Microsoft AZ-600 Practice Test - Questions Answers, Page 10

Reference:

https://github.com/Azure/AzureStack-Tools/blob/master/Identity/README.md

Reference:

https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-replace-node?view=azs-2008

https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-node-actions?view=azs-2008&tabs=az1

Reference:

https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-update-prepare-package?view=azs-2008

Reference:

https://docs.microsoft.com/en-us/azure-stack/user/azure-stack-rest-api-use?view=azs-2008

Reference:

https://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-windows-server-faq?view=azs-2102&tabs=az1%2Caz2

Step 1: Modify the permissions section of the JSON file

Step 2: Modify the assignableScopes section of the JSON file.

Replace <SubscriptionID> with your Azure subscription ID.

Sample JSON file:

{

"Name": "Azure Stack Hub registration role",

"Id": null,

"IsCustom": true,

"Description": "Allows access to register Azure Stack Hub",

"Actions": [

"Microsoft.Resources/subscriptions/resourceGroups/write",

"Microsoft.Resources/subscriptions/resourceGroups/read",

"Microsoft.AzureStack/registrations/*",

"Microsoft.AzureStack/register/action",

"Microsoft.Authorization/roleAssignments/read",

"Microsoft.Authorization/roleAssignments/write",

"Microsoft.Authorization/roleAssignments/delete",

"Microsoft.Authorization/permissions/read",

"Microsoft.Authorization/locks/read",

"Microsoft.Authorization/locks/write"

],

"NotActions": [

],

"AssignableScopes": [

"/subscriptions/<SubscriptionID>"

]

}

Step 3: Connect to the administrator Azure Resource Manager (ARM) endpoint.

In PowerShell, connect to Azure to use Azure Resource Manager. When prompted, authenticate using an account with sufficient permissions such as Owner or User Access Administrator. Connect-AzAccount

Step 4: Run the New-AzRoleDefinition cmdlet.

To create the custom role, use New-AzRoleDefinition specifying the JSON template file.

New-AzRoleDefinition -InputFile "C:\CustomRoles\registrationrole.json

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-registration-role

Box 1: .\New-OAW.ps1

Create the OAW VM using a script

The following script prepares the virtual machine as the Operator Access Workstation (OAW), which is used to access Microsoft Azure Stack Hub. Sign in to the HLH with your credentials.

Download OAW.zip and extract the files.

Open an elevated PowerShell session.

Navigate to the extracted contents of the OAW.zip file.

Run the New-OAW.ps1 script.

Example: Example: Deploy on HLH using a Microsoft Image

$oawRootPath = "D:\oawtest"

$securePassword = Read-Host -Prompt "Enter password for Azure Stack OAW's local administrator" – AsSecureString if (Get-ChildItem -Path $oawRootPath -Recurse | Get-Item -Stream Zone* -ErrorAction SilentlyContinue | Select-Object FileName) { Write-Host "Execution failed, unblock the script files first" } else { .\New-OAW.ps1 -LocalAdministratorPassword $securePassword } Syntax:

New-OAW

-LocalAdministratorPassword <Security.SecureString> `

-IPAddress <String> `

-SubnetMask <String> `

-DefaultGateway <String> `

-DNS <String[]> `

-TimeServer<String> `

[-AzureStackCertificatePath <String>] `

[-AzSStampInfoFilePath <String>] `

[-CertificatePassword <Security.SecureString>] `

[-ERCSVMIP <String[]>] `

[-ImageFilePath <String>] `

[-VirtualMachineName <String>] `

[-VirtualMachineMemory <int64>] `

[-VirtualProcessorCount <int>] `

[-VirtualMachineDiffDiskPath <String>] `

[-PhysicalAdapterMACAddress <String>] `

[-VirtualSwitchName <String>] `

[-ReCreate] `

[-AsJob] `

[-Passthru] `

[-WhatIf] `

[-Confirm] `

[<CommonParameters>]

Box 2: 10.30.1.253

Deployment virtual machine (DVM) IP address: 10.30.1.253

Note:

Parameter:

IPAddress (Required)

The static IPv4 address to configure TCP/IP on the virtual machine.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/operator-access-workstation

Step 1: Create a storage account

A sample alias file with many common image aliases is available. You can use that as a starting point. Host this file in a space where your CLI clients can reach it. One way is to host the file in a blob storage account and share the URL with your users:

1. Download the sample file from GitHub.

2. Create a storage account in Azure Stack Hub (Step 1). When that's done, create a blob container. Set the access policy to "public." (Step 2)

3. Upload the JSON file to the new container (Step 3). When that's done, you can view the URL of the blob. Select the blob name and then select the URL from the blob properties. Step 2: Create a blob container and set the Public access to Blob.

Set up the VM aliases endpoint

Azure Stack Hub operators should set up a publicly accessible endpoint that hosts a VM alias file. The VM alias file is a JSON file that provides a common name for an image. You use the name when you deploy a VM as an Azure CLI parameter.

Note: When public access is allowed for a storage account, you can configure a container with the following permissions:

* Public read access for blobs only: Blobs within the container can be read by anonymous request, but container data is not available anonymously. Anonymous clients cannot enumerate the blobs within the container. * Public read access for container and its blobs: Container and blob data can be read by anonymous request, except for container permission settings and container metadat a. Clients can enumerate blobs within the container by anonymous request, but cannot enumerate containers within the storage account.

* No public read access: The container and its blobs can be accessed only with an authorized request. This option is the default for all new containers.

Step 3: To the container, upload the alias template as a JSON file.

Reference: https://learn.microsoft.com/en-us/azure-stack/operator/azure-stack-cli-admin

https://learn.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-configure