resources/subscriptions/resourceGroups/read",

"Microsoft.AzureStack/registrations/*",

"Microsoft.AzureStack/register/action",

"Microsoft.Authorization/roleAssignments/read",

"Microsoft.Authorization/roleAssignments/write",

"Microsoft.Authorization/roleAssignments/delete",

"Microsoft.Authorization/permissions/read",

"Microsoft.Authorization/locks/read",

"Microsoft.Authorization/locks/write"

],

"NotActions": [

],

"AssignableScopes": [

"/subscriptions/"

]

}

3. In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or User Access Administrator.

Connect-AzAccount

4. To create the custom role, use New-AzRoleDefinition specifying the JSON template file.

New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json"

Step 2: From Azure Cloud shell, run the New-AzRoleDefinition cmdlet.

Step 3: From the Azure portal, add a role assignment to sub1.

Assign a user to registration role

After the registration custom role is created, assign the role to the user account that will be used for registering Azure Stack Hub.

• Sign in with the account with sufficient permission on the Azure subscription to delegate rights - such as Owner or User Access Administrator.

• In Subscriptions, select Access control (IAM) > Add role assignment.

• In Role, choose the custom role you created: Azure Stack Hub registration role.

• Select the users you want to assign to the role.

• Select Save to assign the selected users to the role.

Graphical user interface, text, application Description automatically generated

When deploying Azure Stack Hub in disconnected mode it is recommended to use certificates issued by an enterprise certificate authority. This is important because clients accessing Azure Stack Hub endpoints must be able to contact the certificate revocation list (CRL).

Table Description automatically generated

Step 1: Create a config.file and save the file as Sloud-init.txt file.

Publish a custom cloud-init built image of a Linux virtual machine to Azure Stack Hub Marketplace on the integrated system.

Add Linux images to the Azure Stack Hub Marketplace

1: Create a cloud-init.txt file with your cloud-config

Step 2: Upload the file to Azure Stack Hub storage account.

2: Reference cloud-init.txt during the Linux VM deployment

Upload the file to an Azure storage account, Azure Stack Hub storage account, or GitHub repository reachable by your Azure Stack Hub Linux VM.

Step 3: Provision on Azure Stack Hub virtual machine by using Az PowerShell moduel.

You can create an Ubuntu Server 16.04 LTS virtual machine (VM) by using Azure Stack Hub PowerShell.

Make sure to reference the cloud-init.txt as a part of the -CustomData flag:

$VirtualMachine =Set-AzVMOperatingSystem -VM $VirtualMachine `

-Linux `

-ComputerName "MainComputer" `

-Credential $cred -CustomData "#include https://cloudinitstrg.blob.core.windows.net/strg/cloud-init.txt "

Assign the delegated provider role to User1.

Delegation steps

There are two steps to setting up delegation:

1. Create a delegated provider subscription: Subscribe a user to an offer containing only the subscription service. Users who subscribe to this offer can then extend the delegated offers to other users by signing them up for those offers.

2. Delegate an offer to the delegated provider: This offer enables the delegated provider to create subscriptions or to extend the offer to their users. The delegated provider can now take the offer and extend it to other users.

Note:

Move subscriptions between delegated providers

If needed, a subscription can be moved between new or existing delegated provider subscriptions that belong to the same directory tenant. You can move them using the PowerShell cmdlet Move-AzsSubscription.

Moving subscriptions is useful when:

* You onboard a new team member that will take on the delegated provider role and you want to assign to this team member user subscriptions that were previously created in the default provider subscription.

* You have multiple delegated providers subscriptions in the same directory tenant (Azure AD) and need to move user subscriptions between them. This scenario could occur when a team member moves between teams and their subscription must be allocated to the new team.

Use the Azure Stack Hub Readiness Checker tool to validate that generated public key infrastructure (PKI) certificates which are suitable for pre-deployment. Validate certificates by leaving enough time to test and reissue certificates if necessary.

The Readiness Checker tool performs the following certificate validations:

* Parse PFX

Checks for valid PFX file, correct password, and whether the public information is protected by the password.

* Expiry Date

Checks for minimum validity of seven days.

* Signature algorithm

Checks that the signature algorithm isn't SHA1.

* Private Key

Checks that the private key is present and is exported with the local machine attribute.

* Etc.

Note: Perform core services certificate validation

Use these steps to validate the Azure Stack Hub PKI certificates for deployment and secret rotation:

1. Install AzsReadinessChecker from a PowerShell prompt (5.1 or above) by running the following cmdlet:

Install-Module Microsoft.AzureStack.ReadinessChecker -Force -AllowPrerelease

2. Create the certificate directory structure.

3. Etc.

Box 1: Subject Alternative Name

Implement the App Service resource provider and the Event Hubs resource provider on the integrated system/

Only the Subject Alternative Name is used.

Box 2: DNS Name = =*.eventhub.east.azurestack.treyresearch.net

Event Hubs prerequisites

Procure public key infrastructure (PKI) SSL certificates for Event Hubs. The Subject Alternative Name (SAN) must adhere to the following naming pattern: CN=*.eventhub... Subject Name may be specified, but it's not used by Event Hubs when handling certificates. Only the Subject Alternative Name is used. See PKI certificate requirements for the full list of detailed requirements.

Box 1: 4

The infrastructure of the integrated system must be backed up as frequently as possible.

Enable backup for Azure Stack Hub from the administrator portal

The frequency in hours determines how often backups are created. The default value is 12. Scheduler supports a maximum of 12 and a minimum of 4.

Box 2: Azure key vault

The integrated system backups must be retained for 28 days.

Online retention policy. This specifies the time period during which daily, weekly, monthly, and yearly backups are retained in the Azure Site Recovery vault that's associated with the local MABS instance.

Configure the integrated system to resolve external names by using a DNS Server that has an IP address of 10.100.100.100.

Resolving external DNS names from Azure Stack Hub

To resolve DNS names for endpoints outside Azure Stack Hub (for example: www.bing.com), you need to provide DNS servers that Azure Stack Hub can use to forward DNS requests for which Azure Stack Hub isn 't authoritative. For deployment, DNS servers that Azure Stack Hub forwards requests to are required in the Deployment Worksheet (in the DNS Forwarder field). Provide at least two servers in this field for fault tolerance. Without these values, Azure Stack Hub deployment fails. You can edit the DNS Forwarder values with the Set-AzSDnsForwarder cmdlet after deployment.

Configure conditional DNS forwarding

Important

This only applies to an AD FS deployment.

To enable name resolution with your existing DNS infrastructure, configure conditional forwarding.

To add a conditional forwarder, you must use the privileged endpoint.

For this procedure, use a computer in your datacenter network that can communicate with the privileged endpoint in Azure Stack Hub.

1. Open an elevated Windows PowerShell session (run as administrator), and connect to the IP address of the privileged endpoint. Use the credentials for CloudAdmin authentication.

$cred=Get-Credential

Enter-PSSession -ComputerName -ConfigurationName PrivilegedEndpoint -Credential $cred

2. After you connect to the privileged endpoint, run the following PowerShell command. Substitute the sample values provided with your domain name and IP addresses of the DNS servers you want to use.

Register-CustomDnsServer -CustomDomainName "contoso.com" -Custom

Graphical user interface, text, application, chat or text message Description automatically generated

Box 1: Administrator management endpoint

Note: The developers report high chargeback costs for the dev1 region.

Two integrated systems that are dedicated to application development and have the following configurations:

• The integrated systems are disconnected from the Internet. The workloads in the user subscriptions have Internet access.
• One integrated system has a region name of dev1, and the other has a region name of dev2.
• Both regions are used only by developers at Northwind Traders.

The request gets consumption details for the requested subscriptions and for the requested time frame. There is no request body.

This usage API is a provider API, so the caller must be assigned an Owner, Contributor, or Reader role in the provider's subscription.

Method, Request URI

GET https://{armendpoint}/subscriptions/{subId}/providers/Microsoft.Commerce.Admin/subscriberUsageAggregates?reportedStartTime={reportedStartTime} &reportedEndTime={reportedEndTime}&aggregationGranularity={granularity}&subscriberId={sub1.1}&api-version=2015-06-01-preview&continua

Arguments

* armendpoint

Azure Resource Manager endpoint of your Azure Stack Hub environment. The Azure Stack Hub convention is that the name of the Azure Resource Manager endpoint is in the format https://adminmanagement.{domain-name}. For example, for the Azure Stack Development Kit (ASDK), if the domain name is local.azurestack.external, then the Resource Manager endpoint is https://adminmanagement.local.azurestack.external.

* subId

Subscription ID of the user who makes the call.

* Etc.

Box 2: Get-AzsSubscriberUsage

Retrieve usage information

PowerShell

To generate the usage data, you should have resources that are running and actively using the system; for example, an active virtual machine (VM), or a storage account containing some data. If you're not sure whether you have any resources running in the Azure Stack Hub Marketplace, deploy a VM, and verify the VM monitoring blade to make sure it's running. Use the following PowerShell cmdlets to view the usage data:

• Install PowerShell for Azure Stack Hub.

• Configure the Azure Stack Hub user or the Azure Stack Hub operator PowerShell environment.

• To retrieve the usage data, call the Get-AzsSubscriberUsage PowerShell cmdlet:

Get-AzsSubscriberUsage -ReportedStartTime "2017-09-06T00:00:00Z"

Step 1: Notify all the users in the int1 region and schedule a maintenance window.

Step 2: Select the subscription that was used to perform the initial registration.

Note: You need to change the int1 region to use the capacity model.

Change the billing model and registration name of the int1 region.

The int1 region runs a high number of Windows virtual machines that use pay-as-you-use images.

Change billing model, how features are offered, or re-register your instance

This section applies if you want to change the billing model, how features are offered, or you want to re-register your instance. For all of these cases, you call the registration function to set the new values. You don't need to first remove the current registration.

# select the subscription used during the registration

Select-AzSubscription -Subscription ''

# rerun registration with new BillingModel (or same billing model in case of re-registration) but using other parameters values from portal

Set-AzsRegistration -PrivilegedEndpointCredential $YourCloudAdminCredential -PrivilegedEndpoint $YourPrivilegedEndpoint -BillingModel '' -RegistrationName '' -ResourceGroupName ''

Step 3: Run the Set-AzsRegistration cmdlet.

You can use Set-AzsRegistration to register Azure Stack Hub with Azure and enable or disable the offer of items in the marketplace and usage reporting.

To run the cmdlet, you need:

A global Azure subscription of any type.

To be signed in to Azure PowerShell with an account that's an owner or contributor to that subscription.