AI-102 Plan and manage an Azure AI solution Practice Test 10 — 15 Questions

Question 1

You are deploying an Azure AI solution that uses Azure Cognitive Services for multiple applications. You need to ensure that the solution meets compliance requirements for data residency and that API keys are not exposed in source code. Which two actions should you take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Store API keys in Azure Key Vault and access them using managed identities.. Deploying resources in the required regions ensures data residency, and storing API keys in Key Vault with managed identities prevents key exposure. These two actions directly address the compliance requirements. The other options are either complementary or do not fully meet the stated needs.

Answer

Configure a private endpoint for each Cognitive Services resource to ensure data does not leave the virtual network.

Answer

Enable Azure AD authentication for all Cognitive Services and disable key-based authentication.

Answer

Use Azure Policy to enforce that only allowed regions can be used for resource deployment.

Question 2

You are planning to deploy an Azure AI solution that uses Azure OpenAI Service. You need to ensure that the solution can be managed centrally and that access to the service is controlled via Azure role-based access control (RBAC). What should you do?

Accepted Answer

Deploy Azure OpenAI Service as a separate resource and assign the Cognitive Services OpenAI User role to the developers.. Deploying Azure OpenAI as a separate resource enables centralized management and Azure RBAC. Assigning the Cognitive Services OpenAI User role provides developers with the necessary permissions to use the service without excessive privileges, meeting both requirements.

Answer

Deploy Azure OpenAI Service as part of a multi-service Azure AI Services resource and assign the Cognitive Services Contributor role to the developers.

Answer

Deploy Azure OpenAI Service as a separate resource and assign the Owner role to the developers.

Answer

Deploy Azure OpenAI Service as a separate resource and use API keys for authentication instead of Azure RBAC.

Question 3

You are building an Azure AI solution that uses Azure AI Search, Azure OpenAI, and Azure AI Document Intelligence. The solution must log all API calls for auditing, and the logs must be retained for seven years and be queryable by using Kusto Query Language. You need to configure diagnostic settings for each service. What should you do?

Accepted Answer

Send diagnostic logs to an Azure Log Analytics workspace and set the retention period on the workspace to seven years.. Routing diagnostic settings to an Azure Log Analytics workspace is the only option that supports seven-year retention and native Kusto Query Language querying. Diagnostic settings capture the data-plane API calls for each Azure AI service, and the workspace retention setting controls how long the logs remain queryable. The other destinations either cannot be queried with KQL or do not retain data for the required period.

Answer

Send diagnostic logs to an Azure Storage account and set a lifecycle management policy to retain blobs for seven years.

Answer

Enable Azure Monitor activity logs on each service and export them to an Azure Cosmos DB account with a seven-year time-to-live.

Answer

Send diagnostic logs to an Azure Event Hubs namespace and use Stream Analytics to query the data with SQL.

Question 4

You are managing an Azure AI solution that uses Azure OpenAI Service. You need to monitor the usage and ensure that the solution can scale automatically based on demand. What should you do?

Accepted Answer

Deploy multiple Azure OpenAI resources and use Azure API Management to load balance and scale requests.. Azure OpenAI Service does not provide automatic scaling of the resource itself. To handle variable demand, you can deploy multiple instances and use Azure API Management to route and balance requests. API Management can also provide additional policies like retry and caching. This approach enables horizontal scaling and high availability.

Answer

Use Azure Monitor to track metrics and set up alerts, and adjust provisioned throughput units manually as needed.

Answer

Configure autoscaling for the Azure OpenAI resource based on CPU usage.

Answer

Enable autoscaling on the underlying App Service plan that hosts the Azure OpenAI endpoint.

Question 5

You are deploying an Azure AI Language resource using an ARM template. You need to ensure that the resource can be accessed by other Azure services without using keys. What should you do?

Accepted Answer

Enable a system-assigned managed identity for the Azure AI Language resource and grant it access to the required services.. Using a managed identity for the Azure AI Language resource enables keyless authentication to other Azure services. You assign the identity the appropriate permissions. This is secure and eliminates the need to manage keys. The other options either use keys (SAS or subscription key) or propose an unsupported feature (anonymous access).

Answer

Generate a shared access signature (SAS) token for the Azure AI Language resource and provide it to the other services.

Answer

Store the Azure AI Language subscription key in Azure Key Vault and have the other services retrieve it.

Answer

Configure the Azure AI Language resource to allow anonymous access.

Question 6

You are building an Azure AI solution that uses Azure AI Vision to analyze images. The solution must be deployed to an Azure Kubernetes Service (AKS) cluster to meet data residency requirements. You need to ensure that the Vision API calls are authenticated. What should you use?

Accepted Answer

Azure AI Vision container with API key authentication from Azure Key Vault.. To meet data residency, you must run Azure AI Vision locally using its Docker container on AKS. The container authenticates using an API key from the Azure AI Vision resource. Storing that key in Azure Key Vault and injecting it into the container is the secure, supported pattern. Cloud endpoints or unsupported authentication methods fail the residency or technical requirements.

Answer

Azure AI Vision cloud endpoint with API key authentication from Azure Key Vault.

Answer

Azure AI Vision container with Azure Active Directory token authentication.

Answer

Azure AI Vision cloud endpoint with managed identity authentication.

Question 7

You are deploying an Azure AI solution that uses Azure Cognitive Services for multiple applications. You need to ensure that the solution meets compliance requirements for data residency and that API keys are not exposed in source code. Which two actions should you take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the Document Intelligence resource as a container in Azure Kubernetes Service (AKS) and configure horizontal pod autoscaling based on request volume.. Deploying Document Intelligence as a container on AKS allows you to leverage Kubernetes autoscaling to dynamically adjust the number of pods based on request volume. When there is no traffic, you can scale down to zero, eliminating costs during idle periods. This approach provides near real-time processing and cost efficiency. While it requires managing the AKS cluster, it offers the flexibility and scalability needed for the scenario.

Answer

Use the Document Intelligence Standard S0 tier and configure Azure API Management to cache responses to reduce the number of calls.

Answer

Use the Document Intelligence free tier (F0) for development and the Standard S0 tier for production, and implement a queue-based load leveling pattern.

Answer

Deploy the Document Intelligence resource with the Standard S0 tier and configure autoscaling based on CPU usage.

Question 8

You are deploying an Azure AI solution that uses Azure Cognitive Services for multiple applications. You need to ensure that the solution meets compliance requirements for data residency and that API keys are not exposed in source code. Which two actions should you take? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the account to require secure transfer and set the minimum TLS version to 1.2.. Enforcing a minimum TLS version at the Azure AI services account ensures that the service itself rejects connections using older protocols. Requiring secure transfer complements this by ensuring requests use HTTPS. Together these settings satisfy the requirement without relying on client-side configuration, which could be bypassed or misconfigured.

Answer

Enable Azure Defender for the Azure AI services account.

Answer

Configure a private endpoint for the Azure AI services account.

Answer

Store the account key in Azure Key Vault and rotate it every 30 days.

Question 9

You are planning the deployment of an Azure AI solution that uses Azure OpenAI, Azure AI Vision, and Azure AI Language. The solution must be provisioned repeatably across three environments by using infrastructure as code, and the deployment must support rollback to a previous known-good state. You need to select the deployment approach. Which two actions should you take? (Choose two.)

Accepted Answer

Define the Azure AI resources in a Bicep template and deploy the template by using the Azure CLI az deployment group create command.. Repeatable provisioning with rollback is achieved by defining resources declaratively in Bicep and storing those templates in a Git repository with pull request reviews. The Bicep template ensures consistent deployment across environments, and the Git history provides the ability to redeploy a previous known-good version. Manual portal configuration and imperative scripts lack the declarative guarantees needed for reliable rollback.

Answer

Deploy the resources by using the Azure AI services REST API from a custom PowerShell script that reads a JSON parameter file.

Answer

Use the Azure portal to configure each environment and document the settings in a shared spreadsheet for the operations team.

Answer

Create each Azure AI resource manually in the Azure portal and export the resource group as an ARM template after validation.

Question 10

You are planning to deploy an Azure AI solution that uses Azure Cognitive Search and Azure OpenAI Service. The solution must ensure that the search index is updated in near real-time when new documents are added to Azure Blob Storage, and that the OpenAI model can retrieve relevant context from the index. Which two actions should you take? (Choose two.)

Accepted Answer

Use Azure Cognitive Search's integrated vectorization to create embeddings for the documents.. To achieve near real-time indexing, use an indexer with a blob data source and a frequent schedule. Integrated vectorization automatically creates embeddings, enabling vector search so the OpenAI model can retrieve relevant context. Together, these actions provide a scalable and maintainable solution for retrieval-augmented generation.

Answer

Configure Azure Cognitive Search to use a custom skill that calls Azure OpenAI to generate summaries for each document.

Answer

Enable Azure OpenAI's fine-tuning feature to train the model on the documents in Blob Storage.

Answer

Deploy an Azure Function that triggers on blob creation and calls the Azure Cognitive Search REST API to update the index.

Question 11

You are planning an Azure AI solution that uses multiple Azure AI services, including Azure AI Language and Azure AI Vision. You need to ensure that the solution can be deployed across multiple regions and that the services are managed centrally. You also need to minimize administrative effort. Which TWO actions should you take? (Choose two.)

Accepted Answer

Create a single Azure AI Services multi-service resource and deploy it to multiple regions.. To minimize administrative effort while deploying across regions and managing centrally, use a multi-service Azure AI Services resource deployed to multiple regions. This consolidates multiple services under one resource. Additionally, use Azure Policy to enforce regional restrictions, ensuring governance without manual oversight. Other options either increase effort or do not address central management.

Answer

Configure each AI service to use a different resource group for billing separation.

Answer

Use Azure Front Door to route requests to the nearest regional endpoint.

Answer

Create separate Azure AI Language and Azure AI Vision resources in each region.

Question 12

You are managing an Azure AI services multi-service account that is used by several applications. You need to provide a specific application with access only to the Azure AI Language features, while preventing it from using Azure AI Vision features on the same account. The application authenticates with a managed identity. What should you do?

Accepted Answer

Create a custom role that allows only the Language data actions and assign it to the managed identity.. Azure RBAC built-in roles for Azure AI services are broad and typically grant access to all services in a multi-service account. To restrict an identity to a subset of data actions, you must define a custom role that lists only the allowed operations and assign it at the account scope. This provides the granularity needed to permit Language calls while denying Vision calls.

Answer

Create a separate Azure AI Language resource and assign the managed identity the Cognitive Services User role on that resource.

Answer

Assign the Cognitive Services User role to the managed identity at the account scope.

Answer

Disable local authentication on the account and assign the Reader role to the managed identity.

Question 13

You are designing an Azure AI solution that uses Azure OpenAI and Azure AI Search. The security team requires that all client applications authenticate by using Microsoft Entra ID, that the solution restrict access to specific users in a security group, and that the search index contain only documents the user is authorized to see. You need to implement the authorization model. What should you do?

Accepted Answer

Assign the Cognitive Services User role to each user and filter search results by using security filters in Azure AI Search based on the user's group membership.. Per-user authentication with Microsoft Entra ID requires assigning data-plane roles to users, and document-level authorization in Azure AI Search is implemented through security filters that reference the user's group membership. Together these meet the requirements for identity-based authentication and restricted document visibility. The other options either use shared credentials or apply controls that do not filter documents at query time.

Answer

Enable Microsoft Entra ID authentication on Azure OpenAI and use Azure AI Search synonyms to restrict results by user department.

Answer

Configure Azure OpenAI to use a managed identity and enable Azure AI Search indexer-level access control by using an Azure Storage shared access signature.

Answer

Issue a shared API key to each user and configure Azure AI Search to use role-based access control on the index.

Question 14

You need to monitor costs for an Azure AI solution that uses multiple Azure AI services. Which Azure tool should you use to set budgets and receive alerts?

Accepted Answer

Azure Cost Management. Azure Cost Management is the dedicated Azure tool for setting budgets, defining cost thresholds, and configuring alerts when spending exceeds those limits. It provides detailed cost analysis, forecasting, and policy enforcement across all Azure services, including AI services like Cognitive Services and Azure Machine Learning.

Answer

Azure Advisor

Answer

Azure Monitor

Answer

Azure Service Health

Question 15

You are designing an Azure AI solution that uses Language Understanding (LUIS) for intent detection. The solution must handle multiple languages dynamically based on the user's locale. What should you do?

Accepted Answer

Create separate LUIS applications for each language and route based on locale.. LUIS does not natively support multi-language within a single application; each LUIS app is designed for a single language. To handle multiple languages dynamically, you must create separate LUIS applications for each language and route user utterances based on the detected locale, ensuring accurate intent and entity recognition per language.

Answer

Use Azure Translator to translate user input to English before sending to LUIS.

Answer

Train a single LUIS app with utterances in all languages.

Answer

Enable the 'Multi-Language' feature in the LUIS app.