AI-102 Plan and manage an Azure AI solution Practice Test 9 — 15 Questions

Question 1

You are deploying an Azure AI Foundry hub and project by using an Azure Resource Manager (ARM) template. The template must create a key vault to store secrets and a storage account for project artifacts. You need to ensure that the hub can access the key vault and storage account during deployment. Which property should you configure in the hub resource?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the identity property to a system-assigned managed identity and grant it access to the key vault and storage account.. A system-assigned managed identity on the Azure AI Foundry hub enables secure access to the key vault and storage account without managing credentials. You must then assign the appropriate RBAC roles to this identity. Other properties either configure encryption or control project management but do not provide the required authentication.

Answer

Set the allowProjectManagement property to true to enable the hub to manage project resources.

Answer

Set the primaryUserAssignedIdentity property to a user-assigned managed identity that has access to the key vault and storage account.

Answer

Set the encryption property to use a customer-managed key stored in the key vault.

Question 2

You are deploying an Azure AI Services multi-service resource that will be used by several internal applications. Security policy requires that the applications authenticate by using Microsoft Entra ID and that access be scoped to specific resource groups, with no shared account keys stored in application configuration. You need to configure authentication and authorization for the resource. What should you do?

Accepted Answer

Create a managed identity for each application and assign it the Cognitive Services User role scoped to the resource group that contains the resource.. Managed identities combined with Azure RBAC let each application authenticate through Microsoft Entra ID with no stored secrets, and assigning the Cognitive Services User role at a resource group scope limits which resources each identity can reach. Rotating keys or storing them in Key Vault still depends on shared secrets, and private endpoints address connectivity rather than identity-based authorization.

Answer

Configure the resource to use private endpoints and disable public network access.

Answer

Store the resource key in Azure Key Vault and grant each application the Key Vault Secrets User role.

Answer

Regenerate the primary and secondary keys and distribute the secondary key only to the applications that need access.

Question 3

You are deploying an Azure AI solution that uses Azure OpenAI. The solution must log all API requests and responses for auditing purposes, but the logs must not contain any personally identifiable information (PII). You need to configure logging. What should you do?

Accepted Answer

Enable diagnostic settings on the Azure OpenAI resource to send logs to Azure Monitor and use a custom data transformation to redact PII.. Using diagnostic settings with Azure Monitor and a data transformation allows you to redact or remove PII from logs before they are stored. This meets the auditing requirement while ensuring compliance with privacy policies. It leverages native Azure capabilities and avoids custom code or additional services.

Answer

Use Azure API Management as a proxy to log requests and responses, and configure a policy to mask sensitive fields.

Answer

Configure the Azure OpenAI resource to use a customer-managed key and enable logging to Azure Storage.

Answer

Enable logging in the application code and write logs to a database with column-level encryption.

Question 4

You are deploying an Azure AI solution that uses Azure AI Search and Azure OpenAI. You need to ensure the solution can be provisioned repeatedly into multiple Azure subscriptions with identical settings. The template must be human-readable and support modularization. Which template format should you use?

Accepted Answer

Bicep files. Bicep is the recommended declarative language for deploying Azure resources. It compiles to ARM JSON, supports modules for reuse, and uses a concise syntax that is easier to read and maintain than raw JSON. It satisfies the need for repeatable, identical deployments across subscriptions while providing first-class modularization.

Answer

Terraform configuration files

Answer

Azure CLI scripts

Answer

Azure Resource Manager (ARM) JSON templates

Question 5

You are deploying a real-time fraud detection system that uses an Azure Machine Learning model deployed to an Azure Kubernetes Service (AKS) cluster. The model must automatically scale based on incoming request volume and support A/B testing between two model versions. You need to configure the deployment to meet these requirements with minimal administrative effort. What should you do?

Accepted Answer

Deploy the model as a managed online endpoint with two deployments, each with its own autoscale settings, and assign traffic percentages to each deployment.. Managed online endpoints in Azure Machine Learning are designed for production-grade model serving with built-in support for multiple deployments, traffic splitting, and autoscaling. They abstract away infrastructure management, allowing you to focus on model performance. For A/B testing, you can route a percentage of traffic to each deployment and monitor metrics. Autoscaling ensures each deployment handles load efficiently. This solution meets both the scaling and A/B testing requirements with minimal administrative effort.

Answer

Create two separate AKS clusters, deploy one model version to each, and use Azure Traffic Manager to distribute requests.

Answer

Enable autoscaling on the AKS node pool and deploy the model as a single online endpoint with 100% traffic.

Answer

Deploy the model to an Azure Container Instance with autoscaling enabled and use an Azure Application Gateway for traffic distribution.

Question 6

You are deploying an Azure AI solution that uses an Azure OpenAI model. The solution must ensure that API calls are authenticated by using Microsoft Entra ID (formerly Azure Active Directory) and that the application can be granted the least privilege required to call the model. What should you do?

Accepted Answer

Assign the Cognitive Services User role to the application's managed identity on the Azure OpenAI resource.. To authenticate Azure OpenAI API calls with Microsoft Entra ID while enforcing least privilege, the calling application should use its own managed identity and be assigned the Cognitive Services User role on the Azure OpenAI resource. This role provides data-plane access to invoke the model without granting management permissions. Using keys or management-plane roles does not satisfy the authentication requirement or least privilege.

Answer

Assign the Contributor role to the application's managed identity on the Azure OpenAI resource.

Answer

Enable a system-assigned managed identity on the Azure OpenAI resource and use it to call the API.

Answer

Store the Azure OpenAI API key in Azure Key Vault and retrieve it at runtime by using the application's managed identity.

Question 7

You are deploying an Azure AI solution that uses multiple Azure AI services, including Azure AI Language and Azure AI Vision. You need to ensure that the solution can be managed centrally and that access to the services is controlled using role-based access control (RBAC). You also need to monitor the usage and health of all services from a single pane of glass. Which two actions should you perform? (Choose two.)

Accepted Answer

Use Azure Monitor to collect metrics and logs from all Azure AI services and view them in a single dashboard.. Creating a multi-service resource consolidates access and management for multiple Azure AI services, and Azure Monitor provides centralized monitoring across all services. Together, these actions meet the requirements for centralized management, RBAC, and a single pane of glass for monitoring.

Answer

Configure each Azure AI service with its own resource and use Azure Policy to enforce RBAC assignments.

Answer

Deploy all services in the same resource group and use resource group tags for RBAC.

Answer

Use Azure API Management to proxy all requests to the Azure AI services and enforce RBAC at the API Management level.

Question 8

You are managing an Azure AI solution that uses Azure OpenAI Service. The solution must log all API requests and responses for auditing purposes. The logs must be stored for 90 days and be immutable. You need to configure logging with minimal development effort. What should you do?

Accepted Answer

Enable diagnostic settings on the Azure OpenAI resource to send logs to an Azure Storage account with a retention policy of 90 days and enable immutable storage.. Enabling diagnostic settings on the Azure OpenAI resource to send logs to Azure Storage with a 90-day retention and immutable storage policy meets the auditing requirements with minimal development effort. It uses native Azure features for log export, retention, and immutability.

Answer

Use Azure Monitor Logs to collect logs and set a retention policy of 90 days, then export to Azure Blob Storage with a legal hold.

Answer

Implement custom logging in the application to write requests and responses to an Azure SQL Database with a 90-day retention policy.

Answer

Configure Azure OpenAI to write logs directly to an Azure Event Hub and use Stream Analytics to store them in Azure Data Lake Storage Gen2 with a 90-day retention policy.

Question 9

You are deploying an Azure AI solution that uses Azure OpenAI Service. The solution must log all API requests and responses for auditing purposes. You need to ensure that the logs are retained for 90 days and can be queried using Kusto Query Language (KQL). What should you do?

Accepted Answer

Enable diagnostic settings for the Azure OpenAI resource and send logs to a Log Analytics workspace.. Enabling diagnostic settings and sending logs to a Log Analytics workspace is the correct approach. It captures Azure OpenAI request and response logs, allows retention for 90 days, and supports KQL queries. The other options either do not capture the required data or do not provide the necessary querying and retention capabilities.

Answer

Configure Azure Monitor Application Insights for the Azure OpenAI resource.

Answer

Enable Azure OpenAI request logging in the Azure portal and store logs in an Azure Storage account.

Answer

Use Azure API Management to log all requests and responses and send them to Azure Event Hubs.

Question 10

You are designing an Azure AI solution that ingests customer support tickets from multiple sources. The solution must route tickets to the correct department using a custom text classification model. The model must be retrained automatically when new labeled data is added to an Azure Blob Storage container. You need to configure the training pipeline. What should you use?

Accepted Answer

Azure AI Language custom text classification with an Azure Machine Learning pipeline triggered by a blob event.. The requirement is to automatically retrain a custom text classification model when new labeled data is added to Blob Storage. Azure AI Language provides a training API, and Azure Machine Learning pipelines can be triggered by blob events via Event Grid. This combination enables event-driven, automated retraining. Other options either lack retraining capability, use inefficient polling, or do not handle the full pipeline.

Answer

Azure Logic Apps that polls the blob container and calls the Azure AI Language training API when a new file appears.

Answer

Azure Functions with a timer trigger that runs every hour and submits a training job to Azure AI Language.

Answer

Azure Cognitive Search with a custom skill that calls the Azure AI Language API on a schedule.

Question 11

You are deploying an Azure AI solution that uses Azure Machine Learning and Azure Cognitive Services. The solution must ensure that all data in transit between the services is encrypted and that the services can only be accessed from a specific virtual network. What should you do?

Accepted Answer

Configure Azure Private Link for each service and enable TLS 1.2 for all communications.. Azure Private Link creates a private endpoint in your virtual network, allowing secure access to Azure services without exposing them to the public internet. Combined with TLS 1.2, data in transit is encrypted. This satisfies both the encryption and network isolation requirements. Other options do not provide the same level of private connectivity.

Answer

Enable service endpoints for the services and configure Azure Firewall to allow only traffic from the virtual network.

Answer

Use Azure VPN Gateway to connect the virtual network to the services and enable HTTPS for all communications.

Answer

Deploy the services within the virtual network using Azure Kubernetes Service and enable network policies.

Question 12

You manage an Azure AI Services resource used by a customer-facing application. The application must continue to work during a regional outage, and you need the lowest possible latency for users in both North America and Europe. You configure a multi-region deployment. You need to ensure that client applications automatically route requests to a healthy region without code changes. What should you use?

Accepted Answer

A custom domain endpoint from the Azure AI Services resource and a Traffic Manager profile that routes by performance.. A custom subdomain endpoint provides a stable hostname, and Azure Traffic Manager with performance routing and health probes automatically directs clients to the closest healthy region. This delivers both low latency and outage resilience without application changes. Regional endpoints, key swapping, and network isolation options do not provide automatic global routing or failover.

Answer

A private endpoint in each region and a VPN gateway connecting the client networks.

Answer

Azure Front Door with origin groups that include each regional Azure AI Services endpoint.

Answer

The regional endpoint of the primary resource and a secondary key stored in configuration for manual failover.

Question 13

You are provisioning an Azure AI services multi-service account by using the Azure CLI. The account must be restricted so that it can only be accessed from a specific subnet of a virtual network, and no public internet access is allowed. Which Azure CLI command parameter should you include when creating the account?

Accepted Answer

--vnet-name --subnet . The requirement is to bind the Azure AI services account to a specific virtual network subnet and prevent public internet exposure. Specifying the virtual network and subnet during account creation establishes a virtual network rule that scopes inbound traffic to that subnet. The default deny action then blocks any traffic that is not explicitly allowed, so the account is reachable only from the intended private network path.

Answer

--public-network-access Enabled

Answer

--restrict-outbound-network-access true

Answer

--network-acls default-action Deny

Question 14

You are deploying an Azure AI solution that uses multiple Azure AI services. You need to monitor the solution and ensure that you are alerted when the number of calls to any service exceeds a threshold. You also need to minimize administrative effort. What should you do?

Accepted Answer

Create a single metric alert in Azure Monitor that uses a scope of the resource group containing all Azure AI services and a condition on the Calls metric.. Azure Monitor metric alerts can target a resource group as their scope, allowing a single alert rule to monitor the Calls metric across all Azure AI services in that group. This satisfies the requirement to alert when call counts exceed a threshold while minimizing administrative effort, since you do not need to create and maintain separate alerts for each service.

Answer

Configure Azure Application Insights for each application that calls the services and create a custom alert based on the request count.

Answer

Use Azure Monitor Logs to query the AzureActivity table for each service and create a scheduled query alert.

Answer

Enable diagnostic settings on each Azure AI service to send metrics to a Log Analytics workspace, and create an alert rule in Azure Monitor for each service.

Question 15

You are developing an Azure AI solution that uses Azure Cognitive Search to index documents. You need to ensure that the indexer can access documents stored in an Azure Storage account that is secured by a firewall. The solution must use managed identities for authentication. What should you do?

Accepted Answer

Enable a system-assigned managed identity for the Azure Cognitive Search service and grant it access to the storage account.. The correct approach is to enable a system-assigned managed identity for the Azure Cognitive Search service and assign it the appropriate role on the storage account. This allows the indexer to authenticate without credentials and access data even when the storage account firewall is enabled. Managed identities provide a secure, credential-free authentication mechanism that integrates with Azure RBAC.

Answer

Deploy the Azure Cognitive Search service into a virtual network and use service endpoints to connect to the storage account.

Answer

Configure the storage account to allow access from all networks and use a SAS token for authentication.

Answer

Store the storage account connection string in Azure Key Vault and reference it in the indexer definition.