AI-102 Plan and manage an Azure AI solution Practice Test 8 — 15 Questions

Question 1

Your company uses Azure AI Search to power a customer-facing product catalog search. The search index contains product data from Azure SQL Database. The indexer runs daily. Lately, users complain that new products appear in the catalog with a delay of up to 24 hours. The business requires near real-time indexing (within minutes) for new products. You have the following constraints: - The indexer must continue to run daily for full sync. - You need to minimize changes to the existing architecture. - You cannot use Azure Functions or Logic Apps due to cost. What should you do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a high-water mark change detection policy (e.g., based on a LastModified column) to the indexer data source. Set the indexer to run every 5 minutes.. It uses a high-water mark change detection policy (e.g., based on a LastModified column) to identify only new or updated records since the last indexer run. By setting the indexer to run every 5 minutes, you achieve near real-time indexing without changing the existing architecture or incurring additional costs from Azure Functions or Logic Apps. The daily full sync continues to run as scheduled, ensuring consistency.

Answer

Enable change tracking on the Azure SQL Database and configure the indexer to use it.

Answer

Modify the application to use the push API to upload new products to the index as they are added.

Answer

Remove the daily indexer schedule and instead trigger the indexer manually after each new product insertion.

Question 2

You are designing a solution that uses Azure OpenAI Service to generate product descriptions based on product attributes (name, category, features). The solution must: - Use a GPT-4 model deployed in the West US region. - Implement content filtering to block inappropriate content. - Handle up to 100 requests per second. - Minimize latency. - Use managed identity for authentication. What should you include in the design?

Accepted Answer

Deploy a single GPT-4 model with sufficient capacity (e.g., 100K TPM). Enable content filtering. Use a system-assigned managed identity for authentication.. Deploying a single GPT-4 model with sufficient capacity (e.g., 100K TPM) ensures the solution can handle up to 100 requests per second while minimizing latency by avoiding cross-region calls. Enabling content filtering directly on the Azure OpenAI deployment blocks inappropriate content without additional services, and using a system-assigned managed identity provides secure, keyless authentication that aligns with Azure best practices.

Answer

Deploy multiple GPT-4 models across different regions to reduce latency.

Answer

Use API key authentication stored in Azure Key Vault. Deploy two GPT-4 models to load balance requests.

Answer

Use Azure AI Content Safety in addition to Azure OpenAI to filter content.

Question 3

Your company has an existing Azure AI Search index used for e-commerce product search. The index is populated by an indexer that runs every hour. Recently, the product team added a new field 'promotionPrice' that should be searchable. You need to update the index to include this field without reindexing all documents. The field should be of type Edm.Double, searchable, filterable, and sortable. What should you do?

Accepted Answer

Update the index schema to add the new field using the portal or REST API. Then update the indexer to map the field.. Azure AI Search allows you to add new fields to an existing index schema without reindexing all documents, as long as the new field is nullable or has a default value. After updating the index schema via the portal or REST API, you must update the indexer's field mappings to map the new 'promotionPrice' field from the data source to the index. The indexer will then populate the field for existing documents on its next run, and new documents will include the field automatically.

Answer

Add the new field to the data source mapping in the indexer. The indexer will automatically update the index schema.

Answer

Change the indexer schedule to run every 5 minutes to pickup the new field faster.

Answer

Delete the index and recreate it with the new field. Then run the indexer to repopulate all documents.

Question 4

You are deploying an Azure AI solution that includes an Azure AI Services multi-service resource and several individual Azure AI services. The solution must enforce network-level access restrictions so that only clients originating from a specific virtual network subnet can access the resource. You need to configure the Azure AI Services resource to meet this requirement. What should you do?

Accepted Answer

Add a private endpoint to the Azure AI Services resource and disable public network access.. Using a private endpoint with public network access disabled ensures that the Azure AI Services resource is accessible only from the specified virtual network subnet. This is the standard method for network isolation in Azure AI Services. Other options address authentication, key management, or web security but do not restrict access based on network origin.

Answer

Configure the Azure AI Services resource to use a managed identity and assign the identity the Cognitive Services User role.

Answer

Enable key-based authentication and rotate the keys regularly.

Answer

Set the Azure AI Services resource to use a custom domain and enable CORS for the subnet.

Question 5

You are deploying an Azure AI solution that uses several Azure AI services, including Azure AI Language and Azure AI Vision. Developers in your organization must be able to access these services from their local development machines without storing service keys in source code. You need to configure authentication that provides centralized credential management and supports role-based access control (RBAC). The solution must minimize administrative effort. What should you use?

Accepted Answer

Enable managed identities for the Azure AI services and assign the required roles to each developer's user account.. Using managed identities for Azure AI services and assigning RBAC roles to developers allows them to authenticate without handling secrets. This centralizes access control and minimizes administrative effort because no keys are stored or rotated. The other options either rely on static secrets, unsupported mechanisms, or insecure practices.

Answer

Configure each Azure AI service to use a shared access signature (SAS) token that developers include in their API calls.

Answer

Store the service keys in Azure Key Vault and have developers retrieve them at runtime using their personal Microsoft accounts.

Answer

Embed the service keys in a configuration file that is deployed with the application and restrict access to the file using NTFS permissions.

Question 6

You are deploying a new Azure AI services multi-service resource in Microsoft Foundry. The security team requires that all access keys be rotated automatically every 90 days without modifying application code. You need to configure the resource to meet this requirement while minimizing administrative effort. What should you do?

Accepted Answer

Configure Azure Key Vault to store the access keys and set up a rotation policy that regenerates the keys every 90 days.. Storing the access keys in Azure Key Vault and configuring a rotation policy automates the regeneration of keys on a 90-day schedule. Applications read the current key from Key Vault, so they continue to work without code changes. This approach leverages a native Azure feature designed for secret lifecycle management, reducing administrative effort and meeting the security team's requirement.

Answer

Enable managed identity for the Azure AI services resource and grant it access to Azure Key Vault.

Answer

Use Azure Automation to run a runbook that calls the Azure AI services management API to regenerate keys every 90 days.

Answer

Deploy the Azure AI services resource with two access keys and instruct developers to switch to the secondary key every 90 days.

Question 7

You are planning a solution that uses Azure AI Search to index documents from an Azure Blob Storage container. The solution must ensure that the search index is updated automatically when documents are added or modified. You need to configure an indexer. What should you do?

Accepted Answer

Create a scheduled indexer that runs every 5 minutes and uses a change detection policy based on the LastModified timestamp.. Azure AI Search indexers support scheduled execution and change detection policies. For Azure Blob Storage, the built-in change detection policy using the LastModified timestamp allows the indexer to identify new and updated blobs. Scheduling the indexer ensures that changes are picked up automatically without manual intervention.

Answer

Create a custom skill that queries the blob container for changes and updates the index.

Answer

Configure an Event Grid subscription on the blob container to trigger an Azure Function that calls the Azure AI Search REST API to update the index.

Answer

Enable soft delete on the blob container and set the indexer to run continuously.

Question 8

You are designing an Azure AI solution that uses Azure OpenAI Service. The solution must ensure that all data processed by the service is not used to improve the models and that the data is stored only within a specific geographic region. What should you do?

Accepted Answer

Deploy the Azure OpenAI resource in the desired region and use the default configuration, as Azure OpenAI does not use customer data for model training.. Azure OpenAI Service does not use customer data to train or improve its models by default. Deploying the resource in the desired region ensures data residency. Therefore, using the default configuration meets both requirements without additional settings.

Answer

Use a custom model with your own training data and host it on Azure Kubernetes Service.

Answer

Enable 'Customer Managed Keys' and 'Private Endpoints' on the Azure OpenAI resource.

Answer

Deploy the Azure OpenAI resource in the desired region and enable 'No data retention' in the resource settings.

Question 9

You are configuring network security for an Azure AI services resource that will be accessed by an application running on an Azure Virtual Machine. The solution must ensure that the AI service is not accessible from the public internet and that only the virtual machine can access it. You need to configure the networking settings. Which two actions should you take? (Choose two.)

Accepted Answer

Configure the AI services resource to use a private endpoint.. To ensure the AI service is not accessible from the public internet and only the VM can access it, you should use a private endpoint and restrict the firewall to the VNet subnet. The private endpoint provides a private IP for the service, and the firewall rule adds an extra layer by allowing only that subnet. Together, they meet the security requirements.

Answer

Assign a public IP address to the virtual machine and add it to the AI service's allowed IP list.

Answer

Create a network security group (NSG) rule to allow outbound traffic from the VM to the AI service's public endpoint.

Answer

Enable Azure DDoS Protection on the virtual network.

Question 10

You are developing an Azure AI solution that uses Azure OpenAI Service. You need to ensure that the solution can be deployed to multiple environments (development, test, production) with minimal configuration changes. You also need to manage the deployment of models and prompts as code. What should you use?

Accepted Answer

Azure OpenAI Studio with prompt flow and deployments. Azure OpenAI Studio with prompt flow enables you to manage prompts as code, version them, and deploy them alongside model deployments. This approach supports multiple environments with minimal configuration changes, as prompt flows can be parameterized and deployed consistently.

Answer

Azure Resource Manager (ARM) templates

Answer

Azure DevOps pipelines with variable groups

Answer

GitHub Actions with environment secrets

Question 11

You are deploying an Azure AI solution that uses Azure AI Search to index documents. The solution must ensure that the index is updated automatically when new documents are added to an Azure Blob Storage container. You need to configure an indexer that runs every 15 minutes and only indexes files with a .pdf extension. What should you do?

Accepted Answer

Create an indexer with a schedule interval of PT15M and set the 'fileTypes' parameter to 'pdf' in the data source definition.. To automatically update an index from Azure Blob Storage every 15 minutes and only index .pdf files, you must configure an indexer with a schedule interval of PT15M and specify 'fileTypes' as 'pdf' in the data source. This ensures the correct frequency and file filtering.

Answer

Create an indexer with a schedule interval of '15' and set the 'includedFileExtensions' property to '.pdf' in the index definition.

Answer

Create an indexer with a schedule interval of PT15M and set the 'fileTypes' parameter to '.pdf' in the index definition.

Answer

Create an indexer with a schedule interval of PT15M and set the 'excludedFileExtensions' parameter to 'pdf' in the data source definition.

Question 12

You are designing an Azure AI solution that uses Azure OpenAI Service. The solution must log all prompt and completion data for auditing purposes, and the logs must be retained for 7 years. You need to configure diagnostic settings for the Azure OpenAI resource. Which destination should you choose?

Accepted Answer

Send the logs to an Azure Storage account and configure a lifecycle management policy to retain them for 7 years.. Diagnostic settings for Azure OpenAI can route logs to a storage account, which supports lifecycle management policies to retain data for 7 years. Log Analytics has a shorter maximum retention, Event Hubs is for streaming, and metrics are not logs. Using a storage account with a lifecycle policy provides a cost-effective, long-term archival solution that satisfies the auditing requirement.

Answer

Send the logs to a Log Analytics workspace and set the retention period to 7 years.

Answer

Send the logs to an event hub and configure a consumer to write them to a database with a 7-year retention policy.

Answer

Send the logs to Azure Monitor metrics and configure a retention policy of 7 years.

Question 13

You are deploying an Azure AI solution that uses Azure AI Language to analyze customer feedback. The solution must ensure that the data is processed in a specific Azure region and that the data is not stored or processed outside that region. You need to configure the Azure AI Language resource. What should you do?

Accepted Answer

Deploy the Azure AI Language resource in the desired region and ensure that the resource is not configured for multi-region deployment.. Data residency for Azure AI Language is determined by the Azure region where the resource is deployed. By deploying the resource in the desired region and not using multi-region features, you ensure that data is processed and stored within that region. No additional configuration is required.

Answer

Deploy the Azure AI Language resource in the desired region and configure the resource to use a private endpoint.

Answer

Deploy the Azure AI Language resource in the desired region and set the data residency property to 'regional'.

Answer

Deploy the Azure AI Language resource in the desired region and enable the 'Data Residency' option in the Azure portal.

Question 14

You are planning to deploy an Azure AI Language resource that will be used by multiple applications. You need to ensure that each application has its own access key and that keys can be rotated independently without affecting other applications. What should you do?

Accepted Answer

Configure the Azure AI Language resource to use Microsoft Entra ID authentication and assign each application its own managed identity with appropriate role assignments.. Microsoft Entra ID authentication with managed identities allows each application to have its own identity and role assignment, eliminating shared keys. This enables independent access control and keyless authentication. It is the recommended approach for multi-application scenarios requiring isolation and easy rotation.

Answer

Use Azure Key Vault to store the resource's keys and provide each application with a unique secret identifier.

Answer

Create a separate Azure AI Language resource for each application.

Answer

Generate multiple keys for the resource and distribute one key to each application.

Question 15

You are deploying an Azure AI solution that uses Azure AI Services in multiple regions. You need to ensure that the solution can fail over to a secondary region if the primary region becomes unavailable. The solution must minimize downtime and data loss. Which two actions should you perform? (Choose two.)

Accepted Answer

Deploy the same Azure AI Services resources in a secondary region and configure the application to use the secondary endpoint if the primary fails.. To achieve failover for Azure AI Services across regions, you must deploy duplicate resources in a secondary region and route traffic to the secondary when the primary fails. This can be done by configuring the application with fallback logic or by using Azure Traffic Manager for automatic failover. Both actions together minimize downtime and data loss.

Answer

Use the same access key for both the primary and secondary Azure AI Services resources.

Answer

Store the access keys for both regions in Azure Key Vault and have the application retrieve them at runtime.

Answer

Enable geo-redundant storage (GRS) for the Azure AI Services resources.