AI-103 Plan And Manage AN Azure AI Solution Practice Test 2 — 15 Questions

Question 1

Your organization is implementing a model versioning and rollout strategy for Azure OpenAI deployments. Which TWO practices ensure safe deployment and quick rollback capabilities? Each correct answer presents part of the solution.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy new model versions with distinct deployment names alongside existing versions.. Option C is correct because Azure OpenAI deployments are referenced by deployment name, so creating a new deployment name for each model version lets the old deployment keep serving traffic while the new version is validated, and rollback simply means pointing clients back to the previous deployment name. Option D is correct because Azure OpenAI supports weighted traffic distribution across multiple deployments, enabling a canary release where a small percentage of requests hit the new model version while the majority continue using the stable version, so problems can be detected before full rollout and traffic weights can be reverted instantly. Option A is wrong because deleting the resource group removes all deployments, endpoints, and configuration, eliminating any rollback path and causing an outage. Option B is wrong because overwriting weights in place with the same deployment name destroys the previous version, so there is nothing to roll back to. Option E is wrong because hardcoding version numbers in immutable binaries prevents dynamic switching or rollback without recompiling and redeploying clients.

Answer

Delete the entire Azure AI resource group prior to every model update.

Answer

Overwrite existing model weights in place without changing deployment names.

Answer

Hardcode model version numbers directly inside immutable compiled client binaries.

Question 2

You are provisioning a new Azure AI multi-service account in the West US region for an enterprise application. Which pricing tier should you select to ensure the account supports all available Azure AI capabilities including Custom Neural Voice and Content Moderator?

Accepted Answer

Standard (S0). The Standard (S0) pricing tier is the only Azure AI multi-service account tier that supports the full range of Azure AI capabilities, including premium features like Custom Neural Voice and Content Moderator. Free (F0) has strict quota limits and excludes many advanced features, while B0 and I0 are not valid multi-service tiers for this purpose. S0 is the production-grade tier required for enterprise deployments needing all capabilities.

Answer

Free (F0)

Answer

Isolated (I0)

Answer

Basic (B0)

Question 3

Your enterprise organization operates under strict data residency and sovereignty requirements. You are deploying Azure OpenAI and Azure AI Language services. Which THREE architectural decisions ensure compliance with data residency mandates? Each correct answer presents part of the solution.

Accepted Answer

Verify Microsoft's data privacy commitments guaranteeing that customer data is not used to train base models.. Option A is correct because Microsoft's data privacy commitments for Azure OpenAI and Azure AI Language explicitly state that customer data (prompts, completions, and training data) is not used to train or improve the base foundation models, which is a foundational contractual safeguard for data sovereignty and residency compliance. Option B is correct because diagnostic logs can contain request/response metadata and customer content, so storing them in a storage account within the same region and compliance boundary prevents data from leaving the mandated jurisdiction, satisfying residency requirements. Option E is correct because deploying all Azure AI resources (Azure OpenAI and Azure AI Language) exclusively in the compliant domestic Azure region, such as Australia Southeast, ensures that data at rest and in processing remains within that geographic boundary, which is the core technical control for data residency. Option C is incorrect because storing unencrypted customer prompts on public GitHub repositories exposes sensitive data globally and violates both residency and security mandates. Option D is incorrect because routing inference requests through public relay nodes in foreign countries transfers data across borders, directly breaching data residency and sovereignty requirements.

Answer

Store unencrypted customer prompts on public GitHub repositories.

Answer

Route all inference requests through public relay nodes located in foreign countries to save bandwidth costs.

Question 4

You are migrating an Azure AI Speech service resource to a different Azure subscription within the same tenant. Which mechanism should you use to preserve the existing custom voice models and configurations?

Accepted Answer

Use the Azure portal resource move feature to transfer the Speech resource to the target subscription.. The Azure portal resource move feature supports moving a Cognitive Services (Azure AI Speech) resource to another subscription within the same tenant, and custom voice models and configurations associated with the resource are preserved because the resource's identity and data move with it. This is the supported mechanism for cross-subscription migration within a tenant. Recreating or redeploying would lose the custom models.

Answer

Export custom models as JSON and import them via the Speech Studio in the new subscription.

Answer

Export the resource ARM template and deploy it to the target subscription.

Answer

Recreate the custom models from scratch in the new subscription using a new Speech resource.

Question 5

You need to restrict access to an Azure AI Custom Vision training resource so that only members of a specific Azure AD security group can manage projects and train models. How should you configure access control?

Accepted Answer

Assign the Cognitive Services Contributor role to the Azure AD security group at the resource scope.. Azure RBAC is the correct mechanism to restrict management and training operations to a specific Microsoft Entra ID security group. Assigning the Cognitive Services Contributor role at the resource scope grants members of that group the necessary permissions to manage projects and train models, while excluding all other users. This follows the principle of least privilege using built-in roles.

Answer

Configure IP firewall rules on the networking blade.

Answer

Enable managed identity on the resource and assign it to the security group.

Answer

Generate and distribute secondary API keys to group members.

Question 6

You are designing a disaster recovery strategy for an Azure AI Document Intelligence resource. The business requirement is a Recovery Point Objective (RPO) of zero and Recovery Time Objective (RTO) of less than 15 minutes. Which deployment strategy should you select?

Accepted Answer

Deploy two identical Azure AI resources in paired regions and use Azure Front Door with priority routing for automatic failover.. An RPO of zero requires synchronous replication of data and model state between two live deployments, and an RTO under 15 minutes requires automated traffic failover. Deploying two identical Azure AI resources in paired regions and fronting them with Azure Front Door priority routing achieves both: data is continuously replicated (or the resources are kept in lockstep), and Front Door health probes automatically shift traffic to the secondary region within seconds when the primary fails. This is the only option that delivers both zero data loss and sub-15-minute recovery.

Answer

Configure geo-replication on a standard single-service resource using the Azure CLI without front-end routing.

Answer

Use Azure Site Recovery to replicate the Azure AI virtual machine host nodes directly.

Answer

Take daily backups of the trained custom models by exporting them to Azure Blob Storage in the same region.

Question 7

You are deploying a custom model to an Azure AI managed endpoint. You need to ensure the deployment can access a Key Vault secret without storing credentials in the deployment configuration. What should you do?

Accepted Answer

Assign a User-assigned managed identity to the endpoint and grant it Key Vault Secrets User access.. A User-assigned managed identity is the correct choice because it can be pre-created, granted Key Vault Secrets User RBAC role, and then attached to the endpoint, allowing the deployment to fetch secrets via the Key Vault data plane without any stored credentials. The Key Vault Secrets User role specifically grants read access to secret contents, which is exactly what the deployment needs. User-assigned identities also survive resource recreation, making them preferable for production deployments.

Answer

Enable public access on the Key Vault and use an IP firewall rule.

Answer

Inject the secret directly into the environment variables during deployment.

Answer

Configure a System-assigned identity on the endpoint and grant it Key Vault Reader access.

Question 8

You have an Azure AI Search service. You need to monitor the number of failed queries to identify potential indexing issues. Which tool should you use?

Accepted Answer

The 'Metrics' blade in the Azure portal for the Search service.. The 'Metrics' blade in the Azure portal for the Azure AI Search service provides platform-level metrics that include query-related telemetry such as 'Search Queries per Second' and 'Throttled Search Queries'. Failed queries due to indexing issues (e.g., missing documents, schema mismatches) often manifest as a drop in successful queries or an increase in throttled queries, which can be monitored via these metrics. Metrics are specifically designed for monitoring performance and health of the search service, making them the correct tool for identifying query failures.

Answer

The 'Activity Log' in the Subscription blade.

Answer

The 'Security Center' recommendation dashboard.

Answer

The 'Resource Health' blade.

Question 9

A company requires that all AI models be approved by a compliance officer before they are deployed to production. Which feature facilitates this workflow?

Accepted Answer

Azure AI Model Registry versioning and tagging.. Azure AI Model Registry versioning and tagging allows you to assign custom tags to model versions, such as 'ApprovedByCompliance' or 'PendingReview'. These tags can be used to enforce deployment gates—for example, a CI/CD pipeline can check for the presence of an approval tag before deploying to production. This directly supports a compliance approval workflow by making the approval status a first-class attribute of the model version.

Answer

Azure Service Bus queues.

Answer

Blob Storage access policies.

Answer

Azure Function webhooks.

Question 10

Which THREE authentication/authorization mechanisms are supported for accessing Azure AI services securely?

Accepted Answer

Azure AI API Keys.. Azure AI API Keys (option A) are a supported authentication mechanism: requests to Azure AI services endpoints are authenticated by passing a subscription key in headers such as Ocp-Apim-Subscription-Key or api-key, and keys can be regenerated and rotated per resource. Microsoft Entra ID with RBAC (option C) is also supported: it enables token-based authentication via OAuth 2.0 bearer tokens and authorization through Azure role assignments such as Cognitive Services User, allowing keyless, least-privilege access. Shared Access Signatures (option D) are supported for Azure AI services that expose blob-backed storage, such as Azure AI Vision or Azure AI Language custom models, where a SAS token grants time-limited, scoped access to the underlying storage resources. FTP credentials (option B) are not an authentication mechanism for Azure AI service endpoints, and anonymous public access (option E) is not supported because these services require authenticated requests.

Answer

FTP credentials.

Answer

Anonymous public access.

Question 11

You are deploying an Azure OpenAI solution that must be accessible only from a specific subnet within your virtual network. You need to configure the Azure OpenAI resource to restrict access to that subnet. What should you do?

Accepted Answer

Add a virtual network rule to the Azure OpenAI resource that allows the specific subnet.. Virtual network rules on Azure OpenAI allow you to specify which subnets can access the service. When you add a rule for a subnet and set the default action to Deny, only resources within that subnet are permitted. This is the correct method to restrict access to a specific subnet without deploying additional infrastructure.

Answer

Configure a private endpoint for the Azure OpenAI resource and disable public network access.

Answer

Deploy an Azure Application Gateway in front of the Azure OpenAI endpoint and configure URL path-based routing.

Answer

Assign a managed identity to the Azure OpenAI resource and grant it access to the subnet.

Question 12

You are managing an Azure AI Search service that indexes sensitive data. Your security team requires that all data stored in the search index be encrypted with a customer-managed key (CMK) stored in Azure Key Vault. You need to configure the search service to meet this requirement. What should you do first?

Accepted Answer

Assign a system-assigned managed identity to the search service and grant it access to the Key Vault.. To use customer-managed keys with Azure AI Search, the service must have a managed identity that is authorized to access the Key Vault. The first step is to assign a managed identity to the search service and grant it the necessary permissions on the Key Vault. Only then can you enable CMK encryption and select the key.

Answer

Configure the search service to use a user-assigned managed identity instead of a system-assigned identity.

Answer

Create an Azure Key Vault and generate a new key, then enable CMK encryption on the search service.

Answer

Enable soft-delete and purge protection on the Key Vault to meet compliance requirements.

Question 13

You are designing an Azure AI solution that must be highly available across multiple regions. You need to ensure that the solution can continue to operate if one region fails. Which two actions should you include in your design? (Choose two.)

Accepted Answer

Configure Azure Traffic Manager to route traffic to the closest available region.. To achieve high availability across regions, you should deploy the Azure AI service resources in multiple regions and use a global load balancer like Azure Traffic Manager to route traffic to a healthy region. This combination ensures that if one region fails, traffic is automatically redirected to another region, maintaining service availability.

Answer

Enable zone redundancy for each Azure AI service resource.

Answer

Use a single Azure OpenAI resource with a custom domain and multiple endpoints.

Answer

Implement a read-only replica of the Azure AI service in a secondary region.

Question 14

You are provisioning a new Azure AI Vision resource in the Azure Portal. You need to choose between a 'F0' free pricing tier and an 'S0' standard pricing tier. What is a key limitation of selecting the F0 pricing tier?

Accepted Answer

It restricts the total number of calls allowed per month and limits transaction rates.. The F0 (free) tier for Azure AI Vision is designed for evaluation and small-scale testing, and it enforces both a monthly call quota (e.g., 5,000 transactions per month for many Vision APIs) and a low transactions-per-second (TPS) rate limit. Exceeding either causes 429 throttling or 403 quota-exceeded errors, which is why F0 is unsuitable for production workloads.

Answer

It does not support regional data residency guarantees.

Answer

It disables diagnostic log streaming to Azure Monitor.

Answer

It prohibits the use of managed identities for authentication.

Question 15

You are deploying an Azure OpenAI resource and want to authenticate client applications using Microsoft Entra ID instead of static API keys. Which role must be assigned to the application's managed identity to permit it to invoke model deployments?

Accepted Answer

Cognitive Services OpenAI User. The Cognitive Services OpenAI User role is the RBAC role specifically scoped to grant data-plane access for invoking Azure OpenAI model deployments (chat completions, embeddings, etc.) without granting management permissions. Assigning it to the application's managed identity lets the app call the inference endpoints using Entra ID tokens instead of API keys. This follows the least-privilege principle for OpenAI resource consumption.

Answer

Storage Blob Data Contributor

Answer

Key Vault Secrets Officer

Answer

Contributor