AI-103 Practice Test 5 — 25 Questions

Question 1

You are implementing a disaster recovery strategy for a critical image processing application that relies on Azure AI Vision. If the primary Azure region experiences an outage, how should you configure failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a secondary Azure AI Vision resource in a paired Azure region and configure your application to fail over to the secondary endpoint if errors occur.. Azure AI Vision is a regional PaaS service, so disaster recovery requires deploying a secondary resource in a paired region and having the application fail over to that endpoint when the primary returns errors. There is no automatic cross-region replication of the service itself, so the application must implement the failover logic. This matches Azure's shared responsibility model for PaaS DR.

Answer

Use geo-replication on the Azure Blob Storage account to automatically fail over the AI service endpoints.

Answer

Configure Azure Site Recovery to replicate the Azure AI Vision service backend VMs.

Answer

Rely on automatic synchronous replication of Custom Vision models across all global Azure datacenters without application changes.

Question 2

You are integrating Azure OpenAI into an enterprise application. You need to prevent prompt injection attacks where users attempt to override the system instructions. Which approach provides the most robust defense?

Accepted Answer

Implement an input guardrail using Azure AI Content Safety to detect and block jailbreak attempts before they reach the model.. Azure AI Content Safety's Prompt Shields (jailbreak detection) is purpose-built to detect and block prompt injection and jailbreak attempts at the input boundary before they reach the model. This provides a robust, model-agnostic defense layer that is maintained and updated by Microsoft against emerging attack patterns. Input filtering is the recommended first line of defense in Microsoft's defense-in-depth guidance for LLM applications.

Answer

Set the model frequency penalty to 2.0 to penalize repeated malicious phrases.

Answer

Append 'Ignore previous instructions' at the end of every user message.

Answer

Encode all user input in Base64 before sending it to the model.

Question 3

You are configuring a Prompt Flow to use a custom Python tool. Which configuration is required to ensure the environment has the necessary libraries?

Accepted Answer

Include them in a 'requirements.txt' file in the flow directory.. Prompt Flow resolves Python dependencies for a flow by reading a requirements.txt file located in the flow directory. This file lists the packages and versions needed by custom Python tools, and the Prompt Flow runtime installs them when the flow is executed or built. This ensures reproducibility across local development and cloud execution.

Answer

Install them manually on the host machine.

Answer

Add them to the System Prompt.

Answer

Add them to the deployment manifest.

Question 4

What is the primary benefit of using the Model Catalog in Azure AI Foundry?

Accepted Answer

Centralized discovery and deployment of models. The Model Catalog in Azure AI Foundry is a centralized hub for discovering, comparing, and deploying foundation models from Microsoft, OpenAI, Meta, Mistral, and others. Its primary value is streamlining model selection and one-click deployment into managed endpoints, so teams can quickly move from evaluation to production. It is not a prompt engineering, networking, or data labeling tool.

Answer

Automated prompt engineering

Answer

Network security configuration

Answer

Automatic data labeling

Question 5

You are deploying an Azure AI Document Intelligence resource. You need to ensure that only client requests coming from your corporate public IP address range can access the endpoint. Which networking configuration should you apply?

Accepted Answer

Configure firewall virtual networks and IP address ranges in the Azure AI resource networking settings.. Azure AI resources, including Document Intelligence, provide networking settings where you can configure firewall rules to allow access only from specific virtual networks and public IP address ranges. This directly restricts endpoint access to your corporate IP range, satisfying the requirement. It is the native, intended mechanism for IP-based access control on Azure AI services.

Answer

Configure Azure Bastion access restriction rules.

Answer

Attach an Azure Application Gateway with a WAF policy.

Answer

Enable Microsoft Entra conditional access policies on the API keys.

Question 6

You are designing an automated deployment pipeline for Azure AI Search using GitHub Actions. The pipeline must authenticate to Azure securely without storing credentials or long-lived secrets in GitHub repository settings. Which authentication mechanism should you implement?

Accepted Answer

OpenID Connect (OIDC) with Azure workload identity federation. OpenID Connect (OIDC) with Azure workload identity federation allows GitHub Actions workflows to authenticate to Azure using short-lived tokens issued by GitHub's OIDC provider and exchanged for Microsoft Entra ID tokens via a federated identity credential. This eliminates the need to store any secret in GitHub, satisfying the 'no long-lived credentials' requirement. It is the Microsoft-recommended pattern for CI/CD pipelines deploying Azure resources such as Azure AI Search.

Answer

Hardcoded administrator API keys stored in GitHub Action variables

Answer

A personal access token (PAT) with full subscription ownership

Answer

Anonymous access enabled during deployment time

Question 7

You are preparing training images for a Custom Vision object detection project. Which THREE data preparation practices should you follow to ensure high model accuracy? (Choose three.)

Accepted Answer

Vary object angles, lighting, and scale across your training images.. Option A is correct because varying object angles, lighting, and scale exposes the model to the natural variability it will encounter at inference time, which is essential for a robust Custom Vision object detector. Option C is correct because Microsoft's Custom Vision documentation recommends a minimum of 15 tagged images per tag for object detection, and more images generally yield better accuracy. Option D is correct because including varied backgrounds for the same object class prevents the model from overfitting to a single context and helps it generalize to new environments. Option B is incorrect because using identical backgrounds for all samples reduces variability and encourages overfitting to that background rather than learning the object itself. Option E is incorrect because forcing all images under 100x100 pixels discards detail and resolution that object detection models need to localize and classify objects accurately.

Answer

Use identical background images for all training samples to maintain consistency.

Answer

Keep all training images under 100x100 pixels to speed up training.

Question 8

Your application is receiving 429 errors from the Document Intelligence service. What does this indicate?

Accepted Answer

Rate limit exceeded. HTTP 429 'Too Many Requests' indicates the client has exceeded the rate limit or quota for the Document Intelligence service. Azure Cognitive Services enforce per-second and per-minute transaction limits based on the pricing tier (e.g., S0 has specific TPS limits). The correct response is to implement retry with exponential backoff and/or request a quota increase.

Answer

Authentication failed

Answer

Server-side error

Answer

The request is malformed

Question 9

Your company wants to generate descriptive captions for thousands of product images automatically using Azure AI Vision. Which visual feature parameter should you specify in the analyze request?

Accepted Answer

features=caption. The `caption` feature in Azure AI Vision's Analyze Image API generates a human-readable, one-sentence description of the entire image content. It is specifically designed for scenarios like automatically describing product images at scale. The API returns a `captions` array with `text` and `confidence` values, making it the correct choice for descriptive captioning.

Answer

features=read

Answer

features=smartCrops

Answer

features=objects

Question 10

Which command line tool is primarily used for managing Azure resources, including AI services, from a terminal?

Accepted Answer

Azure CLI.. Azure CLI is the cross-platform command-line tool designed to create, manage, and automate Azure resources, including Azure AI services, from a terminal. It provides commands such as 'az cognitiveservices account create' and 'az ml' for AI workloads, making it the primary terminal-based management tool.

Answer

Azure PowerShell.

Answer

Docker.

Answer

Kubectl.

Question 11

You are provisioning a new Azure AI Search service. You need to choose a pricing tier that supports semantic search capabilities. Which minimum tier should you select?

Accepted Answer

Standard (S1). Semantic search in Azure AI Search requires the Standard tier (S1) or higher. The Basic and Free tiers do not support semantic ranker, which uses deep learning models to re-rank results. Storage Optimized tiers are for large-scale storage but also support semantic search; however, the question asks for the minimum tier, and Standard is the lowest tier that includes semantic search. Therefore, Standard (S1) is correct.

Answer

Basic

Answer

Free

Answer

Storage Optimized (L1)

Question 12

You need to secure communications between an Azure App Service hosting your web app and an Azure AI Computer Vision service. The web app must authenticate to Computer Vision without storing API keys in application settings. Which feature should you enable?

Accepted Answer

Managed Identity on the App Service and RBAC role assignment on the Computer Vision resource.. Enabling a managed identity on the App Service and assigning an appropriate RBAC role on the Computer Vision resource lets the app obtain Microsoft Entra ID tokens automatically, eliminating the need to store API keys in application settings. The managed identity is trusted by Microsoft Entra ID, and the RBAC role grants access to the Computer Vision resource. This is the recommended keyless authentication pattern for service-to-service communication in Azure.

Answer

API Management subscription keys

Answer

Cross-Origin Resource Sharing (CORS)

Answer

Storage account shared access signatures (SAS)

Question 13

You are provisioning a new Azure AI Vision resource in the Azure Portal. You need to choose between a 'F0' free pricing tier and an 'S0' standard pricing tier. What is a key limitation of selecting the F0 pricing tier?

Accepted Answer

It restricts the total number of calls allowed per month and limits transaction rates.. The F0 (free) tier for Azure AI Vision is designed for evaluation and small-scale testing, and it enforces both a monthly call quota (e.g., 5,000 transactions per month for many Vision APIs) and a low transactions-per-second (TPS) rate limit. Exceeding either causes 429 throttling or 403 quota-exceeded errors, which is why F0 is unsuitable for production workloads.

Answer

It does not support regional data residency guarantees.

Answer

It disables diagnostic log streaming to Azure Monitor.

Answer

It prohibits the use of managed identities for authentication.

Question 14

Your development team needs to deploy an Azure AI Language resource that can be accessed from an on-premises datacenter via an ExpressRoute circuit without traversing the public internet. Which Azure feature should you configure?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP from your VNet to the Azure AI Language resource, so traffic from on-premises over ExpressRoute reaches the service via private IP without traversing the public internet. This is the standard Private Link pattern for PaaS services.

Answer

Azure Bastion host subnet

Answer

NAT gateway resource attachment

Answer

Azure Front Door with Web Application Firewall

Question 15

You are configuring an Azure AI Language resource and want to ensure that it can be accessed securely from an Azure Virtual Network (VNet) without traversing the public internet. Which Azure networking feature should you configure?

Accepted Answer

Private endpoints. Private endpoints create a private IP address for an Azure AI Language resource within your VNet, enabling secure access over the Microsoft backbone network without exposing traffic to the public internet. This is the standard way to privately connect to Azure PaaS services. It uses Azure Private Link to map the service to a private endpoint in your subnet.

Answer

Azure Front Door

Answer

Azure Bastion

Answer

VPN Gateway

Question 16

You are using Document Intelligence to classify documents into different types (e.g., invoices, bank statements). Which model is most appropriate?

Accepted Answer

Custom classification model. A custom classification model is purpose-built to categorize documents into user-defined types (e.g., invoice vs. bank statement) before or alongside extraction. It is trained on labeled examples of each document class and returns a document type with confidence. Prebuilt-invoice extracts fields from invoices but does not classify arbitrary document types.

Answer

Prebuilt-invoice

Answer

Read model

Answer

Custom extraction model

Question 17

You are configuring an Azure AI Document Intelligence orchestration model to automatically classify and extract data from incoming customer correspondence, which includes invoices, work orders, and purchase orders. One of the component models is failing to classify documents correctly. How should you resolve this issue?

Accepted Answer

Retrain the failing component custom model with more distinct sample documents that represent the specific document class.. The most effective way to resolve misclassification by a component model in an orchestration model is to retrain that custom model with more distinct sample documents that clearly represent the specific document class. This improves the model's ability to differentiate between classes.

Answer

Modify the orchestration model routing threshold in the Azure portal settings.

Answer

Switch the orchestration model from a template-based classifier to a neural classifier using the REST API.

Answer

Update the API version to bypass classification and force direct extraction via the general document model.

Question 18

Your team needs to extract data from a large volume of standardized tax forms using Azure AI Document Intelligence. The forms have a fixed layout where fields are always in the exact same location. Which model type provides the fastest training and highest accuracy for this specific use case?

Accepted Answer

Custom template model. A custom template model is designed for documents with a consistent, fixed layout, and it trains quickly because it relies on layout/template matching rather than deep semantic learning. For standardized tax forms where fields are always in the same location, the template model achieves high accuracy with minimal training data and fast training time. This is the classic use case Microsoft documents for the template model type.

Answer

Prebuilt receipt model

Answer

Custom neural model

Answer

General document model

Question 19

You are implementing indirect prompt injection protection for an agent that reads emails and summarizes them. An incoming email contains malicious instructions designed to trick the agent into exfiltrating user data. Which Azure AI feature should you configure to detect this threat?

Accepted Answer

Prompt Shields for indirect prompt injection in Azure AI Content Safety. Prompt Shields in Azure AI Content Safety is specifically designed to detect both direct (user) and indirect (document/email-embedded) prompt injection attacks. For an agent that reads emails, indirect prompt injection is the threat model — malicious instructions hidden in email content — and Prompt Shields analyzes the content to flag it before the agent acts on it. This is the only option that addresses prompt injection at the AI layer.

Answer

Azure DDoS Protection standard tier

Answer

Azure Web Application Firewall (WAF) SQL injection rules

Answer

Microsoft Defender for Cloud threat detection

Question 20

You need to secure the communication between your app and Document Intelligence using a private endpoint. What is the primary benefit?

Accepted Answer

Traffic stays within the Azure private network. A private endpoint for Document Intelligence creates a private IP address in your virtual network via Azure Private Link, so all traffic between your app and the Document Intelligence resource traverses the Microsoft backbone and never the public internet. The primary benefit is network isolation — traffic stays within the Azure private network, reducing exposure to internet-based threats and satisfying compliance requirements for data-in-transit isolation.

Answer

Reduced cost

Answer

Faster inference speeds

Answer

Increased throughput limits