AZ-220 Microsoft Azure IoT Developer Questions and Answers

https://docs.microsoft.com/en-us/azure/iot-edge/deploy-modbus-gateway

Automatic device management in Azure IoT Hub automates many of the repetitive and complex tasks of managing large device fleets. With automatic device management, you can target a set of devices based on their properties, define a desired configuration, and then let IoT Hub update the devices when they come into scope. This update is done using an automatic device configuration or automatic module configuration, which lets you summarize completion and compliance, handle merging and conflicts, and roll out configurations in a phased approach.

Create an endpoint for Azure Digital Twins.

These are the supported types of endpoints that you can create for your instance:

• Event Grid
• Event Hubs
• Service Bus

Note: In Azure Digital Twins, you can route event notifications to downstream services or connected compute resources. This is done by first setting up endpoints that can receive the events. You can then create event routes that specify which events generated by Azure Digital Twins are delivered to which endpoints.

B: X.509 certificates are typically arranged in a certificate chain of trust. If a certificate at any stage in a chain becomes compromised, trust is broken. The certificate must be blacklisted to prevent Device Provisioning Service from provisioning devices downstream in any chain that contains that certificate.

C: Individual enrollments apply to a single device and can use either X.509 certificates or SAS tokens (in a real or virtual TPM) as the attestation mechanism. (Devices that use SAS tokens as their attestation mechanism can be provisioned only through an individual enrollment.) To blacklist a device that has an individual enrollment, you can either disable or delete its enrollment entry.

To blacklist a device that has an individual enrollment, you can either disable or delete its enrollment entry. Reference:

https://docs.microsoft.com/en-us/azure/iot-dps/how-to-revoke-device-access-portal

An enrollment is the record of devices or groups of devices that may register through auto-provisioning. The enrollment record contains information about the device or group of devices, including:

the attestation mechanism used by the device

the optional initial desired configuration desired IoT hub

the desired device ID

Note: Azure IoT auto-provisioning can be broken into three phases:

1.Service configuration - a one-time configuration of the Azure IoT Hub and IoT Hub Device Provisioning Service instances, establishing them and creating linkage between them.

2.Device enrollment - the process of making the Device Provisioning Service instance aware of the devices that will attempt to register in the future. Enrollment is accomplished by configuring device identity information in the provisioning service, as either an "individual enrollment" for a single device, or a "group enrollment" for multiple devices.

3.Device registration and configuration

Consider using jobs when you need to schedule and track progress any of the following activities on a set of devices:

• Invoke direct methods
• Update desired properties
• Update tags

Step: With DPS (Device Provisioning Service) you can generate device credentials and configure the devices offline without registering the devices through IoT Central UI.

Connect devices that use SAS tokens without registering

1. Copy the IoT Central application's group primary key

2. Use the dps-keygen tool to generate the device SAS keys. Use the group primary key from the previous step. The device IDs must be lower-case:

dps-keygen -mk: -di:

3. The OEM flashes each device with a device ID, a generated device SAS key, and the application ID scope value.

4. When you switch on a device, it first connects to DPS to retrieve its IoT Central registration information.

The device initially has a device status Unassociated on the Devices page and isn't assigned to a device template. On the Devices page, Migrate the device to the appropriate device template. Device provisioning is now complete, the device status is now Provisioned, and the device can start sending data.

On the Administration > Device connection page, the Auto approve option controls whether you need to manually approve the device before it can start sending data.

The device telemetry category tracks errors that occur at the IoT hub and are related to the telemetry pipeline. This category includes errors that occur when sending telemetry events (such as throttling) and receiving telemetry events (such as unauthorized reader). This category cannot catch errors caused by code running on the device itself.

Note: The metric d2c.telemetry.ingress.sendThrottle is the number of throttling errors due to device throughput throttles.

Box 1: Cert2 only

Cert2: The leaf certificate, or end-entity certificate, identifies the certificate holder. It has the root certificate in its certificate chain as well as zero or more intermediate certificates. The leaf certificate is not used to sign any other certificates. It uniquely identifies the device to the provisioning service and is sometimes referred to as the device certificate.

Box 2: Cert1 only

Cert1: A root certificate is a self-signed X.509 certificate representing a certificate authority (CA). It is the terminus, or trust anchor, of the certificate chain. Root certificates can be self-issued by an organization or purchased from a root certificate authority.

Example: $event['p1'] != NULL

['p1'] is the only token used. Interpreted as $event['p1'].Double != NULL

Each device uses its derived device key with your unique registration ID to perform symmetric key attestation with the enrollment during provisioning. To generate the device key, use the key you copied from your DPS

enrollment to compute an HMAC-SHA256 of the unique registration ID for the device and convert the result into Base64 format.

Box 1: "desired": {

To configure connection events as high priority and collect high priority events every 7 minutes, use the following configuration.

"desired": {

"ms_iotn:urn_azureiot_Security_SecurityAgentConfiguration": {

"highPriorityMessageFrequency": {

"value": "PT7M"

},

"eventPriorityConnectionCreate": {

"value": "High"

}

Box 2: "highPriorityMessageFrequency ": {

Box 3: "eventPriorityConnectionCreate": {

Devices use telemetry to send numerical data from the device. A rule triggers when the selected telemetry crosses a specified threshold.

E: To create a telemetry rule, the device template must include at least one telemetry value. The rule monitors the temperature reported by the device and sends an email when it falls below 400 degrees.

B: Configure the rule conditions.

Conditions define the criteria that the rule monitors. In this tutorial, you configure the rule to fire when the temperature exceeds 70° F.

1. Select Temperature in the Telemetry dropdown.

2. Next, choose Is less than as the Operator and enter 400 as the Value.

3. Optionally, you can set a Time aggregation. When you select a time aggregation, you must also select an aggregation type, such as average or sum from the aggregation drop-down.

• Without aggregation, the rule triggers for each telemetry data point that meets the condition.
• With aggregation, the rule triggers if the aggregate value of the telemetry data points in the time window meets the condition.

Scenario: POV Requirements

Ensure that all message content during this phase is human readable to simplify debugging.

Avro uses a binary format, so it is not human readable.

The more lightweight JSON (Javascript object notation) has become a popular alternative to XML for various reasons. A couple obvious ones are:

Less verbose- XML uses more words than necessary

JSON is faster- Parsing XML software is slow and cumbersome.

Scenario: You discover connectivity issues between the IoT gateway devices and iothub1, which cause IoT devices to lose connectivity and messages.

To synchronize state information between a device and an IoT hub, you use device twins. A device twin is a JSON document, associated with a specific device, and stored by IoT Hub in the cloud where you can query them. A device twin contains desired properties, reported properties, and tags.

Box 1: iothub1

The Azure IoT hub is named iothub1.

Box 2: azure-devices.net

The format of the device connection string looks like:

HostName={YourIoTHubName}.azure-devices.net;DeviceId=MyNodeDevice;SharedAccessKey={YourSharedAccessKey}

Box 1: device1

Device1 has a primary key of Uihuih76hbHb.

Box 1: ID Scope

In the Azure portal, select the Overview blade for your Device Provisioning service and copy the ID Scope value. The ID Scope is generated by the service and guarantees uniqueness. It is immutable and used to uniquely identify the registration IDs.

Box 2: Global device endpoint

The global_prov_uri variable, which allows the IoT Hub client registration API IoTHubClient_LL_CreateFromDeviceAuth to connect with the designated Device Provisioning Service instance.

Example code:

static const char* global_prov_uri = "global.azure-devices-provisioning.net";

static const char* id_scope = "[ID Scope]";

Create a dedicated consumer group in the IoT hub for the Time Series Insights environment to consume from. Each Time Series Insights event source must have its own dedicated consumer group that isn't shared with any other consumer. If multiple readers consume events from the same consumer group, all readers are likely to exhibit failures.

Scenario: You discover connectivity issues between the IoT gateway devices and iothub1, which cause IoT devices to lose connectivity and messages.

To log device connection events and errors, turn on diagnostics for IoT Hub. We recommend turning on these logs as early as possible, because if diagnostic logs aren't enabled, when device disconnects occur, you won't have any information to troubleshoot the problem with.

Step 1:

1.Sign in to the Azure portal.

2.Browse to your IoT hub.

3.Select Diagnostics settings.

4.Select Turn on diagnostics.

5.Enable Connections logs to be collected.

6.For easier analysis, turn on Send to Log Analytics (see pricing).

Step 2:

Set up alerts for device disconnect at scale

To get alerts when devices disconnect, configure alerts on the Connected devices (preview) metric.

Scenario: You plan to use a 30-second period to calculate the average temperature reading of the sensors.

Tumbling window functions are used to segment a data stream into distinct time segments and perform a function against them, such as the example below. The key differentiators of a Tumbling window are that they repeat, do not overlap, and an event cannot belong to more than one tumbling window.

InAnswers:

A: Hopping window functions hop forward in time by a fixed period. It may be easy to think of them as Tumbling windows that can overlap, so events can belong to more than one Hopping window result set.

IoT Hub is one of the first Azure services to support distributed tracing. As more Azure services support distributed tracing, you'll be able trace IoT messages throughout the Azure services involved in your solution.

Note:

Enabling distributed tracing for IoT Hub gives you the ability to:

Precisely monitor the flow of each message through IoT Hub using trace context. This trace context includes correlation IDs that allow you to correlate events from one component with events from another component. It can be applied for a subset or all IoT device messages using device twin.

Automatically log the trace context to Azure Monitor diagnostic logs.

Measure and understand message flow and latency from devices to IoT Hub and routing endpoints. Start considering how you want to implement distributed tracing for the non-Azure services in your IoT solution.