I85PREP
⌘ K
Azure AZ-600 study materials
Azure AZ-600 study resources

Azure AZ-600 practice questions

One question at a time. Build your Azure AZ-600 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Plan and deploy Azure Stack Hub

An organization wants to evaluate Azure Stack Hub before purchasing hardware. Which offering should they request from Microsoft?

  1. A regional datacenter extension
  2. The Azure Stack Development Kit Correct answer.
  3. A pay-as-you-go subscription
  4. A disconnected integrated system

Explanation

The Azure Stack Development Kit is a single-node deployment intended for evaluation, learning, and proof-of-concept work. It is not licensed or supported for production workloads, so it is the correct choice for pre-purchase evaluation.

Question 2Plan and deploy Azure Stack Hub

Which component is required to register an Azure Stack Hub integrated system with Azure?

  1. A System Center Operations Manager management group
  2. A local Active Directory domain only
  3. A Microsoft Entra tenant and an Azure subscription Correct answer.
  4. A standalone certificate authority

Explanation

Registration links the Azure Stack Hub stamp to an Azure subscription and a Microsoft Entra tenant so that marketplace syndication, billing, and support features work. Both the subscription and the directory tenant are prerequisites.

Question 3Plan and deploy Azure Stack Hub

What is the purpose of the privileged endpoint (PEP) on an Azure Stack Hub system?

  1. To serve the marketplace syndication feed
  2. To provide a just-in-time administrative interface for support tasks Correct answer.
  3. To host tenant virtual machines
  4. To act as the software load balancer

Explanation

The privileged endpoint is a remote PowerShell endpoint that exposes a limited set of administrative cmdlets. Access is monitored and time-bound, and it is used for tasks such as log collection and support diagnostics rather than routine operations.

Question 4Plan and deploy Azure Stack Hub

Which Azure Stack Hub capacity consideration most directly determines whether a planned VM can be deployed?

  1. The number of registered resource providers
  2. The certificate expiration dates
  3. The remaining memory and storage in the stamp Correct answer.
  4. The number of available public IP addresses

Explanation

Placement of a virtual machine depends on available compute memory and storage capacity across the scale unit. Public IPs, resource providers, and certificates affect other aspects of the deployment but do not by themselves block VM placement.

Question 5Plan and deploy Azure Stack Hub

A company must deploy Azure Stack Hub in a facility with no internet connectivity. Which deployment model applies?

  1. Connected deployment with automatic updates
  2. Hybrid deployment using Azure Arc only
  3. Disconnected deployment with offline update packages Correct answer.
  4. Development kit deployment

Explanation

Disconnected deployments are used where the stamp cannot reach Azure, and updates and marketplace content are imported through offline packages. Connected deployments and the development kit both assume connectivity.

Question 6Plan and deploy Azure Stack Hub

Which certificate type is required for the Azure Stack Hub administrator and user portal endpoints?

  1. A client authentication certificate
  2. A server authentication certificate with the portal subject names Correct answer.
  3. An email protection certificate
  4. A code-signing certificate

Explanation

Portal endpoints are HTTPS services, so they require server authentication certificates whose subject alternative names include the administrator and user portal DNS names. Client authentication, code signing, and email certificates serve different purposes.

Question 7Plan and deploy Azure Stack Hub

What does the Azure Stack Hub scale unit represent in an integrated system?

  1. A logical container for tenant subscriptions
  2. A network segment dedicated to the BMC
  3. A single physical server used for management
  4. A group of physical hosts managed as a single compute and storage cluster Correct answer.

Explanation

A scale unit is the collection of physical hosts, storage, and networking that forms the deployable and expandable compute and storage cluster. Capacity grows by adding nodes to the scale unit.

Question 8Plan and deploy Azure Stack Hub

Which tool is used to validate hardware and generate the deployment configuration files before an integrated system deployment?

  1. Azure Migrate
  2. The Azure Stack Hub Readiness Checker Correct answer.
  3. The Azure Storage Explorer
  4. Azure Advisor

Explanation

The Readiness Checker runs a set of validation tests on the hardware and collects the environment data needed to create the deployment configuration. Azure Migrate, Advisor, and Storage Explorer are unrelated Azure services.

Question 9Plan and deploy Azure Stack Hub

An operator needs to add capacity to a running integrated system. What is the supported approach?

  1. Add nodes to the existing scale unit Correct answer.
  2. Enable the development kit on a management host
  3. Create a second stamp and federate it
  4. Increase the size of the privileged endpoint

Explanation

Integrated systems scale by adding physical nodes to the existing scale unit, which increases compute and storage capacity. Creating a second stamp, enabling the development kit, or resizing the PEP does not add supported capacity.

Question 10Plan and deploy Azure Stack Hub

Which identity provider choice must be made when planning an Azure Stack Hub deployment?

  1. Microsoft Entra ID or LDAP
  2. Microsoft Entra ID or Kerberos only
  3. Active Directory Federation Services or RADIUS
  4. Microsoft Entra ID or Active Directory Federation Services Correct answer.

Explanation

Azure Stack Hub supports either Microsoft Entra ID or Active Directory Federation Services as the identity provider. This choice affects registration, sign-in, and whether a connected or disconnected model is feasible.

Question 11Plan and deploy Azure Stack Hub

A deployment plan requires that management services remain available if a single host fails. Which design element addresses this?

  1. A single top-of-rack switch
  2. A multi-node scale unit with redundant infrastructure roles Correct answer.
  3. A standalone development kit
  4. A single-node scale unit

Explanation

High availability of management and infrastructure services requires multiple hosts so that roles can be distributed and survive a host failure. Single-node and single-switch designs introduce single points of failure.

Question 12Plan and deploy Azure Stack Hub

Which network is used for out-of-band management of the physical hosts in an Azure Stack Hub system?

  1. The tenant network
  2. The BMC network Correct answer.
  3. The public VIP network
  4. The storage network

Explanation

The baseboard management controller network provides out-of-band access to host hardware for power and console management. The public VIP, tenant, and storage networks carry workload or infrastructure traffic.

Question 13Plan and deploy Azure Stack Hub

What is the role of the Azure Bridge component in Azure Stack Hub?

  1. It brokers authentication tokens
  2. It syndicates marketplace items from Azure Correct answer.
  3. It replicates storage to Azure
  4. It bridges tenant VNets to the internet

Explanation

The Azure Bridge downloads and syndicates marketplace items from Azure so that operators can publish them to users. It is not a network gateway, storage replication service, or token broker.

Question 14Plan and deploy Azure Stack Hub

Which prerequisite must be satisfied before an operator can register an integrated system?

  1. The marketplace must be fully populated
  2. The stamp must be deployed and the administrator portal reachable Correct answer.
  3. The development kit must be uninstalled
  4. All tenant subscriptions must be created

Explanation

Registration happens after the stamp is successfully deployed and the administrator portal is available. Tenant subscriptions and marketplace content can be added later and are not registration prerequisites.

Question 15Plan and deploy Azure Stack Hub

An operator wants to restrict which virtual machine images tenants can deploy. Which capability should be used?

  1. Azure Policy on the tenant subscription
  2. Resource locks on the stamp
  3. Network security groups
  4. Marketplace management with custom image publishing Correct answer.

Explanation

Operators control available images through marketplace management, including publishing custom images and removing unwanted items. Azure Policy, NSGs, and resource locks address governance, traffic filtering, and deletion protection rather than image availability.

Question 16Plan and deploy Azure Stack Hub

Which statement describes the update process for an Azure Stack Hub integrated system?

  1. Updates are installed automatically by Windows Update
  2. Updates are applied only by the hardware OEM on site
  3. Updates are applied as full update packages through the administrator portal Correct answer.
  4. Updates are pushed by the tenant subscription owner

Explanation

Azure Stack Hub updates are delivered as update packages that operators download and apply through the administrator portal. They are not handled by Windows Update or by tenants, and OEM involvement is not required for every update.

Question 17Plan and deploy Azure Stack Hub

What is the purpose of the OEM extension in an Azure Stack Hub deployment?

  1. To add additional Azure regions
  2. To extend the tenant subscription quota
  3. To replace the privileged endpoint
  4. To provide hardware-specific drivers, firmware, and management tools Correct answer.

Explanation

The OEM extension delivers hardware vendor-specific drivers, firmware, and management utilities that integrate with the stamp. It does not affect tenant quotas, Azure regions, or the privileged endpoint.

Question 18Plan and deploy Azure Stack Hub

A planner needs to decide between a connected and a disconnected deployment. Which factor most strongly drives the choice?

  1. The version of the development kit
  2. Whether outbound internet access to Azure is available Correct answer.
  3. The size of the scale unit
  4. The number of tenant subscriptions

Explanation

Connected deployments require outbound connectivity to Azure for registration, telemetry, and updates, while disconnected deployments are used when that connectivity is unavailable. Subscription count, scale unit size, and development kit version do not determine the model.

Question 19Plan and deploy Azure Stack Hub

Which component provides the DNS and time synchronization services required by the stamp?

  1. The OEM hardware management controller
  2. The tenant virtual machines
  3. The infrastructure services hosted on the stamp Correct answer.
  4. The public VIP address

Explanation

Core infrastructure services, including DNS and time synchronization, run on the stamp's infrastructure hosts. Tenant VMs, the public VIP, and the management controller do not provide these stamp-wide services.

Question 20Plan and deploy Azure Stack Hub

Which requirement applies to the Microsoft Entra tenant used for Azure Stack Hub registration?

  1. It must be synchronized from Active Directory Federation Services
  2. It must be a personal Microsoft account
  3. It must be a newly created tenant with no users
  4. It must be the same tenant that owns the Azure subscription used for registration Correct answer.

Explanation

The Azure subscription and the directory tenant used for registration must be associated with each other so that billing and identity work correctly. The tenant does not need to be new, federated, or a personal account.

Question 21Plan and deploy Azure Stack Hub

Which Azure Stack Hub capability lets operators offer services beyond the default set?

  1. Increasing the number of storage accounts
  2. Registering additional resource providers Correct answer.
  3. Adding public IP addresses
  4. Creating more tenant subscriptions

Explanation

Additional services such as App Service, Event Hubs, or SQL resource providers are offered by registering and deploying the corresponding resource providers. Subscriptions, IP addresses, and storage accounts do not add new service types.

Question 22Plan and deploy Azure Stack Hub

What is the recommended approach for backing up Azure Stack Hub infrastructure?

  1. Export the administrator portal configuration manually
  2. Use the infrastructure backup feature to capture control plane data Correct answer.
  3. Use storage replication to a second stamp
  4. Rely on tenant VM backups only

Explanation

Infrastructure backup captures the control plane data needed to restore the stamp, such as configuration and secrets. Tenant VM backups, manual exports, and cross-stamp replication do not protect the infrastructure control plane.

Question 23Plan and deploy Azure Stack Hub

Which statement about the Azure Stack Development Kit is accurate?

  1. It supports production workloads with a Microsoft support agreement
  2. It requires a multi-node scale unit
  3. It cannot run the administrator portal
  4. It runs as a single-node deployment on validated hardware Correct answer.

Explanation

The development kit is a single-node deployment that runs on specific validated hardware for evaluation and development. It is not supported for production and does include the administrator portal.

Question 24Plan and deploy Azure Stack Hub

An operator must ensure that tenant workloads cannot exhaust infrastructure capacity. Which control should be configured?

  1. Network security groups
  2. Tenant quotas and plans Correct answer.
  3. Diagnostic settings
  4. Resource tags

Explanation

Quotas and plans limit the resources a subscription can consume, protecting shared stamp capacity. NSGs, tags, and diagnostic settings address traffic filtering, organization, and monitoring rather than consumption limits.

Question 25Plan and deploy Azure Stack Hub

Which factor determines the minimum number of physical nodes in an integrated system?

  1. The certificate validity period
  2. The hardware OEM's validated configuration for the scale unit Correct answer.
  3. The number of tenant subscriptions
  4. The size of the marketplace

Explanation

Each OEM publishes validated configurations that specify the supported node counts and hardware combinations for a scale unit. Subscriptions, marketplace size, and certificate validity do not dictate node minimums.

Question 26Plan and deploy Azure Stack Hub

Which Azure Stack Hub component is responsible for hosting the administrator and user portals and the related management APIs?

  1. The admin and tenant portal services running as part of the infrastructure Correct answer.
  2. The OEM hardware management controller
  3. The Azure Bridge registration agent
  4. The privileged endpoint

Explanation

The portal and management API services are part of the stamp infrastructure and are published through the external DNS namespace so operators and tenants can reach them. The privileged endpoint is a separate just-in-time remote PowerShell surface, not a web front end.

Question 27Plan and deploy Azure Stack Hub

An operator needs to know which account type is used to sign in to the administrator portal of an integrated system that is federated with Microsoft Entra ID.

  1. The OEM factory service account
  2. A local administrator account created during deployment
  3. A tenant user account with the user access administrator role
  4. A Microsoft Entra account holding an owner or contributor role on the registration subscription Correct answer.

Explanation

When the stamp is federated with Microsoft Entra ID, operator sign-in to the admin portal uses Microsoft Entra identities that hold appropriate permissions on the registration subscription. Local accounts are used only for the privileged endpoint and for recovery scenarios.

Question 28Plan and deploy Azure Stack Hub

Which protocol and port are used by the Azure Stack Hub infrastructure to reach Azure for registration and billing?

  1. LDAP over TCP 389
  2. HTTPS over TCP 443 Correct answer.
  3. SNMP over UDP 161
  4. SMB over TCP 445

Explanation

Outbound connectivity to Azure for registration, billing, and marketplace syndication uses HTTPS on TCP 443. Operators must allow this traffic through the egress firewall along with the documented endpoint list.

Question 29Plan and deploy Azure Stack Hub

Which Azure Stack Hub service should an operator use to publish a custom virtual machine image to tenants?

  1. The tenant subscription's resource group
  2. The OEM hardware extension
  3. The privileged endpoint session
  4. The Marketplace Management blade in the administrator portal Correct answer.

Explanation

Operators publish images and marketplace items through the Marketplace Management feature in the administrator portal. Once published, tenants can select those images when creating resources in their subscriptions.

Question 30Plan and deploy Azure Stack Hub

What is the purpose of the region management object created during an integrated system deployment?

  1. It stores tenant virtual network definitions.
  2. It defines the OEM hardware bill of materials.
  3. It controls the update cadence of the physical hosts.
  4. It groups the stamp's scale units and holds regional settings such as the DNS suffix. Correct answer.

Explanation

The region object is the top-level container for a stamp and holds regional properties including the external DNS suffix used by all endpoints. Scale units are created inside the region, and tenant resources are placed in subscriptions under it.

Question 31Plan and deploy Azure Stack Hub

Which Azure Stack Hub feature allows an operator to delegate the creation of offers and plans to a tenant-like organizational unit?

  1. System-assigned managed identities
  2. Azure Policy exemptions
  3. Resource locks on the region
  4. Delegated provider subscriptions Correct answer.

Explanation

Delegated providers are a special subscription type that lets a hosting provider or internal team manage offers and plans on behalf of the stamp owner. They receive their own quotas and can onboard their own customers.

Question 32Plan and deploy Azure Stack Hub

An operator must give a support engineer temporary command-line access to the stamp's infrastructure hosts. Which mechanism should be used?

  1. Open RDP to the ERCS virtual machine permanently
  2. Add the engineer to the Azure subscription owner role
  3. Create a tenant virtual machine with a public IP address
  4. Enable and use the privileged endpoint session Correct answer.

Explanation

The privileged endpoint is the supported just-in-time surface for infrastructure troubleshooting, and sessions expire automatically. Permanent remote access paths to infrastructure hosts are not supported because they weaken the stamp's security posture.

Question 33Plan and deploy Azure Stack Hub

Which statement correctly describes how an operator adds a new plan to an existing offer that tenants are already using?

  1. The plan must be added to the offer and the offer republished for tenants to see the change. Correct answer.
  2. The plan is automatically visible to all tenants without any offer change.
  3. The plan must be added to each tenant subscription individually.
  4. The offer must be deleted and recreated with the new plan.

Explanation

Plans are associated with offers, and changes to an offer's plan set require the offer to be republished before tenants can subscribe to the new plan. Offers are not recreated, and tenants do not need per-subscription configuration.

Question 34Plan and deploy Azure Stack Hub

A planner must choose a DNS name for the stamp's external endpoints. Which constraint applies to that name?

  1. It must be a fully qualified domain name whose suffix the operator controls and that resolves to the stamp's external addresses. Correct answer.
  2. It must match the NetBIOS name of the first physical host.
  3. It must be a single-label name resolvable only inside the corporate network.
  4. It must be identical to the Microsoft Entra tenant's initial domain name.

Explanation

The external DNS suffix must be a domain the operator owns and can create records in, because all portal, API, and administrative endpoints are published beneath it. It also must not collide with names already used elsewhere in the environment.

Question 35Plan and deploy Azure Stack Hub

An operator needs to verify that an integrated system can reach all required Azure endpoints before go-live. Which approach is appropriate?

  1. Ping each Azure public IP address from a tenant virtual machine.
  2. Rely on the OEM's factory test report for connectivity.
  3. Run the Azure Stack Hub readiness checker against the documented endpoint list from the corporate network segment used by the stamp. Correct answer.
  4. Disable the egress firewall during the first week of operation.

Explanation

The readiness checker validates outbound connectivity to the documented Azure endpoints from the network segment that hosts the stamp. This catches proxy, firewall, and certificate interception problems before deployment completes.

Question 36Plan and deploy Azure Stack Hub

An operator wants to offer a virtual machine size that is not present in the default set. What must be done?

  1. Request a quota increase from Azure support.
  2. Add the size to the offer's plan quota definition.
  3. Create a new scale unit that contains the desired hardware.
  4. Create a custom virtual machine size definition through the administrator portal and make it available in plans. Correct answer.

Explanation

Azure Stack Hub lets operators create custom virtual machine sizes and then expose them through plans. The size definitions are stamp-wide objects, and offers control which tenants can use them.

Question 37Plan and deploy Azure Stack Hub

Which action must an operator take before a newly created plan can be included in an offer that tenants can subscribe to?

  1. Assign the plan to a delegated provider.
  2. Publish the plan to the Azure Marketplace.
  3. Create a quota for the plan and delete the default quota.
  4. Set the plan's state to public and add it to the offer's plan list. Correct answer.

Explanation

A plan must be made public and associated with an offer before tenants can access its services. Private plans remain visible only to the operator and delegated providers.

Question 38Plan and deploy Azure Stack Hub

An operator must ensure that a specific tenant cannot create more than a set number of virtual cores across the stamp. Which configuration accomplishes this?

  1. A compute quota attached to the plan the tenant subscribes to Correct answer.
  2. A network security group rule on the tenant's subnet
  3. A resource lock on the tenant's resource group
  4. An Azure Policy assignment in the tenant's subscription

Explanation

Compute quotas limit the number of virtual cores and virtual machines a subscription can consume, and they are applied through the plan. Resource locks, network rules, and policies address different concerns and do not cap core consumption.

Question 39Plan and deploy Azure Stack Hub

Which component of an integrated system must be configured with a certificate whose subject matches the external DNS namespace?

  1. The baseboard management controller
  2. The external endpoints for the administrator and tenant portals and APIs Correct answer.
  3. The OEM hardware extension
  4. The internal backup share

Explanation

The external certificate secures the portal and API endpoints, so its subject and subject alternative names must match the stamp's external DNS suffix. Internal services use separate certificates for their own endpoints.

Question 40Plan and deploy Azure Stack Hub

An operator wants to make a marketplace item available to tenants without requiring the stamp to have live internet access at the moment of download. Which approach should be used?

  1. Enable the Azure Bridge to pull items on demand
  2. Enable automatic syndication and wait for the next update cycle
  3. Download the item to a staging share and publish it from the local blob store Correct answer.
  4. Ask tenants to upload the item to their own storage account

Explanation

Marketplace items can be downloaded ahead of time to a staging location and then published into the stamp's storage, which supports disconnected or bandwidth-constrained environments. Automatic syndication requires connectivity to the Azure Marketplace.

Question 41Plan and deploy Azure Stack Hub

A planner is deciding how many availability sets a tenant workload should use to survive the loss of a single physical host. What should the planner understand about fault domains in Azure Stack Hub?

  1. The number of fault domains equals the number of physical nodes in the scale unit. Correct answer.
  2. Fault domains are limited to two in all configurations.
  3. Fault domains are configured per tenant subscription by the operator.
  4. Each scale unit provides one fault domain regardless of node count.

Explanation

In an Azure Stack Hub scale unit, each physical host is its own fault domain, so the fault domain count matches the node count. Placing virtual machines in an availability set spreads them across those hosts to tolerate a single host failure.

Question 42Plan and deploy Azure Stack Hub

An operator must recover the stamp after a catastrophic failure of the infrastructure. Which element is essential to that recovery?

  1. A recent export of tenant virtual machine disks
  2. The infrastructure backup stored on an external SMB share Correct answer.
  3. A snapshot of the tenant subscription catalog
  4. A copy of the OEM factory image

Explanation

Infrastructure backup captures the stamp's control-plane configuration and is written to an external SMB share so it survives loss of the stamp. Tenant data protection is the tenant's responsibility and is separate from infrastructure recovery.

Question 43Plan and deploy Azure Stack Hub

Which statement describes how the Azure Stack Hub operator should plan for capacity when adding a new tenant workload with predictable growth?

  1. Capacity planning relies on the tenant's own monitoring data alone.
  2. Capacity planning should model CPU, memory, and storage growth against the scale unit's physical limits and reserved infrastructure capacity. Correct answer.
  3. Capacity planning assumes infrastructure reserves no capacity for management services.
  4. Capacity planning uses only the current free cores reported by the administrator portal.

Explanation

Effective planning considers all resource dimensions and accounts for the capacity reserved for infrastructure services. Relying on a single metric or on tenant data alone can lead to oversubscription.

Question 44Plan and deploy Azure Stack Hub

An operator needs to give a tenant access to a plan that includes only a subset of the available services. Which configuration accomplishes this?

  1. Create a plan with only the desired services and quotas, then add it to an offer Correct answer.
  2. Assign the tenant the contributor role on the region
  3. Enable the delegated provider feature for the tenant
  4. Create a resource group in the tenant subscription and apply a policy

Explanation

Plans define which services and quotas a tenant receives, so a plan containing only the desired services limits what the tenant can provision. Offers then present one or more plans to tenants.

Question 45Plan and deploy Azure Stack Hub

An operator is preparing a disconnected Azure Stack Hub deployment. Which planning consideration is most important?

  1. Ensuring the stamp can reach the Azure Marketplace continuously
  2. Relying on Microsoft Entra ID for all operator sign-in
  3. Disabling the privileged endpoint to reduce attack surface
  4. Pre-staging update packages, marketplace items, and certificates through a connected device Correct answer.

Explanation

Disconnected stamps cannot pull updates, marketplace content, or certificates directly, so these artifacts must be brought in through a connected device and staged. Identity may use AD FS in this scenario, and the privileged endpoint remains a required support surface.

Question 46Plan and deploy Azure Stack Hub

An operator observes that a planned deployment fails validation because the external DNS suffix resolves to an address on the corporate network rather than the stamp's external VIP. What is the correct remediation?

  1. Update the external DNS records so the suffix resolves to the stamp's external addresses Correct answer.
  2. Move the stamp's external VIP to the corporate management subnet
  3. Change the stamp's internal DNS forwarders to resolve the suffix locally
  4. Reissue the external certificate with a new subject name

Explanation

Clients must resolve the external namespace to the stamp's published external addresses, so the public DNS records must point there. Internal forwarders and certificate subjects do not correct a misdirected public record.

Question 47Plan and deploy Azure Stack Hub

A stamp owner wants an internal business unit to resell capacity to its own customers while keeping billing and quotas separate. Which design satisfies this requirement?

  1. Grant the business unit the owner role on the default provider subscription
  2. Create a tenant subscription and assign it the user access administrator role
  3. Publish the default offers to the Azure Marketplace
  4. Create a delegated provider subscription with its own plans, offers, and quotas Correct answer.

Explanation

Delegated providers receive their own subscription and can build plans and offers for their customers, with quotas tracked separately from the stamp owner. Sharing the default provider subscription would blur billing and quota boundaries.

Question 48Plan and deploy Azure Stack Hub

An operator must plan certificate rotation for the external endpoints with minimal tenant disruption. Which approach is correct?

  1. Replace the certificate only after it expires and accept an outage
  2. Rotate the certificate by changing the external DNS suffix
  3. Stage the new certificate, validate it with the secret rotation tooling, and rotate before expiry Correct answer.
  4. Rotate the certificate by redeploying the scale unit

Explanation

Certificate rotation uses the stamp's secret rotation tooling, which validates the new certificate before it replaces the active one, avoiding an outage. Rotation does not require redeploying the scale unit or changing the DNS namespace.

Question 49Plan and deploy Azure Stack Hub

A planner is evaluating whether a single scale unit can meet a workload that requires host-level anti-affinity across four independent hosts. What should the planner verify?

  1. That the workload is placed in a single virtual network
  2. That the tenant subscription has the contributor role on the region
  3. That the scale unit contains at least four physical nodes and the workload uses an availability set Correct answer.
  4. That the stamp is registered with a Microsoft Entra tenant

Explanation

Because each node in a scale unit is a separate fault domain, spreading virtual machines across four hosts requires at least four nodes and an availability set. Network placement and subscription roles do not affect host-level anti-affinity.

Question 50Plan and deploy Azure Stack Hub

Which Azure Stack Hub component exposes the operator and tenant portals and the Azure Resource Manager endpoints to users outside the stamp?

  1. The privileged endpoint
  2. The external-facing VIPs configured on the hardware load balancer Correct answer.
  3. The baseboard management controller network
  4. The OEM hardware management virtual machine

Explanation

Users reach the portals, Azure Resource Manager, and other services through externally published virtual IP addresses that the hardware load balancer presents on the public network. The privileged endpoint and the baseboard management controller network are restricted to operator and hardware-management traffic respectively.