Refined AZ-220 Forum 2021

NEW QUESTION 1

You use Azure Security Center in an Azure IoT solution.
You need to exclude some security events. The solution must minimize development effort. What should you do?

• A. Create an Azure function to filter security messages.
• B. Add a configuration to the code of the physical IoT device.
• C. Add configuration details to the device twin object.
• D. Create an azureiotsecurity module twin and add configuration details to the module twin object.

Answer: D

Explanation:
Properties related to every Azure Security Center for IoT security agent are located in the agent configuration object, within the desired properties section, of the azureiotsecurity module.
To modify the configuration, create and modify this object inside the azureiotsecurity module twin identity. Note: Azure Security Center for IoT's security agent twin configuration object is a JSON format object. The
configuration object is a set of controllable properties that you can define to control the behavior of the agent. These configurations help you customize the agent for each scenario required. For example, automatically
excluding some events, or keeping power consumption to a minimal level are possible by configuring these
properties.
Reference:
https://docs.microsoft.com/en-us/azure/asc-for-iot/how-to-agent-configuration

NEW QUESTION 2

You have an Azure IoT Edge device.
You need to modify the credentials used to access the container registry. What should you modify?

• A. the @edgeHub module twin
• B. the IoT Edge module
• C. the $edgeAgent module twin
• D. the Azure IoT Hub device twin

Answer: C

Explanation:
The module twin for the IoT Edge agent is called $edgeAgent and coordinates the communications between the IoT Edge agent running on a device and IoT Hub. The desired properties are set when applying a deployment manifest on a specific device as part of a single-device or at-scale deployment.
These properties include: runtime.settings.registryCredentials.{registryId}.username runtime.settings.registryCredentials.registryId}.password
Reference:
https://docs.microsoft.com/en-us/azure/iot-edge/module-edgeagent-edgehub

NEW QUESTION 3

You have an Azure IoT hub.
You plan to attach three types of IoT devices as shown in the following table.

You need to select the appropriate communication protocol for each device.
What should you select? To answer, drag the appropriate protocols to the correct devices. Each protocol may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Box 1: AMQP
Use AMQP on field and cloud gateways to take advantage of connection multiplexing across devices. Box 2: MQTT
MQTT is used on all devices that do not require to connect multiple devices (each with its own per-device credentials) over the same TLS connection.
Box 3: HTTPS
Use HTTPS for devices that cannot support other protocols.
https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-protocols

NEW QUESTION 4

You have an Azure IoT hub.
You need to recommend a solution to scale the IoT hub automatically. What should you include in the recommendation?

• A. Create an SMS alert in IoT Hub for the Total number of messages used metric.
• B. Create an Azure function that retrieves the quota metrics of the IoT hub.
• C. Configure autoscaling in Azure Monitor.
• D. Emit custom metrics from the IoT device code and create an Azure Automation runbook alert.

Answer: B

Explanation:
Note: IoT Hub is scaled and priced based on an allowed number of messages per day across all devices connected to that IoT Hub. If you exceed the allowed message threshold for your chosen tier and number of units, IoT Hub will begin rejecting new messages. To date, there is no built-in mechanism for automatically scaling an IoT Hub to the next level of capacity if you approach or exceed that threshold.
Reference:
https://docs.microsoft.com/en-us/samples/azure-samples/iot-hub-dotnet-autoscale/iot-hub-dotnet-autoscale/

NEW QUESTION 5

You have an Azure IoT Central application that has a custom device template. You need to configure the device template to support the following activities:
Return the reported power consumption.
Configure the desired fan speed.
Run the device reset routine.
Read the fan serial number.
Which option should you use for each activity? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:
Box 1: Measurement
Telemetry/measurement is a stream of values sent from the device, typically from a sensor. For example, a sensor might report the ambient temperature.
Box 2: Property
The template can provide a writeable fan speed property
Properties represent point-in-time values. For example, a device can use a property to report the target temperature it's trying to reach. You can set writeable properties from IoT Central.
Box 3: Settings
Box 4: Command
You can call device commands from IoT Central. Commands optionally pass parameters to the device and receive a response from the device. For example, you can call a command to reboot a device in 10 seconds.
Reference:
https://docs.microsoft.com/en-us/azure/iot-central/core/howto-set-up-template

NEW QUESTION 6

You have an Azure IoT solution that includes an Azure IoT hub and 100 Azure IoT Edge devices.
You plan to deploy the IoT Edge devices to external networks. The firewalls of the external networks only allow traffic on port 80 and port 443.
You need to ensure that the devices can connect to the IoT hub. The solution must minimize costs. What should you do?

• A. Configure the devices for extended offline operations.
• B. Configure the upstream protocol of the devices to use MQTT over WebSocket.
• C. Connect the external networks to the IoT solution by using ExpressRoute.
• D. Configure the devices to use an HTTPS proxy.

Answer: B

Explanation:
MQTT over WebSockets uses port 443. Reference:
https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-devguide-protocols

NEW QUESTION 7

You have 20 devices that connect to an Azure IoT hub.
You open Azure Monitor as shown in the exhibit. (Click the Exhibit tab.)

You discover that telemetry is not being received from five IoT devices.
You need to identify the names of the devices that are not generating telemetry and visualize the data. What should you do first?

• A. Add the Number of throttling errors metric and archive the logs to an Azure storage account.
• B. Configure diagnostics for Routes and stream the logs to Azure Event Hubs.
• C. Add the Telemetry messages sent metric and archieve the logs to an Azure Storage account.
• D. Configure diagnostics for Connections and send the logs to Azure Log Analytics.

Answer: D

Explanation:
To log device connection events and errors, turn on diagnostics for IoT Hub. We recommend turning on these logs as early as possible, because if diagnostic logs aren't enabled, when device disconnects occur, you won't have any information to troubleshoot the problem with.
Sign in to the Azure portal.
Browse to your IoT hub.
Select Diagnostics settings.
Select Turn on diagnostics.
Enable Connections logs to be collected.
For easier analysis, turn on Send to Log Analytics

Reference:
https://docs.microsoft.com/bs-cyrl-ba/azure/Iot-hub/iot-hub-troubleshoot-connectivity

NEW QUESTION 8

You plan to deploy Azure Time Series Insights.
What should you create on iothub1 before you deploy Time Series Insights?

• A. a new message route
• B. a new consumer group
• C. a new shared access policy
• D. an IP filter rule

Answer: B

Explanation:
Create a dedicated consumer group in the IoT hub for the Time Series Insights environment to consume from. Each Time Series Insights event source must have its own dedicated consumer group that isn't shared with any other consumer. If multiple readers consume events from the same consumer group, all readers are likely to exhibit failures.
Reference:
https://docs.microsoft.com/en-us/azure/time-series-insights/time-series-insights-how-to-add-an-event-source- iothub

NEW QUESTION 9

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have devices that connect to an Azure IoT hub. Each device has a fixed GPS location that includes latitude and longitude.
You discover that a device entry in the identity registry of the IoT hub is missing the GPS location.
You need to configure the GPS location for the device entry. The solution must prevent the changes from being propagated to the physical device.
Solution: You add the desired properties to the device twin. Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

Explanation:
Device Twins are used to synchronize state between an IoT solution's cloud service and its devices. Each device's twin exposes a set of desired properties and reported properties. The cloud service populates the desired properties with values it wishes to send to the device. When a device connects it requests and/or subscribes for its desired properties and acts on them.
Reference:
https://azure.microsoft.com/sv-se/blog/deep-dive-into-azure-iot-hub-notifications-and-device-twin/

NEW QUESTION 10

You have an Azure IoT hub that uses a Device Provisioning Service instance to automate the deployment of Azure IoT Edge devices.
The IoT Edge devices have a Trusted Platform Module (TPM) 2.0 chip.
From the Azure portal, you plan to add an individual enrollment to the Device Provisioning Service that will use the TPM of the IoT Edge devices as the attestation mechanism.
Which detail should you obtain before you can create the enrollment.

• A. the scope ID and the Device Provisioning Service endpoint
• B. the primary key of the Device Provisioning Service shared access policy and the global device endpoint
• C. the X.509 device certificate and the certificate chain
• D. the endorsement key and the registration ID

Answer: D

Explanation:
The TPM simulator's Registration ID and the Endorsement key, are used when you create an individual enrollment for your device.
Reference:
https://docs.microsoft.com/en-us/azure/iot-edge/how-to-auto-provision-simulated-device-linux

NEW QUESTION 11

You have an Azure IoT hub that uses a Device Provisioning Service instance.
You create a new individual device enrollment that uses symmetric key attestation.
Which detail from the enrollment is required to auto provision the device by using the Device Provisioning Service?

• A. the registration ID of the enrollment
• B. the primary key of the enrollment
• C. the device identity of the IoT hub
• D. the hostname of the IoT hub

Answer: C

Explanation:
An enrollment is the record of devices or groups of devices that may register through auto-provisioning. The enrollment record contains information about the device or group of devices, including:
the attestation mechanism used by the device
the optional initial desired configuration desired IoT hub the desired device ID
Note: Azure IoT auto-provisioning can be broken into three phases:
*1. Service configuration - a one-time configuration of the Azure IoT Hub and IoT Hub Device Provisioning Service instances, establishing them and creating linkage between them.
*2. Device enrollment - the process of making the Device Provisioning Service instance aware of the devices that will attempt to register in the future. Enrollment is accomplished by configuring device identity information in the provisioning service, as either an "individual enrollment" for a single device, or a "group enrollment" for multiple devices.
*3. Device registration and configuration Reference:
https://docs.microsoft.com/en-us/azure/iot-dps/concepts-service#enrollment

NEW QUESTION 12

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure IoT solution that includes an Azure IoT hub, a Device Provisioning Service instance, and 1,000 connected IoT devices.
All the IoT devices are provisioned automatically by using one enrollment group. You need to temporarily disable the IoT devices from the connecting to the IoT hub. Solution: You delete the enrollment group from the Device Provisioning Service. Does the solution meet the goal?

• A. Yes
• B. No

Answer: B

Explanation:
Instead, from the Device Provisioning Service, you disable the enrollment group, and you disable device entries in the identity registry of the IoT hub to which the IoT devices are provisioned.
Reference:
https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-unprovision-devices

NEW QUESTION 13

You have an Azure IoT hub that uses a Device Provisioning Service instance.
You have 1,000 legacy IoT devices that only support MAC address or serial number identities. The device do NOT have a security feature that can be used to securely identify the device or a hardware security module (HSM).
You plan to deploy the devices to a secure environment.
You need to configure the Device Provisioning Service instance to ensure that all the devices are identified securely before they receive updates.
Which attestation mechanism should you choose?

• A. Trusted Platform Module (TPM) 1.2 attestation
• B. symmetric key attestation
• C. X.509 certificates

Answer: B

Explanation:
A common problem with many legacy devices is that they often have an identity that is composed of a single piece of information. This identity information is usually a MAC address or a serial number. Legacy devices may not have a certificate, TPM, or any other security feature that can be used to securely identify the device. The Device Provisioning Service for IoT hub includes symmetric key attestation. Symmetric key attestation can be used to identify a device based off information like the MAC address or a serial number.
Reference:
https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-legacy-device-symm-key

NEW QUESTION 14

You plan to deploy an Azure IoT hub. The IoT hub must support the following:
Three Azure IoT Edge devices 2,500 IoT devices
Each IoT device will spend a 6 KB message every five seconds.
You need to size the IoT hub to support the devices. The solution must minimize costs. What should you choose?

• A. one unit of the S1 tier
• B. one unit of the B2 tier
• C. one unit of the B1 tier
• D. one unit of the S3 tier

Answer: D

Explanation:
\ 2500* 6 KB * 12 = 180,000 KB/minute = 180 MB/Minute.
B3, S3 can handle up to 814 MB/minute per unit. Incorrect Answers:
A, C: B1, S1 can only handle up to 1111 KB/minute per unit B: B2, S2 can only handle up to 16 MB/minute per unit.
Reference:
https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-scaling

NEW QUESTION 15

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this question, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure IoT solution that includes an Azure IoT hub, a Device Provisioning Service instance, and 1,000 connected IoT devices.
All the IoT devices are provisioned automatically by using one enrollment group. You need to temporarily disable the IoT devices from the connecting to the IoT hub.
Solution: From the Device Provisioning Service, you disable the enrollment group, and you disable device entries in the identity registry of the IoT hub to which the IoT devices are provisioned.
Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

Explanation:
You may find it necessary to deprovision devices that were previously auto-provisioned through the Device Provisioning Service.
In general, deprovisioning a device involves two steps:
*1. Disenroll the device from your provisioning service, to prevent future auto-provisioning. Depending on whether you want to revoke access temporarily or permanently, you may want to either disable or delete an enrollment entry.
*2. Deregister the device from your IoT Hub, to prevent future communications and data transfer. Again, you can temporarily disable or permanently delete the device's entry in the identity registry for the IoT Hub where it was provisioned.
Reference:
https://docs.microsoft.com/bs-latn-ba/azure/iot-dps/how-to-unprovision-devices

NEW QUESTION 16
......