AI-103 Plan And Manage AN Azure AI Solution — 10 Questions

Question 1

You are designing a monitoring solution for an Azure AI Document Intelligence resource that processes thousands of invoices daily. You need to track custom metric alerts when HTTP 429 (Too Many Requests) errors exceed a specific threshold over a 5-minute window. Where should you configure this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor metric alerts. Azure Monitor metric alerts evaluate platform metrics emitted by Azure resources, including Azure AI Document Intelligence, and can trigger when a metric such as HTTP 429 errors exceeds a threshold over a 5-minute window. Metric alerts support dimensions and aggregation, making them the correct place to configure threshold-based alerts on service metrics.

Answer

Application Insights availability web tests

Answer

Microsoft Defender for Cloud threat protection policies

Answer

Azure AI Studio diagnostics dashboard

Question 2

You are managing an enterprise Azure OpenAI deployment with high traffic volumes. To prevent unexpected bill increases due to sudden usage spikes, you need to implement a cost-control mechanism that halts requests once a specific financial limit is reached. What is the native approach to achieve this?

Accepted Answer

Configure an Azure API Management (APIM) policy to track token usage and reject requests when the quota is exceeded.. Azure API Management (APIM) is the native Azure service for enforcing token-based quotas and rate limits on Azure OpenAI endpoints. An APIM policy can inspect the response's token usage, maintain a running counter per subscription, and return 429 once a financial threshold is reached — providing the hard stop the scenario requires.

Answer

Set a hard spending limit directly inside the Azure AI Services resource properties pane.

Answer

Create an Azure Cost Management budget with an action group running a script to delete the OpenAI resource.

Answer

Enable Microsoft Defender for Cloud auto-remediation rules for high billing.

Question 3

Your organization uses Azure Monitor diagnostic settings to route logs and metrics for all Azure AI services to a centralized Log Analytics workspace. You need to write a Kusto Query Language (KQL) query to find all incoming API requests that resulted in an HTTP 500 server error over the last 24 hours. Which table should you query?

Accepted Answer

AzureDiagnostics. Azure Monitor diagnostic settings route resource logs and metrics to a Log Analytics workspace, and those records land in the AzureDiagnostics table when using the diagnostic settings destination. To find incoming API requests that returned HTTP 500, you query AzureDiagnostics and filter on fields such as Category, OperationName, and ResultSignature or status code fields. AzureDiagnostics is the standard table for resource-level diagnostic logs from Azure AI services.

Answer

AppTraces

Answer

AzureActivity

Answer

SecurityEvent

Question 4

You are deploying an Azure AI Speech resource. Your compliance team stipulates that all data sent to the speech service must be processed strictly within the geographical boundaries of the European Union and must not be used for Microsoft's model training. How should you ensure this compliance?

Accepted Answer

Deploy the Speech resource in an EU-based region (such as West Europe) and review the data privacy and residency terms.. To ensure EU data residency and prevent data use for model training, you should deploy the Azure AI Speech resource in an EU-based region (e.g., West Europe) and review the data privacy and residency terms. Azure regional deployments keep data at rest and in processing within the chosen geography, and Microsoft's terms specify that data from paid Speech services is not used to train models without consent.

Answer

Enable Azure Policy to encrypt all audio files using customer-managed keys (CMK).

Answer

Configure an Azure Firewall instance to inspect and drop audio payloads destined outside the EU.

Question 5

You are designing an automated pipeline to deploy Azure AI Custom Vision projects using Infrastructure as Code (IaC) with Bicep. You need to reference an existing Custom Vision training resource in your deployment script without hardcoding its endpoint URL or primary key. Which Bicep construct should you use to retrieve these properties dynamically?

Accepted Answer

The Bicep 'existing' keyword reference. The Bicep 'existing' keyword allows you to reference an already-deployed resource by name and resource group, then access its properties (such as endpoint and keys) dynamically without hardcoding. This is the idiomatic Bicep way to retrieve properties from an existing resource during deployment.

Answer

The ARM template 'reference()' function inside a Bicep file

Answer

An Azure Key Vault secret data source

Answer

A Bicep module output parameter from a separate template

Question 6

Your company is deploying an Azure OpenAI gpt-4 model. You need to implement model versioning so that when Microsoft releases a newer model version, you can test it on a small subset of user traffic before rolling it out to all users. Which feature should you configure?

Accepted Answer

Create multiple model deployments with different version tags and configure traffic splitting weights.. Azure OpenAI supports deploying the same model with different version tags as separate deployments, and traffic splitting weights let you route a percentage of requests to a canary deployment for A/B testing. This is the native mechanism for controlled rollout of a new model version.

Answer

Enable dynamic scaling rules in Azure Kubernetes Service (AKS).

Answer

Configure Azure Traffic Manager with two regional endpoints.

Answer

Use Azure Application Gateway URL path-based routing.

Question 7

You are deploying an Azure AI Document Intelligence container in an on-premises disconnected environment. The container requires periodic license validation against Azure. What is the maximum duration the container can operate offline before requiring reconnection to Azure for billing and metering validation?

Accepted Answer

Up to 30 days. Azure AI Document Intelligence (formerly Form Recognizer) containers, like most Azure Cognitive Services containers, can run disconnected but must periodically report billing/metering data to Azure. Microsoft documents that the container will continue to operate offline for up to 30 days before it stops processing and requires reconnection for license validation. This 30-day window is the standard for Azure Cognitive Services disconnected containers.

Answer

Exactly 7 days

Answer

Maximum of 24 hours

Answer

Indefinitely without any connection required

Question 8

You need to programmatically check the health status of an Azure OpenAI service endpoint. Which HTTP method and path suffix should your health-check script use?

Accepted Answer

GET /openai/operations. Azure AI Services provide standard health check endpoints to verify service availability.

Answer

DELETE /openai/keys/revoke

Answer

POST /openai/deployments/delete

Answer

PUT /openai/models/update

Question 9

You are deploying an Azure AI resource and want to organize it logically within your Azure hierarchy. Which scope is the highest level at which you can assign Azure RBAC roles for your AI resource?

Accepted Answer

Management Group. Management Groups sit above subscriptions in the Azure hierarchy and are the highest scope at which Azure RBAC roles can be assigned for resources like Azure AI services. Assigning at a management group propagates permissions down to all subscriptions, resource groups, and resources within it.

Answer

Tenant root group

Answer

Resource Group

Answer

Azure AI Resource instance

Question 10

Your organization operates in a highly regulated financial sector. You are required to ensure that all data stored by your Azure AI services resource is encrypted using a custom encryption key managed by your team in Azure Key Vault, rather than a Microsoft-managed key. Which feature must you configure during resource creation?

Accepted Answer

Customer-Managed Keys (CMK) with Azure Key Vault. Customer-Managed Keys (CMK) with Azure Key Vault is the correct feature because it allows you to encrypt data at rest using your own encryption key stored in Azure Key Vault, rather than relying on Microsoft-managed keys. This satisfies regulatory requirements for key ownership and control. For Azure AI services resources that support CMK, you configure the key during resource creation so that training data and model artifacts stored in the associated storage account are encrypted with your key.

Answer

Storage Account Shared Access Signatures (SAS)

Answer

Microsoft Defender for Key Vault threat detection

Answer

Azure Information Protection sensitivity labels