AI-103 Plan And Manage AN Azure AI Solution Practice Test 4 — 15 Questions

Question 1

Your organization wants to ensure that all Azure AI resources created in any subscription across the tenant adhere to a standardized naming convention (e.g., prefixing with 'ai-'). Which Azure governance tool should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with custom naming convention rules. Azure Policy can enforce naming conventions by evaluating resource names against regular expressions upon creation.

Answer

Microsoft Defender for Cloud

Answer

Azure Cost Management budgets

Answer

Azure Advisor

Question 2

You are managing an Azure OpenAI model deployment in an active-passive multi-region disaster recovery architecture. A regional outage occurs, and you failover traffic to the secondary region. However, clients report receiving authentication errors. What is the most likely cause?

Accepted Answer

The client application's managed identity has not been granted the required RBAC roles on the secondary Azure OpenAI resource.. Managed identities are region-specific or require proper role assignments on the secondary resource instance.

Answer

Azure automatically deletes API keys during a regional failover.

Answer

Azure OpenAI models require re-training after any regional failover event.

Answer

The primary region's DNS zone must be manually deleted for failover to work.

Question 3

You are deploying an Azure AI Speech resource using an ARM template. Which parameter defines the name of the resource instance?

Accepted Answer

name. The 'name' property in ARM template resource definitions specifies the name of the resource.

Answer

sku

Answer

location

Answer

kind

Question 4

Your enterprise team is deploying multiple Azure AI Custom Vision resources across different development stages (Dev, Test, Prod). You need to ensure that billing costs for the Dev environment are billed to a specific cost center. Which Azure feature should you use to categorize these costs?

Accepted Answer

Azure resource tags. Azure resource tags allow categorizing resources for cost allocation and management reporting.

Answer

Azure role-based access control (RBAC)

Answer

Azure Service Health alerts

Answer

Azure Firewall rules

Question 5

You are provisioning an Azure AI services account and want to view your current API key. Where can you retrieve the API key in the Azure portal?

Accepted Answer

Keys and Endpoint blade of the resource. The 'Keys and Endpoint' blade of an Azure AI resource displays the generated primary and secondary keys.

Answer

Resource graph explorer

Answer

Azure Advisor cost optimization pane

Answer

Azure Active Directory overview page

Question 6

You are designing an automated deployment pipeline for Azure AI Search using GitHub Actions. The pipeline must authenticate to Azure securely without storing credentials or long-lived secrets in GitHub repository settings. Which authentication mechanism should you implement?

Accepted Answer

OpenID Connect (OIDC) with Azure workload identity federation. Federated identity credentials with OpenID Connect (OIDC) allow GitHub Actions to authenticate to Azure without storing secrets.

Answer

Hardcoded administrator API keys stored in GitHub Action variables

Answer

A personal access token (PAT) with full subscription ownership

Answer

Anonymous access enabled during deployment time

Question 7

You are provisioning an Azure AI services account and need to select the kind of resource. Which kind parameter value should you select for an Azure OpenAI deployment?

Accepted Answer

OpenAI. The 'OpenAI' kind is specified when creating Azure OpenAI resources.

Answer

CognitiveSearch

Answer

MachineLearning

Answer

BotService

Question 8

Your organization is deploying an Azure OpenAI resource. Your security policy requires that all network traffic destined for the OpenAI service must traverse a secure hub-and-spoke virtual network topology and pass through an Azure Firewall instance. How should you route outbound traffic from your application subnet to Azure OpenAI?

Accepted Answer

Configure User Defined Routes (UDR) on the application subnet with a next hop pointing to the Azure Firewall.. User Defined Routes (UDR) allow you to override default Azure routing tables and force traffic through an Azure Firewall or network virtual appliance.

Answer

Configure Azure Traffic Manager dns routing.

Answer

Attach an Azure Bastion subnet to the firewall.

Answer

Rely on automatic default system routing without route tables.

Question 9

Your organization is running multiple Azure AI services. You need to configure alerts so that when the availability of any AI service drops below 99.% over a 15-minute window, an incident is created in ServiceNow. Which Azure Monitor feature should you use?

Accepted Answer

Azure Monitor metric alerts combined with Action Groups configured with a Webhook receiver. Azure Monitor metric alerts integrated with Action Groups allow sending notifications to webhooks (such as ServiceNow).

Answer

Azure Cost Management alerts

Answer

Azure Advisor performance recommendations

Answer

Microsoft Defender for Cloud threat detection

Question 10

You are designing a high-throughput, low-latency architecture for an Azure OpenAI application. Clients are distributed globally across North America, Europe, and Asia. To ensure minimal latency and high availability, you decide to deploy multiple Azure OpenAI instances in different regions. How should you route incoming client requests to the nearest optimal region?

Accepted Answer

Azure Front Door with latency-based routing. Azure Front Door provides global HTTP/HTTPS load balancing, latency-based routing, and web application firewall protection.

Answer

Azure ExpressRoute global reach

Answer

Azure Bastion global routing profile

Answer

Azure Local Traffic Manager (LTM)

Question 11

You are managing an enterprise Azure AI Search deployment. During an audit, you notice that index data is encrypted at rest using Microsoft-managed keys. Management mandates that you switch to customer-managed keys (CMK) stored in Azure Key Vault immediately without losing index data or rebuilding the service. How should you implement this?

Accepted Answer

Configure encryption with customer-managed keys in the Azure portal on the existing search service instance and assign necessary Key Vault access permissions.. Azure AI Search supports updating an existing service to use customer-managed keys by configuring Key Vault integration on the existing service instance.

Answer

Delete the search service and provision a brand new one with CMK enabled from inception.

Answer

Modify the DNS records to point to a new CMK-encrypted endpoint.

Answer

Run an Azure Automation runbook that exports indices to blob storage, deletes the service, and restores it.

Question 12

You are planning the security architecture for an enterprise Azure AI multi-service account. Management requires that access to the resource be strictly controlled and audited. Which TWO security features or configurations should you implement? Each correct answer presents part of the solution.

Accepted Answer

Disable local authentication (API key access) and require Microsoft Entra ID authentication.. Disabling local auth enforces Entra ID, and Private Endpoints secure network traffic.

Answer

Store all admin API keys permanently in an unencrypted Azure Blob Storage container.

Answer

Grant the Contributor role to all end-user client applications.

Answer

Enable anonymous public access across all subnets.

Question 13

Your organization is establishing a governance framework for Azure AI resources. You need to ensure cost control, tagging compliance, and security posture management across all subscriptions. Which THREE Azure services or features should you deploy? Each correct answer presents part of the solution.

Accepted Answer

Microsoft Defender for Cloud for security posture and compliance assessments. Azure Policy enforces tags, Cost Management handles budgets, and Defender for Cloud handles security posture.

Answer

Azure Bastion for database query optimization

Answer

Azure Traffic Manager for database scaling

Question 14

Your organization requires that all Azure AI resources maintain rigorous logging and diagnostic tracking. Which TWO data categories can you collect using Azure Monitor diagnostic settings for Azure AI services? Each correct answer presents part of the solution.

Accepted Answer

Request and response telemetry logs (such as Audit and Request logs). Diagnostic settings collect audit logs, request traces, and performance metrics.

Answer

Microsoft 365 Exchange mailbox audit logs

Answer

Windows registry hives from underlying hypervisors

Answer

Active Directory domain controller SYSVOL replication status

Question 15

You are troubleshooting a scenario where client applications are unable to connect to an Azure AI Language resource secured by a Private Endpoint. Which TWO troubleshooting steps should you perform? Each correct answer presents part of the solution.

Accepted Answer

Check that the client subnet can route to the private IP address assigned to the Private Endpoint.. Checking Private DNS zone configuration and verifying VNet peering or routing are key troubleshooting steps.

Answer

Verify that the client application has been assigned the Storage Blob Data Contributor role.

Answer

Ensure that the Azure OpenAI model weights have been retrained.

Answer

Check that public network access is set to enabled and unrestricted.