AI-103 Plan And Manage AN Azure AI Solution Practice Test 5 — 15 Questions

Question 1

You are troubleshooting a performance issue where requests to an Azure OpenAI model deployment experience intermittent HTTP 429 errors. You examine Azure Monitor metrics and see that the 'Processed Tokens' metric is well below your provisioned limit, but the 'Requests' metric spikes. What is the root cause of the error?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The request rate (Transactions Per Second) has exceeded the provisioned limit, even though token volume is within bounds.. HTTP 429 (Too Many Requests) from Azure OpenAI is triggered when the request rate — measured in Transactions Per Second (TPS) or Requests Per Minute (RPM) — exceeds the deployment's provisioned throughput, independent of token consumption. Since the Processed Tokens metric is below the limit but Requests is spiking, the rate limit on call count is the cause.

Answer

The model weights have become corrupted and require redeployment.

Answer

The Azure subscription has run out of monthly financial budget.

Answer

The Private Endpoint DNS resolution has failed.

Question 2

Your organization wants to ensure that all Azure AI resources created in any subscription across the tenant adhere to a standardized naming convention (e.g., prefixing with 'ai-'). Which Azure governance tool should you use?

Accepted Answer

Azure Policy with custom naming convention rules. Azure Policy is the governance service designed to enforce organizational standards such as naming conventions across subscriptions and resources. A custom policy definition using a naming pattern rule (e.g., enforcing an 'ai-' prefix) can be assigned at the management group or subscription scope to audit or deny non-compliant resources tenant-wide.

Answer

Microsoft Defender for Cloud

Answer

Azure Cost Management budgets

Answer

Azure Advisor

Question 3

You are managing an Azure OpenAI model deployment in an active-passive multi-region disaster recovery architecture. A regional outage occurs, and you failover traffic to the secondary region. However, clients report receiving authentication errors. What is the most likely cause?

Accepted Answer

The client application's managed identity has not been granted the required RBAC roles on the secondary Azure OpenAI resource.. When using managed identity for authentication, the identity must be granted the appropriate RBAC role (such as Cognitive Services OpenAI User) on each Azure OpenAI resource it accesses. During failover to a secondary resource in another region, that resource is a distinct Azure resource with its own scope, so role assignments from the primary do not automatically carry over. The authentication error is therefore caused by missing RBAC role assignments on the secondary resource.

Answer

Azure automatically deletes API keys during a regional failover.

Answer

Azure OpenAI models require re-training after any regional failover event.

Answer

The primary region's DNS zone must be manually deleted for failover to work.

Question 4

You are deploying an Azure AI Speech resource using an ARM template. Which parameter defines the name of the resource instance?

Accepted Answer

name. In an ARM template, the 'name' property within the resource block specifies the name of the resource instance being deployed, such as the Azure AI Speech account name. This is a required property for every ARM resource and determines the unique identifier of the deployed resource. The other properties configure SKU, region, and resource type but do not set the instance name.

Answer

sku

Answer

location

Answer

kind

Question 5

Your enterprise team is deploying multiple Azure AI Custom Vision resources across different development stages (Dev, Test, Prod). You need to ensure that billing costs for the Dev environment are billed to a specific cost center. Which Azure feature should you use to categorize these costs?

Accepted Answer

Azure resource tags. Azure resource tags are key-value pairs applied to resources and resource groups that flow into the Azure Cost Management and Billing data, enabling cost categorization, filtering, and chargeback/showback by dimensions like CostCenter, Environment, or Project. Tagging the Dev Custom Vision resources with a CostCenter tag lets finance attribute those costs to the correct cost center.

Answer

Azure role-based access control (RBAC)

Answer

Azure Service Health alerts

Answer

Azure Firewall rules

Question 6

You are provisioning an Azure AI services account and want to view your current API key. Where can you retrieve the API key in the Azure portal?

Accepted Answer

Keys and Endpoint blade of the resource. In the Azure portal, the API key and endpoint for an Azure AI services (Cognitive Services) resource are found on the 'Keys and Endpoint' blade of that resource. This blade displays Key1 and Key2, the endpoint URL, and the region, and allows regenerating the keys. It is the standard location for retrieving credentials used by SDKs and REST calls.

Answer

Resource graph explorer

Answer

Azure Advisor cost optimization pane

Answer

Azure Active Directory overview page

Question 7

You are designing an automated deployment pipeline for Azure AI Search using GitHub Actions. The pipeline must authenticate to Azure securely without storing credentials or long-lived secrets in GitHub repository settings. Which authentication mechanism should you implement?

Accepted Answer

OpenID Connect (OIDC) with Azure workload identity federation. OpenID Connect (OIDC) with Azure workload identity federation allows GitHub Actions workflows to authenticate to Azure using short-lived tokens issued by GitHub's OIDC provider and exchanged for Microsoft Entra ID tokens via a federated identity credential. This eliminates the need to store any secret in GitHub, satisfying the 'no long-lived credentials' requirement. It is the Microsoft-recommended pattern for CI/CD pipelines deploying Azure resources such as Azure AI Search.

Answer

Hardcoded administrator API keys stored in GitHub Action variables

Answer

A personal access token (PAT) with full subscription ownership

Answer

Anonymous access enabled during deployment time

Question 8

You are provisioning an Azure AI services account and need to select the kind of resource. Which kind parameter value should you select for an Azure OpenAI deployment?

Accepted Answer

OpenAI. For an Azure OpenAI deployment, the resource kind must be 'OpenAI'. This kind provisions an Azure OpenAI resource that provides access to OpenAI models like GPT-4, GPT-3.5, DALL-E, and Whisper through Azure's infrastructure. The 'OpenAI' kind is specifically designed for Azure OpenAI Service, enabling features such as model deployment, fine-tuning, and content filtering. Other kinds correspond to different Azure AI services and do not support OpenAI model deployments.

Answer

CognitiveSearch

Answer

MachineLearning

Answer

BotService

Question 9

Your organization is deploying an Azure OpenAI resource. Your security policy requires that all network traffic destined for the OpenAI service must traverse a secure hub-and-spoke virtual network topology and pass through an Azure Firewall instance. How should you route outbound traffic from your application subnet to Azure OpenAI?

Accepted Answer

Configure User Defined Routes (UDR) on the application subnet with a next hop pointing to the Azure Firewall.. User Defined Routes (UDR) let you override Azure's default system routes by associating a custom route table with the application subnet. By setting the next hop type to 'Virtual appliance' and pointing to the Azure Firewall's private IP, all egress traffic (including to the Azure OpenAI endpoint) is forced through the firewall for inspection and policy enforcement. This is the standard hub-and-spoke pattern for centralized network security.

Answer

Configure Azure Traffic Manager dns routing.

Answer

Attach an Azure Bastion subnet to the firewall.

Answer

Rely on automatic default system routing without route tables.

Question 10

You are designing a high-throughput, low-latency architecture for an Azure OpenAI application. Clients are distributed globally across North America, Europe, and Asia. To ensure minimal latency and high availability, you decide to deploy multiple Azure OpenAI instances in different regions. How should you route incoming client requests to the nearest optimal region?

Accepted Answer

Azure Front Door with latency-based routing. Azure Front Door is a global, scalable entry point that uses Microsoft's global edge network to route client requests based on latency. It continuously measures latency to the origin and directs traffic to the lowest-latency healthy backend, which is ideal for globally distributed Azure OpenAI instances. This ensures minimal latency and high availability.

Answer

Azure ExpressRoute global reach

Answer

Azure Bastion global routing profile

Answer

Azure Local Traffic Manager (LTM)

Question 11

You are managing an enterprise Azure AI Search deployment. During an audit, you notice that index data is encrypted at rest using Microsoft-managed keys. Management mandates that you switch to customer-managed keys (CMK) stored in Azure Key Vault immediately without losing index data or rebuilding the service. How should you implement this?

Accepted Answer

Configure encryption with customer-managed keys in the Azure portal on the existing search service instance and assign necessary Key Vault access permissions.. Azure AI Search supports enabling customer-managed key (CMK) encryption on an existing service without data loss or service recreation. You configure CMK in the Azure portal (or via ARM/Bicep) under the Encryption blade, then grant the search service's managed identity the necessary Key Vault permissions (get, wrapKey, unwrapKey). The service re-encrypts the index encryption key with your CMK, and no reindexing or rebuild is required.

Answer

Delete the search service and provision a brand new one with CMK enabled from inception.

Answer

Modify the DNS records to point to a new CMK-encrypted endpoint.

Answer

Run an Azure Automation runbook that exports indices to blob storage, deletes the service, and restores it.

Question 12

You are planning the security architecture for an enterprise Azure AI multi-service account. Management requires that access to the resource be strictly controlled and audited. Which TWO security features or configurations should you implement? Each correct answer presents part of the solution.

Accepted Answer

Disable local authentication (API key access) and require Microsoft Entra ID authentication.. Option A is correct because disabling local authentication on the Azure AI multi-service account removes API-key-based access, forcing all callers to authenticate through Microsoft Entra ID (formerly Azure AD), which enables identity-based access control, conditional access, and full audit logging of who accessed the resource. Option C is correct because configuring an Azure Private Endpoint assigns a private IP address from your virtual network to the Azure AI service, so data-plane traffic stays on the Microsoft backbone and the resource can be restricted from public network access, satisfying strict network-level control and auditability. Option B is wrong because storing admin API keys permanently in an unencrypted Blob container exposes credentials and directly contradicts the requirement for strictly controlled, audited access. Option D is wrong because granting the Contributor role to all end-user client applications violates least privilege and gives broad management-plane rights rather than scoped data access. Option E is wrong because enabling anonymous public access across all subnets removes authentication and network restrictions entirely, which is the opposite of the required security posture.

Answer

Store all admin API keys permanently in an unencrypted Azure Blob Storage container.

Answer

Grant the Contributor role to all end-user client applications.

Answer

Enable anonymous public access across all subnets.

Question 13

Your organization is establishing a governance framework for Azure AI resources. You need to ensure cost control, tagging compliance, and security posture management across all subscriptions. Which THREE Azure services or features should you deploy? Each correct answer presents part of the solution.

Accepted Answer

Microsoft Defender for Cloud for security posture and compliance assessments. Azure Cost Management budgets with alerts (D) directly address cost control by letting you set spending thresholds per subscription and trigger notifications when actual or forecasted costs exceed them. Azure Policy (C) enforces tagging compliance and region restrictions by evaluating resource properties against built-in or custom policy definitions and applying deny, audit, or modify effects automatically. Microsoft Defender for Cloud (A) provides the security posture management piece through continuous secure score assessments, regulatory compliance dashboards, and recommendations across all subscriptions. Azure Bastion (B) is a managed jump-host service for secure RDP/SSH access to VMs, not a database query optimization tool, so it does not fit. Azure Traffic Manager (E) is a DNS-based global traffic load balancer for distributing user traffic across endpoints, not a database scaling mechanism, so it is also irrelevant here.

Answer

Azure Bastion for database query optimization

Answer

Azure Traffic Manager for database scaling

Question 14

You are troubleshooting a scenario where client applications are unable to connect to an Azure AI Language resource secured by a Private Endpoint. Which TWO troubleshooting steps should you perform? Each correct answer presents part of the solution.

Accepted Answer

Check that the client subnet can route to the private IP address assigned to the Private Endpoint.. Option A is correct because a Private Endpoint exposes the Azure AI Language resource through a private IP address in the client's virtual network, so the client subnet must have valid routing (for example, via the default VNet routing or a configured route table) to reach that private IP; if routing is broken, connections fail even if DNS resolves correctly. Option D is correct because name resolution must map the Azure AI Language endpoint FQDN to the Private Endpoint's private IP, which requires the corresponding Private DNS zone (for example, privatelink.cognitiveservices.azure.com) to be linked to the client virtual network; without that link, clients resolve the public IP and cannot connect privately. Option B is not relevant because Storage Blob Data Contributor is an Azure Storage RBAC role and has no bearing on connecting to an Azure AI Language resource. Option C is not relevant because retraining Azure OpenAI model weights is unrelated to Private Endpoint connectivity for Azure AI Language. Option E is incorrect because enabling unrestricted public network access would bypass the private-only access model rather than troubleshoot the Private Endpoint connection, and it may violate the intended security configuration.

Answer

Verify that the client application has been assigned the Storage Blob Data Contributor role.

Answer

Ensure that the Azure OpenAI model weights have been retrained.

Answer

Check that public network access is set to enabled and unrestricted.

Question 15

You are optimizing the cost of your Azure AI infrastructure. You notice several resources are underutilized or incorrectly provisioned. Which THREE actions should you take to reduce unnecessary spending? Each correct answer presents part of the solution.

Accepted Answer

Downgrade development and test resources from high-tier production SKUs to free or lower standard tiers where appropriate.. Option A is correct because non-production dev/test workloads rarely need high-tier production SKUs, so moving them to free or lower standard tiers (e.g., Azure AI Search Basic/Standard, Cognitive Services standard pricing tiers) directly cuts recurring compute and feature charges without affecting production SLAs. Option C is correct because abandoned or unused Azure AI resource accounts (e.g., orphaned Cognitive Services, Azure OpenAI, or Azure AI Search resources) still incur charges for provisioned capacity and stored data, so identifying and deleting them eliminates pure waste. Option D is correct because Azure Cost Management budgets and cost anomaly alerts provide proactive visibility and governance, letting you detect and remediate unexpected spend before it accumulates. Option B is not appropriate because Provisioned Throughput Units (PTUs) reserve dedicated Azure OpenAI capacity at a fixed hourly rate and are cost-effective only for steady, high-volume production workloads, not idle development sandboxes. Option E is not appropriate because permanently scaling Azure AI Search partitions and replicas to maximum capacity increases cost and is only justified by sustained indexing/query load or high-availability requirements, not cost reduction.

Answer

Provision dedicated Azure OpenAI PTUs for idle development sandboxes.

Answer

Scale out search service partitions and replicas to maximum capacity permanently.