Configuring and Operating a Hybrid Cloud with Microsoft Azure Stack Hub

 

Candidates for this exam have subject matter expertise in providing infrastructure as a service (IaaS) and platform as a service (PaaS) offering to end users or customers from within their own datacenter using Azure Stack Hub. Their responsibilities are to plan, deploy, update, and maintain the Azure Stack Hub infrastructure. They also configure resources, manage infrastructure capacity, and optimize the services that run in Azure Stack Hub. Professionals in this role work with teams that support datacenter infrastructure, teams that manage identity, and teams that consume Azure Stack Hub resources, including developers, DevOps engineers, and virtual infrastructure administrators.
 

As an exam candidate, you should have significant experience managing and operating Azure Stack Hub environments. You should have a strong understanding of Azure, in addition to some knowledge of virtualization, networking, and identity management. You will also need to understand how Azure Stack Hub enables DevOps processes and the hybrid development model.
 

Plan and deploy Azure Stack Hub (30—35%) Plan an Azure Stack Hub deployment

• Recommend a deployment model for a specific scenario
• Recommend a name resolution strategy
• Define fully qualified domain name (FQDN) and region name
• Recommend a public and internal IP strategy
• Define static routes or Border Gateway Protocol (BGP) configuration
• Recommend a datacenter firewall integration strategy
• Choose between Azure Active Directory (Azure AD) and Active Directory Federation Services (AD FS)
• Validate identity provider and network by using the Azure Stack Hub Readiness Checker tool
• Select a billing model

Plan and implement infrastructure certificates for Azure Stack Hub

• Choose between an Enterprise certificate authority (CA) and a public certificate
• Prepare certificates for Azure Stack Hub
• Import certificates
• Export PFX files
• Prepare folder structure
• Validate certificates by using the Azure Stack Hub Readiness Checker tool
• Rotate secrets for certificates

Manage Azure Stack Hub registration and billing

• Recommend a registration model
• Register in a connected environment
• Register in a disconnected environment
• Validate Azure Stack Hub registration
• Refresh Azure Stack Hub registration
• Set up usage data reporting
• View and retrieve usage data by using the usage API
• Manage usage and billing in multitenant and cloud solution provider (CSP) scenarios

Set up management environment

• Obtain and connect to Azure Resource Manager endpoints
• Download and deploy Operator Access Workstation
• Install PowerShell modules for Azure Stack Hub
• Enable Azure CLI for Azure Stack Hub users
• Download and deploy Azure Stack PowerShell tools
• Add relevant environment based on a scenario
• Enable the Emergency VM Access Service (EVA)

Provide services (20—25%) Manage Azure Stack Hub Marketplace

• Populate Azure Stack Hub Marketplace from a connected environment
• Populate Azure Stack Hub Marketplace in a disconnected environment
• Create a custom Azure Stack Hub Marketplace item
• Manage the lifecycle for Azure Stack Hub Marketplace items
• Create an ARM template

Offer the Azure App Service resource provider

• Plan the App Service resource provider deployment
• Deploy the App Service resource provider
• Update the App Service resource provider
• Scale roles based on capacity requirements
• Rotate App Service secrets and certificates
• Manage and monitor worker tiers
• Back up App Service resource provider, including SQL databases, file server share, and secrets

Offer the Azure Event Hubs resource provider

• Plan an Event Hubs resource provider deployment
• Deploy an Event Hubs resource provider
• Update an Event Hubs resource provider
• Rotate Event Hubs secrets and certificates

Offer services

• Create and manage quotas
• Create and manage plans
• Create and manage offers
• Create and manage user subscriptions
• Change user subscription owner

Manage infrastructure (40—45%) Manage identity and access

• Assign users and groups in Azure Stack Hub
• Grant an app access to resources
• Define a custom role in Azure AD for delegating Azure Stack Hub management tasks to users
• Register a tenant directory with Azure Stack Hub
• Update a tenant directory
• Unregister a tenant directory

Monitor and maintain system health

• Monitor system health by using the administrator portal
• Monitor system health by using PowerShell
• Monitor system health by using the REST API
• Respond to and manage alerts
• Validate health and system status by using Test-AzureStack
• Monitor Azure Stack Hub infrastructure certificates
• Collect diagnostic logs on demand by using the administrator portal
• Collect diagnostic logs on demand by using the privileged endpoint
• Configure automatic diagnostic log collection
• Configure syslog forwarding for Azure Stack Hub infrastructure

Plan and configure business continuity and disaster recovery (BCDR)

• Retrieve BitLocker recovery keys
• Recommend a BCDR strategy
• Recommend a solution for tenant backups
• Choose a method for infrastructure backups
• Configure storage target for infrastructure backups
• Configure certificates for infrastructure backups
• Configure frequency and retention policy for infrastructure backups
• Test backup and restore of infrastructure by using Azure Stack Development Kit
• Enable backup by using PowerShell
• Validate success status of backup

Perform node and system-wide operations

• Add nodes
• Manage storage capacity by reclaiming space or rebalancing
• Add IP pools
• Stop and start Azure Stack Hub
• Perform node operations, including start, stop, resume, repair, drain, and shutdown
• Configure Time Server (NTP)
• Configure syslog server
• Configure DNS server
• Update Azure Stack Hub, including scheduling, deploying, monitoring, and troubleshooting
• Update Azure AD home directory

Configure and use privileged endpoints

• Connect to a privileged endpoint
• Configure the cloud admin user role
• Unlock a support session
• Close the session on the privileged endpoint