AI-103 Plan And Manage AN Azure AI Solution Practice Test 3 — 15 Questions

Question 1

Your development team needs to deploy an Azure AI Language resource that can be accessed from an on-premises datacenter via an ExpressRoute circuit without traversing the public internet. Which Azure feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint assigns a private IP from your VNet to the Azure AI Language resource, so traffic from on-premises over ExpressRoute reaches the service via private IP without traversing the public internet. This is the standard Private Link pattern for PaaS services.

Answer

Azure Bastion host subnet

Answer

NAT gateway resource attachment

Answer

Azure Front Door with Web Application Firewall

Question 2

Your company's security policy requires that all Azure AI Services accounts disable public network access completely. However, internal applications hosted inside a specific Azure Virtual Network must still communicate with the AI services. How should you configure network access?

Accepted Answer

Disable public network access and configure a Private Endpoint for the resource.. To disable public network access while allowing internal applications in a specific Azure Virtual Network to communicate with Azure AI Services, you should disable public network access and configure a Private Endpoint. This creates a private IP address in the VNet for the service, enabling secure private connectivity.

Answer

Configure an inbound Network Security Group (NSG) rule on the AI resource subnet.

Answer

Keep public network access enabled and rely on API keys for security.

Answer

Deploy a VPN gateway inside the Azure AI resource group.

Question 3

Your enterprise organization provisions multiple Azure AI Services accounts across different subscriptions. Security mandates that all API keys must be automatically rotated every 30 days without human intervention. Which Azure service configuration should you implement?

Accepted Answer

Azure Key Vault automated secret rotation using an Azure Function. Azure Key Vault automated secret rotation using an Azure Function is correct because Key Vault supports rotation policies that can trigger an Azure Function to generate new keys and update the AI Services account automatically. This enables fully automated, scheduled rotation without human intervention. The Azure Function can call the Azure AI Services management API to regenerate keys and store the new keys back in Key Vault.

Answer

Microsoft Defender for Cloud JIT access policies

Answer

Azure AI Services built-in automatic key rotation policy

Answer

Azure Monitor alert rules tied to Microsoft Entra ID

Question 4

You are deploying an Azure AI multi-service account in the West US region. The finance department requires that all resource deployment costs be tracked by department code using Azure Resource Manager tags. Which Azure feature should you use to enforce the mandatory application of the department tag across all future Azure AI resource deployments?

Accepted Answer

Azure Policy. Azure Policy is the governance service that enforces organizational standards by evaluating resources against rules and taking effects such as deny, audit, or append. A policy with an 'append' or 'deny' effect on the tag requirement enforces mandatory department tags across all future deployments.

Answer

Azure Cost Management budgets

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Question 5

You are deploying a custom text classification model using Azure AI Language. The model undergoes frequent retraining as new business data arrives. You need to establish a model versioning strategy that allows zero-downtime client updates while ensuring seamless rollback capability if regression occurs. What is the recommended architectural approach?

Accepted Answer

Deploy each model version with a unique deployment name and update the application client configuration or routing rules to shift traffic progressively.. Azure AI Language custom models are consumed through deployments, and each deployment has a unique name that maps to a specific model version. By deploying each new version under a unique deployment name and updating client configuration or routing rules, you can shift traffic progressively and roll back instantly by pointing clients back to the previous deployment. This achieves zero-downtime updates and seamless rollback.

Answer

Delete the original resource before deploying the updated model version.

Answer

Overwrite the existing model artifact in place with the new training run using the exact same name.

Answer

Create a completely new Azure AI resource in a different subscription for every single model iteration.

Question 6

You are provisioning a multi-service Azure AI resource using an Azure Resource Manager (ARM) template. Which resource type should you specify in the template for a generic multi-service cognitive services account?

Accepted Answer

Microsoft.CognitiveServices/accounts. In Azure Resource Manager templates, a multi-service Azure AI (Cognitive Services) account is declared with the resource type 'Microsoft.CognitiveServices/accounts'. This resource type provisions a single account that exposes multiple AI service endpoints (such as Vision, Language, and Speech) under one key and endpoint, which is exactly what a generic multi-service resource requires.

Answer

Microsoft.AI/cognitiveServices

Answer

Microsoft.CognitiveServices/projects

Answer

Microsoft.MachineLearningServices/workspaces

Question 7

Your security team discovers that an application using Azure AI Services is intermittently failing with authentication errors due to expired client secrets. You need to refactor the application to use Microsoft Entra ID workﬂows with managed identities. Which authentication library should your application code use to acquire tokens securely without embedding secrets?

Accepted Answer

Microsoft Authentication Library (MSAL). Microsoft Authentication Library (MSAL) is the recommended library for acquiring tokens from Microsoft Entra ID, including tokens for managed identities and service principals. MSAL handles token caching, refresh, and secure acquisition without embedding secrets in code. Using MSAL with managed identities lets the application authenticate without storing client secrets, directly addressing the expired-secret failures.

Answer

Azure Storage Data Movement Library

Answer

System.Net.Http WebRequestHandler

Answer

Azure SDK for .NET Management Client

Question 8

You are planning the disaster recovery strategy for an Azure AI Translator resource. In the event of a regional outage in East US, you want to ensure minimal downtime and continuity of service. Which deployment model should you select?

Accepted Answer

Deploy a primary resource in East US and a secondary resource in the paired region (West US), then implement client-side failover logic.. Azure AI Translator does not provide automatic cross-region failover or built-in geo-replication for the translation endpoint. The recommended disaster recovery pattern is to deploy the resource in two regions (ideally a paired region such as East US / West US) and implement client-side failover logic that switches the endpoint and key when the primary region is unavailable. This achieves minimal downtime without relying on features the service does not offer.

Answer

Configure an Azure Backup vault to snapshot the AI model weights daily.

Answer

Store all translation requests in Azure Blob Storage and replay them when the region recovers.

Answer

Rely on Azure's native synchronous cross-region database replication for cognitive services.

Question 9

Your development team needs to deploy an Azure AI Language resource that can be accessed from an on-premises datacenter via an ExpressRoute circuit without traversing the public internet. Which Azure feature should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Portal or Azure OpenAI Studio during model deployment creation by selecting the Provisioned tier.. Provisioned Throughput Units (PTUs) for Azure OpenAI are purchased and managed through the Azure Portal or Azure OpenAI Studio when creating or updating a model deployment by selecting the Provisioned deployment type. This is where you specify the PTU quantity, associate it with the Azure OpenAI resource, and manage capacity reservations for predictable latency and throughput.

Answer

Azure DevOps pipeline YAML configuration files.

Answer

Microsoft 365 Admin Center under billing subscriptions.

Answer

Visual Studio Enterprise subscription benefit portal.

Question 10

You are setting up cost alerts for your Azure subscription, which contains several Azure AI services resources. You want to receive an email notification when your month-to-date spending reaches 80% of your $5,000 budget. Which feature should you configure?

Accepted Answer

Azure Cost Management budgets and alerts. Azure Cost Management budgets and alerts allow you to set a budget and configure alerts based on actual or forecasted spending thresholds, such as 80% of a $5,000 budget. This is the correct feature for cost monitoring and notifications.

Answer

Microsoft Defender for Cloud security alerts

Answer

Azure Monitor activity log alerts

Answer

Azure Advisor cost recommendations

Question 11

You are auditing your Azure subscription and find several unused Azure AI Content Safety resources that are incurring base charges. You want to remove the resources permanently. Which operation should you perform?

Accepted Answer

Delete the Azure AI Content Safety resource from the Azure portal.. Deleting the Azure AI Content Safety resource removes it permanently from the subscription, which stops all billing including any base or provisioned charges. Since the requirement is to remove unused resources permanently, deletion is the only operation that eliminates the resource and its associated costs.

Answer

Remove the role assignments from the resource.

Answer

Stop the Azure AI Content Safety resource state.

Answer

Disable the keys associated with the resource.

Question 12

You are provisioning a new Azure AI Search service. You need to choose a pricing tier that supports semantic search capabilities. Which minimum tier should you select?

Accepted Answer

Standard (S1). Semantic search in Azure AI Search requires the Standard tier (S1) or higher. The Basic and Free tiers do not support semantic ranker, which uses deep learning models to re-rank results. Storage Optimized tiers are for large-scale storage but also support semantic search; however, the question asks for the minimum tier, and Standard is the lowest tier that includes semantic search. Therefore, Standard (S1) is correct.

Answer

Basic

Answer

Free

Answer

Storage Optimized (L1)

Question 13

Your organization has multiple Azure AI services deployed across different resource groups. Your security officer requests a centralized dashboard to monitor security recommendations, vulnerability assessments, and compliance posture for all AI resources. Which Azure service should you open?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides a centralized security posture management dashboard that aggregates security recommendations, vulnerability assessments, regulatory compliance, and threat protection across Azure resources, including Azure AI services. It is the correct service to open when a security officer requests a unified view of security recommendations and compliance posture across multiple resource groups.

Answer

Azure Advisor

Answer

Microsoft Entra ID protection portal

Answer

Azure Policy compliance blade

Question 14

You are deploying an Azure AI Speech container on an Azure Kubernetes Service (AKS) cluster. Your security policy dictates that pod-to-pod communication within the cluster must be encrypted in transit using mTLS, and egress traffic to Azure must flow through a strict outbound firewall. Which Kubernetes feature should you implement?

Accepted Answer

Kubernetes Network Policies combined with a service mesh for mTLS. Kubernetes Network Policies enforce pod-level traffic rules (including egress restrictions to a firewall), while a service mesh (e.g., Istio, Linkerd, or Open Service Mesh) provides automatic mTLS for pod-to-pod communication. Together they satisfy both requirements: encrypted in-transit pod traffic and strict egress control. This is the standard AKS pattern for zero-trust pod networking.

Answer

Azure Container Registry vulnerability scanning

Answer

Azure Bastion deployed inside the AKS worker node subnet

Answer

AKS cluster auto-scaler configuration

Question 15

You are managing an Azure AI Search service with multiple replicas and partitions. During peak query hours, latency increases significantly, and CPU utilization on the search service hits 95%. You need to scale the service to improve query throughput without altering the index data schema. Which scaling action should you take?

Accepted Answer

Increase the number of search replicas in the Azure portal or via CLI.. Adding replicas increases the number of copies of the index that can serve queries, directly improving query throughput and distributing CPU load across more nodes. Since the issue is high query CPU utilization and latency during peak hours, scaling replicas is the correct horizontal scale-out for read/query performance.

Answer

Increase the number of search partitions.

Answer

Disable semantic ranking to reduce compute overhead.

Answer

Migrate the service to the Free pricing tier.