AI-103 Practice Test 18 — 15 Questions

Question 1

Your organization requires that all data sent to Azure OpenAI Service remains encrypted using a key that your security team fully controls and rotates. Which feature should you configure during resource creation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-managed keys (CMK) with Azure Key Vault. Customer-managed keys (CMK) via Azure Key Vault allow organizations to manage encryption keys used to secure Azure AI service data.

Answer

Azure Information Protection client-side encryption

Answer

Service-managed keys (Default encryption)

Answer

Transparent Data Encryption with a SQL Managed Instance

Question 2

You are managing an Azure OpenAI model deployment in an active-passive multi-region disaster recovery architecture. A regional outage occurs, and you failover traffic to the secondary region. However, clients report receiving authentication errors. What is the most likely cause?

Accepted Answer

The client application's managed identity has not been granted the required RBAC roles on the secondary Azure OpenAI resource.. Managed identities are region-specific or require proper role assignments on the secondary resource instance.

Answer

Azure automatically deletes API keys during a regional failover.

Answer

Azure OpenAI models require re-training after any regional failover event.

Answer

The primary region's DNS zone must be manually deleted for failover to work.

Question 3

You are deploying an Azure AI Speech resource using an ARM template. Which parameter defines the name of the resource instance?

Accepted Answer

name. The 'name' property in ARM template resource definitions specifies the name of the resource.

Answer

sku

Answer

location

Answer

kind

Question 4

You are migrating an Azure AI Speech service resource to a different Azure subscription within the same tenant. Which mechanism should you use to preserve the existing custom voice models and configurations?

Accepted Answer

Use the Azure portal resource move feature to transfer the Speech resource to the target subscription.. Azure Resource Mover or subscription-level resource move operations allow moving cognitive service resources while retaining custom models and configurations, provided regional constraints are met.

Answer

Export custom models as JSON and import them via the Speech Studio in the new subscription.

Answer

Export the resource ARM template and deploy it to the target subscription.

Answer

Recreate the custom models from scratch in the new subscription using a new Speech resource.

Question 5

You are migrating an Azure AI service from one region to another. What is the most efficient way to migrate the configuration?

Accepted Answer

Export the resource as an ARM template and deploy it to the new region.. Azure Resource Manager (ARM) templates or Bicep files are the standard for infrastructure as code, ensuring consistent replication.

Answer

Restore a backup from a Recovery Services vault.

Answer

Use Azure Data Factory to copy the resource.

Answer

Manually recreate all resources in the new region.

Question 6

Which TWO actions should you take to ensure that your Azure AI deployment is secure?

Accepted Answer

Use Managed Identities for service-to-service communication.. Enforcing TLS 1.2+ and using managed identities are standard security best practices for Azure AI.

Answer

Keep the public IP exposed at all times.

Answer

Store all keys in a public GitHub repository.

Answer

Use the default 'Owner' role for all users.

Question 7

You are provisioning an Azure AI services account and want to view your current API key. Where can you retrieve the API key in the Azure portal?

Accepted Answer

Keys and Endpoint blade of the resource. The 'Keys and Endpoint' blade of an Azure AI resource displays the generated primary and secondary keys.

Answer

Resource graph explorer

Answer

Azure Advisor cost optimization pane

Answer

Azure Active Directory overview page

Question 8

You are auditing your Azure AI services for cost optimization. You discover an Azure AI Search service that has been over-provisioned with too many search units and replica nodes. How can you right-size the service without losing your existing indexes?

Accepted Answer

Modify the scale settings in the Azure portal to reduce the number of replicas and partitions.. You can scale down search units and replicas directly through the Azure portal or management API without losing indexes, provided the data fits within the reduced storage limits.

Answer

Switch the pricing tier from Standard to Free.

Answer

Export all index definitions, delete the service, and re-import the indexes into a new Basic tier service.

Answer

Delete the search service and recreate it with fewer replicas and partitions.

Question 9

Your organization is implementing strict network isolation for Azure OpenAI. Direct internet access from worker nodes is prohibited. Which THREE mechanisms must be correctly configured to allow secure communication? Each correct answer presents part of the solution.

Accepted Answer

Public network access disabled on the Azure OpenAI resource. Private endpoint, private DNS zone, and disabling public access ensure secure network isolation.

Answer

Public IP addresses assigned directly to the AI service endpoint

Answer

Azure Bastion host attached to the OpenAI backend storage

Question 10

You need to restrict access to an Azure AI Custom Vision training resource so that only members of a specific Azure AD security group can manage projects and train models. How should you configure access control?

Accepted Answer

Assign the Cognitive Services Contributor role to the Azure AD security group at the resource scope.. Role-Based Access Control (RBAC) allows assigning built-in or custom roles like Cognitive Services Contributor to specific Azure AD security groups at the resource scope.

Answer

Configure IP firewall rules on the networking blade.

Answer

Enable managed identity on the resource and assign it to the security group.

Answer

Generate and distribute secondary API keys to group members.

Question 11

You are planning the deployment of Azure AI containers in an on-premises disconnected environment. Which THREE prerequisites and operational considerations must you address? Each correct answer presents part of the solution.

Accepted Answer

Submit an online application and obtain billing approval from Microsoft to use disconnected containers.. Application for approval, license downloading, and periodic re-authentication are required for disconnected containers.

Answer

Rely on perpetual offline execution without ever reporting telemetry to Azure.

Answer

Connect the container permanently to an active Azure SQL database over the public internet.

Question 12

You are provisioning a new Azure AI multi-service account in the West US region for an enterprise application. Which pricing tier should you select to ensure the account supports all available Azure AI capabilities including Custom Neural Voice and Content Moderator?

Accepted Answer

Standard (S0). The Standard (S0) pricing tier is required for full access to standard and advanced Azure AI services. The Free (F0) tier has transaction limits and restricted feature sets.

Answer

Free (F0)

Answer

Isolated (I0)

Answer

Basic (B0)

Question 13

You are implementing a multi-region disaster recovery strategy for an Azure OpenAI deployment. If the primary region goes down, how should you configure traffic redirection to the secondary region using Azure Front Door?

Accepted Answer

Use priority routing with the primary region set to priority 1 and the secondary region set to priority 2.. Configuring a priority routing method in Azure Front Door enables automatic failover to the secondary region when the primary endpoint fails health probes.

Answer

Use geographic routing based on the client IP location.

Answer

Use weighted routing with a 50/50 split between regions.

Answer

Use performance-based routing to the lowest latency node.

Question 14

Your enterprise organization operates under strict data residency and sovereignty requirements. You are deploying Azure OpenAI and Azure AI Language services. Which THREE architectural decisions ensure compliance with data residency mandates? Each correct answer presents part of the solution.

Accepted Answer

Verify Microsoft's data privacy commitments guaranteeing that customer data is not used to train base models.. Deploying in local regions, verifying data privacy terms, and avoiding cross-region logging ensure compliance.

Answer

Store unencrypted customer prompts on public GitHub repositories.

Answer

Route all inference requests through public relay nodes located in foreign countries to save bandwidth costs.

Question 15

Your development team needs to test a new Azure AI Language service feature without incurring ongoing charges when the service is idle. Which billing model is appropriate for initial prototyping?

Accepted Answer

Pay-as-you-go (Consumption-based metering). The pay-as-you-go pricing model charges only for transactions processed, meaning no charges accrue when the service is idle.

Answer

Dedicated hardware hosting

Answer

Reserved Instance 3-year term

Answer

Commitment tier (Pre-purchased capacity)