AI-103 Plan And Manage AN Azure AI Solution Practice Test 4 — 15 Questions

Question 1

You are creating an Azure AI Services resource using Azure CLI. Which command parameter specifies the pricing tier of the resource?

Accepted Answer

--sku. The Azure CLI command 'az cognitiveservices account create' uses the --sku parameter to specify the pricing tier (e.g., S0, F0) of the Azure AI Services resource. This is the standard parameter name across Azure CLI resource creation commands for specifying the SKU.

Answer

--tier

Answer

--pricing

Answer

--kind

Question 2

Your development team has created a custom model using Azure Machine Learning. You need to deploy this model as a real-time web service endpoint with auto-scaling capabilities. Which deployment target should you select?

Accepted Answer

Azure Managed Online Endpoint. Azure Managed Online Endpoints are designed for real-time inference with built-in autoscaling, authentication, and monitoring, making them the correct deployment target for a custom Azure Machine Learning model exposed as a web service. They support scale-to-zero or rule-based scaling based on metrics like CPU utilization or request rate.

Answer

Azure Functions consumption plan

Answer

Azure Container Registry webhook

Answer

Azure Batch cluster

Question 3

Your organization is running an Azure AI Search service and needs to restrict management operations (such as index creation and deletion) to administrators while allowing standard client applications to perform search queries only. How should you configure access?

Accepted Answer

Use Admin API keys for management operations and Query API keys for client search queries.. Azure AI Search issues two key types: admin keys (primary and secondary) that grant full control including index creation, deletion, and configuration, and query keys that only permit read operations against indexes. Assigning admin keys to administrators and query keys to client applications enforces least privilege at the data-plane level without needing Azure RBAC.

Answer

Enable IP firewall rules to block index creation.

Answer

Configure CORS settings in the Azure portal.

Answer

Assign the Contributor role to client applications.

Question 4

You are setting up diagnostic logging for an Azure OpenAI resource. Your security team mandates that all log streams must be exported in real-time to a security information and event management (SIEM) platform outside Azure, such as Splunk. Which destination should you configure in the Azure Monitor diagnostic setting?

Accepted Answer

Stream to an Azure Event Hub. Azure Event Hub is the supported real-time streaming destination for Azure Monitor diagnostic settings and integrates natively with external SIEM platforms like Splunk via the Splunk add-on for Event Hub. It provides low-latency, high-throughput egress of logs outside Azure.

Answer

Send to a Microsoft Sentinel workbook

Answer

Configure an Azure Automation runbook webhook

Answer

Archive to an Azure Storage account container

Question 5

You are deploying an Azure AI service resource in the Azure portal. Which option specifies the geographic location where your data will be processed and stored?

Accepted Answer

Region. In Azure, the region specifies the geographic location where your resource's data is processed and stored. When you create an Azure AI service resource, you select a region (e.g., East US, West Europe), and that choice determines data residency, latency, and which features are available. This is a core compliance and architecture decision.

Answer

Tenant

Answer

Domain

Answer

Zone

Question 6

You are managing an enterprise Azure OpenAI resource that experiences bursty traffic patterns. To optimize cost without sacrificing availability during sudden workload spikes, you decide to implement a caching layer for frequent prompts and responses. Which Azure service should you integrate in front of Azure OpenAI?

Accepted Answer

Azure Cache for Redis. Azure Cache for Redis provides a low-latency, in-memory caching layer that can store frequent prompt-response pairs, reducing the number of calls to Azure OpenAI during bursty traffic. This optimizes cost by serving cached responses and maintains availability by offloading repeated requests from the OpenAI resource. It is the standard Azure service for application-level caching in front of AI endpoints.

Answer

Azure Traffic Manager routing profile

Answer

Azure ExpressRoute local gateway

Answer

Azure Content Delivery Network (CDN)

Question 7

Your company uses Azure Policy to enforce governance across all subscriptions. A developer attempts to deploy an Azure OpenAI resource in a region that is prohibited by corporate policy. What happens during the deployment?

Accepted Answer

The deployment is blocked and returns an error explaining the policy violation.. Azure Policy operates as a guardrail at the control plane: when a deployment violates a Deny-effect policy, the Resource Manager blocks the request and returns an error describing the policy violation. The resource is never created, and the developer must remediate the request to comply.

Answer

Azure automatically moves the resource to an allowed region.

Answer

The resource is deployed successfully, but an email alert is sent to the administrator.

Answer

The deployment succeeds and automatically applies a remediation task.

Question 8

Your development team needs to deploy an Azure AI Search service and connect it to an Azure SQL Database containing source documents. Security requirements state that credentials must not be stored in application code. Which authentication method should you use between Azure AI Search and Azure SQL Database?

Accepted Answer

Managed Identity. Managed Identity allows Azure AI Search to authenticate to Azure SQL Database without storing credentials in code. The indexer can use the search service's managed identity to access the SQL database, provided the identity has been granted appropriate permissions in SQL.

Answer

Shared Access Signature (SAS) token

Answer

Hardcoded SQL administrator password in indexer configuration

Answer

Anonymous access connection string

Question 9

You are configuring rate limiting and request throttling for multiple client applications consuming an Azure OpenAI endpoint. Different clients have different tier agreements (Bronze, Silver, Gold). Where should you implement these tiered rate-limiting policies?

Accepted Answer

Azure API Management (APIM). Azure API Management (APIM) is the correct place to implement tiered rate-limiting and throttling policies because it sits in front of the Azure OpenAI endpoint as a gateway and supports per-subscription, per-product, and per-key rate-limit policies. You can create Bronze, Silver, and Gold products/subscriptions in APIM and apply rate-limit or rate-limit-by-key policies with different quotas (calls per minute, tokens per minute) to each tier. Azure OpenAI itself does not expose customer-configurable tiered throttling policies per client.

Answer

Azure Application Gateway custom WAF rules

Answer

Azure OpenAI service built-in tier settings

Answer

Network Security Group (NSG) outbound rules

Question 10

You are provisioning an Azure AI services account and want to ensure that all telemetry and monitoring metrics are collected. Which built-in monitoring feature is automatically enabled on Azure AI resources without requiring additional agent installation?

Accepted Answer

Azure Monitor platform metrics. Azure Monitor platform metrics are collected automatically for Azure AI services (Cognitive Services, Azure OpenAI, AI Search, etc.) with no agent, SDK, or diagnostic extension required. They appear in the resource's Metrics blade within seconds to minutes and cover request counts, latency, errors, and token usage. This makes them the only truly zero-configuration monitoring feature among the choices.

Answer

Log Analytics Windows security agent

Answer

Application Insights SDK code instrumentation

Answer

Azure Diagnostics extension for Linux

Question 11

You are reviewing the Azure Cost Management dashboard to analyze spending on Azure AI services. Which grouping option allows you to see costs broken down by specific resource names?

Accepted Answer

Resource. In Azure Cost Management, the 'Resource' grouping dimension breaks down costs by individual resource name (e.g., a specific Azure OpenAI account, a specific AI Search service). This is the only grouping that surfaces per-resource granularity, which is what the question asks for. Resource type groups by category (e.g., 'Microsoft.CognitiveServices/accounts'), not by name.

Answer

Resource type

Answer

Meter category

Answer

Location

Question 12

Your organization is preparing for an annual external security audit. The auditor requests proof that all Azure AI resources comply with ISO 27001 standards. Where can you download the official compliance audit reports for Azure AI services?

Accepted Answer

Microsoft Service Trust Portal. The Microsoft Service Trust Portal is the official Microsoft repository for compliance documentation, including ISO 27001 audit reports, SOC reports, and other regulatory attestations for Azure and Azure AI services. Auditors accept these reports as evidence of compliance because they are produced by independent third-party assessors. Access requires signing in with a Microsoft Entra ID account and accepting the non-disclosure agreement.

Answer

Microsoft 365 Admin Center security center

Answer

Visual Studio subscription benefits page

Answer

Azure OpenAI Studio compliance tab

Question 13

You are designing a multi-tenant SaaS application on Azure. Each tenant requires isolation of their Azure OpenAI token usage and cost tracking. What is the recommended provisioning strategy to achieve strict cost and quota isolation per tenant?

Accepted Answer

Provision a separate Azure OpenAI resource for each tenant.. Provisioning a separate Azure OpenAI resource per tenant provides independent quota limits, separate keys, and distinct billing meters, which together deliver strict cost and quota isolation. This is the recommended multi-tenant pattern when isolation is a hard requirement.

Answer

Use a single Azure OpenAI resource for all tenants and track usage using custom HTTP headers.

Answer

Deploy all tenants in the F0 free pricing tier.

Answer

Rely on Azure Cost Management resource group tags alone without resource separation.

Question 14

You are deploying an Azure AI Document Intelligence resource. You need to ensure that only client requests coming from your corporate public IP address range can access the endpoint. Which networking configuration should you apply?

Accepted Answer

Configure firewall virtual networks and IP address ranges in the Azure AI resource networking settings.. Azure AI resources, including Document Intelligence, provide networking settings where you can configure firewall rules to allow access only from specific virtual networks and public IP address ranges. This directly restricts endpoint access to your corporate IP range, satisfying the requirement. It is the native, intended mechanism for IP-based access control on Azure AI services.

Answer

Configure Azure Bastion access restriction rules.

Answer

Attach an Azure Application Gateway with a WAF policy.

Answer

Enable Microsoft Entra conditional access policies on the API keys.

Question 15

Your organization has deployed an Azure AI Custom Vision model. You need to automate the retraining pipeline whenever new training images are uploaded to an Azure Blob Storage container. Which Azure service should you use to trigger the retraining pipeline?

Accepted Answer

Azure Event Grid. Azure Event Grid is a fully managed event-routing service that natively integrates with Blob Storage. When a blob is created in a container, Event Grid publishes a BlobCreated event that can trigger an Azure Function, Logic App, or webhook to invoke the Custom Vision retraining pipeline.

Answer

Azure ExpressRoute monitor

Answer

Azure Backup service

Answer

Azure Monitor alert rules