AI-103 Plan And Manage AN Azure AI Solution Practice Test 7 — 15 Questions

Question 1

You are provisioning an Azure AI Language resource and want to ensure that all telemetry and activity logs are retained for compliance auditing over a 365-day period. Where should you configure this retention policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the resource's Diagnostic settings by specifying a retention period on a storage account destination.. Diagnostic settings in the Azure portal allow configuring log destinations and retention policies (in days) when sending logs to a Storage Account.

Answer

In the Microsoft Defender for Cloud security policy blade.

Answer

In the Azure AI Language service Studio configuration panel.

Answer

In the Azure Cost Management budget alert settings.

Question 2

Your development team wants to deploy a new version of an Azure OpenAI model while ensuring zero downtime for client applications currently calling the existing model deployment. What is the recommended deployment strategy?

Accepted Answer

Create a new deployment with a distinct deployment name for the new model version, then update application configuration to point to the new deployment.. Blue-green or side-by-side deployments allow deploying the new model version alongside the old one, updating client application endpoints or routing rules after validation.

Answer

Overwrite the existing model deployment name with the new model version.

Answer

Delete the Azure OpenAI resource and provision a new one in the same region.

Answer

Downgrade the pricing tier to pause traffic while updating the model version.

Question 3

You need to secure communications between an Azure App Service hosting your web app and an Azure AI Computer Vision service. The web app must authenticate to Computer Vision without storing API keys in application settings. Which feature should you enable?

Accepted Answer

Managed Identity on the App Service and RBAC role assignment on the Computer Vision resource.. A system-assigned or user-assigned managed identity allows the App Service to acquire Microsoft Entra tokens to authenticate to Computer Vision securely without embedded keys.

Answer

API Management subscription keys

Answer

Cross-Origin Resource Sharing (CORS)

Answer

Storage account shared access signatures (SAS)

Question 4

You are monitoring the health and operational status of an Azure AI multi-service account. Which TWO built-in metrics can you track in Azure Monitor to evaluate performance and reliability? (Choose two.)

Accepted Answer

Server Errors (failed requests due to server-side issues). Total Calls and Server Errors are standard platform metrics available in Azure Monitor to evaluate performance and reliability.

Answer

Employee payroll deductions

Answer

Virtual machine disk defragmentation percentage

Answer

Browser cache hit ratio

Question 5

You are hardening an Azure OpenAI service deployment for a financial application that handles sensitive customer data. Which THREE security configurations should you apply? (Choose three.)

Accepted Answer

Authenticate client applications using Microsoft Entra ID (Azure AD) tokens instead of static API keys.. Financial applications require strict network isolation via private endpoints, customer-managed encryption keys, and Entra ID authentication instead of static keys.

Answer

Store API keys in plain text within the client application's source code repository for easy developer access.

Answer

Enable anonymous access on the Azure OpenAI endpoint to simplify client connection testing.

Question 6

Your organization is planning to deploy multiple Azure AI services and needs to implement robust cost management and governance practices. Which TWO actions should you take? (Choose two.)

Accepted Answer

Implement Azure Policy to enforce mandatory cost-tracking tags on all AI resource deployments.. Using Azure Policy enforces tagging and resource rules, while resource groups separate environments for accurate billing allocation and cost tracking.

Answer

Deploy all development, test, and production AI resources into a single shared resource group to simplify administration.

Answer

Disable diagnostic logging across all AI resources to reduce Azure storage and log ingestion costs.

Answer

Use the Free (F0) pricing tier for all production workloads to eliminate infrastructure costs.

Question 7

When planning the model selection and versioning lifecycle for Azure OpenAI deployments in an enterprise environment, which TWO practices should you follow? (Choose two.)

Accepted Answer

Monitor Microsoft documentation and deprecation notices for model version lifecycles.. Best practices include testing model updates in non-production environments first and reviewing deprecation schedules for model versions.

Answer

Use deprecated model versions indefinitely to maintain identical outputs.

Answer

Automatically upgrade all production model deployments to the latest preview version the moment it is released.

Answer

Never update model versions once deployed to avoid any future validation work.

Question 8

You are designing a high-availability architecture for an Azure AI Speech service solution. Which THREE practices should you incorporate into your design? (Choose three.)

Accepted Answer

Configure Azure Front Door or Traffic Manager with health probes to route traffic away from unhealthy regions.. High availability involves multi-region deployments, automated health checks with Azure Front Door, and proper monitoring/alerts.

Answer

Hardcode the primary region IP address in all client applications without using a routing DNS layer.

Answer

Rely exclusively on a single-region deployment without backups to minimize operational complexity.

Question 9

When establishing a governance strategy for Azure AI resources across multiple cloud teams, which THREE administrative tasks should an administrator perform? (Choose three.)

Accepted Answer

Apply Role-Based Access Control (RBAC) following the principle of least privilege.. Governance involves applying Azure Policies, assigning least-privilege RBAC roles, and organizing resources into management groups and subscriptions.

Answer

Disable Azure Activity Logs to prevent administrative audit trails.

Answer

Assign the Owner role to all developers to streamline resource creation.

Question 10

Your company wants to track and allocate Azure AI service costs by department. Which TWO mechanisms can assist with this requirement? (Choose two.)

Accepted Answer

Using Azure Cost Management filters and cost allocation rules to generate chargeback reports.. Resource tags and Azure Cost Management filters/chargeback reports are the standard tools for department-level cost allocation.

Answer

Sharing a single Azure subscription across all departments without using tags or resource groups.

Answer

Deactivating Azure Cost Management to reduce management overhead.

Answer

Provisioning all AI resources in the Free (F0) tier.

Question 11

You are configuring network isolation and security for an Azure AI Search service that connects to an Azure SQL Database backend. Which THREE features can you utilize to secure this data flow? (Choose three.)

Accepted Answer

IP firewall rules restricting Azure SQL Database access to the Azure AI Search service outbound IPs.. Securing data flows between PaaS services involves private endpoints, IP firewalls, and managed identity connections.

Answer

Disabling all transport layer security (TLS) requirements to speed up query execution.

Answer

Storing plain-text database admin credentials in the search index configuration file.

Question 12

Your company is provisioning a new Azure AI Services multi-service resource. The security team mandates that all network traffic between the client applications and the Azure AI endpoint must remain entirely within the Microsoft backbone network without traversing the public internet. Which feature should you configure?

Accepted Answer

Azure Private Endpoint. Azure Private Link enables you to access Azure AI Services via a private endpoint in your virtual network, ensuring traffic stays within the Microsoft backbone network. Public IP, DNS forwarding rules, and service tags do not inherently provide the required private network isolation.

Answer

Cross-Origin Resource Sharing (CORS)

Answer

Service Principal Authentication

Answer

Azure AI Custom Subdomain

Question 13

You are deploying a custom text classification model using Azure AI Language. You need to implement cost management controls and track exact expenditures by tagging the Azure AI resource with the internal project cost center 'CC-409'. Where should you configure these tags in the Azure Portal?

Accepted Answer

Under the Resource management > Tags section of the Azure AI Services resource blade. Tags applied at the Azure Resource Group or individual Azure AI resource level in the Azure Portal propagate to Azure Cost Management for granular tracking and reporting. Access control, network configuration, and diagnostic settings do not handle resource-level billing tags.

Answer

Within the Networking blade under Private endpoint connections

Answer

In the Access control (IAM) settings as a custom role assignment

Answer

In the Diagnostic settings by creating a new metric alert rule

Question 14

You are designing a disaster recovery strategy for an Azure AI Document Intelligence resource. The business requirement is a Recovery Point Objective (RPO) of zero and Recovery Time Objective (RTO) of less than 15 minutes. Which deployment strategy should you select?

Accepted Answer

Deploy two identical Azure AI resources in paired regions and use Azure Front Door with priority routing for automatic failover.. Deploying paired regions with geo-redundant storage (or multi-region active-active deployment using Azure Front Door) is required to meet aggressive RPO/RTO requirements. Standard local redundancy or manual JSON backups do not provide automated sub-15-minute failover.

Answer

Configure geo-replication on a standard single-service resource using the Azure CLI without front-end routing.

Answer

Use Azure Site Recovery to replicate the Azure AI virtual machine host nodes directly.

Answer

Take daily backups of the trained custom models by exporting them to Azure Blob Storage in the same region.

Question 15

Your development team requires secure, passwordless authentication from an Azure Function to an Azure AI Vision resource. Which authentication mechanism should you implement to adhere to security best practices?

Accepted Answer

Microsoft Entra managed identity. Managed identities eliminate the need for developers to manage credentials and allow Azure resources to authenticate to Azure services supporting Microsoft Entra ID. API keys and connection strings present credential rotation and leakage risks.

Answer

Shared Access Signature (SAS) tokens with read-only permissions

Answer

Basic authentication using service administrator username and password

Answer

Primary API Key passed in the Ocp-Apim-Subscription-Key header