AI-103 Plan And Manage AN Azure AI Solution — 20 Questions

Question 1

You are provisioning a new Azure AI Vision resource in the Azure Portal. You need to choose between a 'F0' free pricing tier and an 'S0' standard pricing tier. What is a key limitation of selecting the F0 pricing tier?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

It restricts the total number of calls allowed per month and limits transaction rates.. The F0 pricing tier restricts the total number of transactions allowed per month and limits concurrency.

Answer

It does not support regional data residency guarantees.

Answer

It disables diagnostic log streaming to Azure Monitor.

Answer

It prohibits the use of managed identities for authentication.

Question 2

You are deploying an Azure OpenAI resource and want to authenticate client applications using Microsoft Entra ID instead of static API keys. Which role must be assigned to the application's managed identity to permit it to invoke model deployments?

Accepted Answer

Cognitive Services OpenAI User. Cognitive Services OpenAI User is the standard least-privilege role assigned to principals that need to run inference against deployed models.

Answer

Storage Blob Data Contributor

Answer

Key Vault Secrets Officer

Answer

Contributor

Question 3

Your development team needs to deploy an Azure AI Language resource that can be accessed from an on-premises datacenter via an ExpressRoute circuit without traversing the public internet. Which Azure feature should you configure?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint injects a private IP address from a virtual network into the Azure AI resource, allowing secure access over ExpressRoute or VPN.

Answer

Azure Bastion host subnet

Answer

NAT gateway resource attachment

Answer

Azure Front Door with Web Application Firewall

Question 4

Your company's security policy requires that all Azure AI Services accounts disable public network access completely. However, internal applications hosted inside a specific Azure Virtual Network must still communicate with the AI services. How should you configure network access?

Accepted Answer

Disable public network access and configure a Private Endpoint for the resource.. Disabling public network access while enabling private endpoints ensures that traffic flows exclusively through the virtual network's private IP space.

Answer

Configure an inbound Network Security Group (NSG) rule on the AI resource subnet.

Answer

Keep public network access enabled and rely on API keys for security.

Answer

Deploy a VPN gateway inside the Azure AI resource group.

Question 5

Your enterprise organization provisions multiple Azure AI Services accounts across different subscriptions. Security mandates that all API keys must be automatically rotated every 30 days without human intervention. Which Azure service configuration should you implement?

Accepted Answer

Azure Key Vault automated secret rotation using an Azure Function. Azure Key Vault integrates with managed identities and Event Grid or Azure Automation to automate secret and API key rotation schedules.

Answer

Microsoft Defender for Cloud JIT access policies

Answer

Azure AI Services built-in automatic key rotation policy

Answer

Azure Monitor alert rules tied to Microsoft Entra ID

Question 6

You are deploying an Azure AI multi-service account in the West US region. The finance department requires that all resource deployment costs be tracked by department code using Azure Resource Manager tags. Which Azure feature should you use to enforce the mandatory application of the department tag across all future Azure AI resource deployments?

Accepted Answer

Azure Policy. Azure Policy enables the enforcement of resource properties and tags at scale during deployment by evaluating resource definitions against rule conditions such as 'Tags'.

Answer

Azure Cost Management budgets

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Question 7

You are designing a monitoring solution for an Azure AI Document Intelligence resource that processes thousands of invoices daily. You need to track custom metric alerts when HTTP 429 (Too Many Requests) errors exceed a specific threshold over a 5-minute window. Where should you configure this alert?

Accepted Answer

Azure Monitor metric alerts. Azure Monitor metric alerts allow you to evaluate platform metrics such as 'Total Calls' or 'HTTP 429' against dynamic or static thresholds.

Answer

Application Insights availability web tests

Answer

Microsoft Defender for Cloud threat protection policies

Answer

Azure AI Studio diagnostics dashboard

Question 8

You are managing an enterprise Azure OpenAI deployment with high traffic volumes. To prevent unexpected bill increases due to sudden usage spikes, you need to implement a cost-control mechanism that halts requests once a specific financial limit is reached. What is the native approach to achieve this?

Accepted Answer

Configure an Azure API Management (APIM) policy to track token usage and reject requests when the quota is exceeded.. Azure AI Services do not have a built-in automated hard-stop mechanism based directly on spend thresholds; however, budgets with action groups can trigger alerts or automated runbooks, though real-time hard stopping typically requires throttling or custom API management policies.

Answer

Set a hard spending limit directly inside the Azure AI Services resource properties pane.

Answer

Create an Azure Cost Management budget with an action group running a script to delete the OpenAI resource.

Answer

Enable Microsoft Defender for Cloud auto-remediation rules for high billing.

Question 9

Your organization uses Azure Monitor diagnostic settings to route logs and metrics for all Azure AI services to a centralized Log Analytics workspace. You need to write a Kusto Query Language (KQL) query to find all incoming API requests that resulted in an HTTP 500 server error over the last 24 hours. Which table should you query?

Accepted Answer

AzureDiagnostics. Azure AI Services diagnostic logs are sent to the AzureDiagnostics table when using legacy resource-specific or workspace-based diagnostic settings.

Answer

AppTraces

Answer

AzureActivity

Answer

SecurityEvent

Question 10

You are deploying a custom text classification model using Azure AI Language. The model undergoes frequent retraining as new business data arrives. You need to establish a model versioning strategy that allows zero-downtime client updates while ensuring seamless rollback capability if regression occurs. What is the recommended architectural approach?

Accepted Answer

Deploy each model version with a unique deployment name and update the application client configuration or routing rules to shift traffic progressively.. Deploying models with distinct version identifiers and updating the endpoint configuration or using deployment slots/version tags allows routing traffic dynamically.

Answer

Delete the original resource before deploying the updated model version.

Answer

Overwrite the existing model artifact in place with the new training run using the exact same name.

Answer

Create a completely new Azure AI resource in a different subscription for every single model iteration.

Question 11

You are provisioning a multi-service Azure AI resource using an Azure Resource Manager (ARM) template. Which resource type should you specify in the template for a generic multi-service cognitive services account?

Accepted Answer

Microsoft.CognitiveServices/accounts. The standard resource type for a multi-service Cognitive Services account in ARM templates is 'Microsoft.CognitiveServices/accounts'.

Answer

Microsoft.AI/cognitiveServices

Answer

Microsoft.CognitiveServices/projects

Answer

Microsoft.MachineLearningServices/workspaces

Question 12

Your security team discovers that an application using Azure AI Services is intermittently failing with authentication errors due to expired client secrets. You need to refactor the application to use Microsoft Entra ID workﬂows with managed identities. Which authentication library should your application code use to acquire tokens securely without embedding secrets?

Accepted Answer

Microsoft Authentication Library (MSAL). The Microsoft Authentication Library (MSAL) is the standard library used to acquire tokens from Microsoft Entra ID for managed identities or service principals.

Answer

Azure Storage Data Movement Library

Answer

System.Net.Http WebRequestHandler

Answer

Azure SDK for .NET Management Client

Question 13

You are planning the disaster recovery strategy for an Azure AI Translator resource. In the event of a regional outage in East US, you want to ensure minimal downtime and continuity of service. Which deployment model should you select?

Accepted Answer

Deploy a primary resource in East US and a secondary resource in the paired region (West US), then implement client-side failover logic.. Deploying paired or secondary multi-service resources in a secondary paired region allows applications to failover to the secondary endpoint.

Answer

Configure an Azure Backup vault to snapshot the AI model weights daily.

Answer

Store all translation requests in Azure Blob Storage and replay them when the region recovers.

Answer

Rely on Azure's native synchronous cross-region database replication for cognitive services.

Question 14

Your development team needs to deploy an Azure OpenAI model deployment in an enterprise environment. They require provisioned throughput units (PTUs) to guarantee predictable latency and throughput for a mission-critical chatbot. Where can you purchase and manage PTU allocations?

Accepted Answer

Azure Portal or Azure OpenAI Studio during model deployment creation by selecting the Provisioned tier.. Provisioned Throughput Units (PTUs) for Azure OpenAI are purchased and allocated through Azure Portal or Azure OpenAI Studio under resource management when selecting provisioned pricing models.

Answer

Azure DevOps pipeline YAML configuration files.

Answer

Microsoft 365 Admin Center under billing subscriptions.

Answer

Visual Studio Enterprise subscription benefit portal.

Question 15

You are deploying an Azure AI Speech resource. Your compliance team stipulates that all data sent to the speech service must be processed strictly within the geographical boundaries of the European Union and must not be used for Microsoft's model training. How should you ensure this compliance?

Accepted Answer

Deploy the Speech resource in an EU-based region (such as West Europe) and review the data privacy and residency terms.. Azure AI Services comply with regional data residency and offer data privacy controls ensuring customer data is stored at rest in the specified region and not used for training without explicit opt-in.

Answer

Enable Azure Policy to encrypt all audio files using customer-managed keys (CMK).

Answer

Configure an Azure Firewall instance to inspect and drop audio payloads destined outside the EU.

Question 16

You are setting up cost alerts for your Azure subscription, which contains several Azure AI services resources. You want to receive an email notification when your month-to-date spending reaches 80% of your $5,000 budget. Which feature should you configure?

Accepted Answer

Azure Cost Management budgets and alerts. Azure Cost Management budgets allow you to set spending thresholds and associate them with action groups for email notifications.

Answer

Microsoft Defender for Cloud security alerts

Answer

Azure Monitor activity log alerts

Answer

Azure Advisor cost recommendations

Question 17

You are designing an automated pipeline to deploy Azure AI Custom Vision projects using Infrastructure as Code (IaC) with Bicep. You need to reference an existing Custom Vision training resource in your deployment script without hardcoding its endpoint URL or primary key. Which Bicep construct should you use to retrieve these properties dynamically?

Accepted Answer

The Bicep 'existing' keyword reference. The 'existing' keyword in Bicep allows you to reference an already deployed Azure resource to read its properties or output keys without recreating it.

Answer

The ARM template 'reference()' function inside a Bicep file

Answer

An Azure Key Vault secret data source

Answer

A Bicep module output parameter from a separate template

Question 18

Your company is deploying an Azure OpenAI gpt-4 model. You need to implement model versioning so that when Microsoft releases a newer model version, you can test it on a small subset of user traffic before rolling it out to all users. Which feature should you configure?

Accepted Answer

Create multiple model deployments with different version tags and configure traffic splitting weights.. Azure OpenAI model deployments support setting weight allocations or creating multiple deployments for canary testing and traffic splitting.

Answer

Enable dynamic scaling rules in Azure Kubernetes Service (AKS).

Answer

Configure Azure Traffic Manager with two regional endpoints.

Answer

Use Azure Application Gateway URL path-based routing.

Question 19

You are auditing your Azure subscription and find several unused Azure AI Content Safety resources that are incurring base charges. You want to remove the resources permanently. Which operation should you perform?

Accepted Answer

Delete the Azure AI Content Safety resource from the Azure portal.. Deleting the resource group or the individual Azure AI resource via the Azure portal or CLI permanently removes it and stops all associated charges.

Answer

Remove the role assignments from the resource.

Answer

Stop the Azure AI Content Safety resource state.

Answer

Disable the keys associated with the resource.

Question 20

You are deploying an Azure AI Document Intelligence container in an on-premises disconnected environment. The container requires periodic license validation against Azure. What is the maximum duration the container can operate offline before requiring reconnection to Azure for billing and metering validation?

Accepted Answer

Up to 30 days. Disconnected containers for Azure AI services require synchronization with Azure at least every designated billing period, typically up to 29 or 30 days depending on the specific service terms.

Answer

Exactly 7 days

Answer

Maximum of 24 hours

Answer

Indefinitely without any connection required