AI-103 Plan And Manage AN Azure AI Solution Practice Test 8 — 15 Questions

Question 1

You are designing a high-availability architecture for an Azure AI Speech service solution. Which THREE practices should you incorporate into your design? (Choose three.)

Accepted Answer

Configure Azure Front Door or Traffic Manager with health probes to route traffic away from unhealthy regions.. Option B is correct because Azure Front Door or Traffic Manager with health probes provides DNS-based global load balancing and automatically routes clients away from an unhealthy Speech region, which is essential for high availability. Option C is correct because Azure Monitor alert rules on metrics such as server error rates and latency enable operations teams to detect degradation quickly and trigger failover or remediation before users are broadly impacted. Option D is correct because deploying Speech resources in multiple Azure regions supports active-passive or active-active failover, ensuring service continuity if one region becomes unavailable. Option A is incorrect because hardcoding a primary region IP bypasses DNS-based failover and creates a single point of failure. Option E is incorrect because a single-region deployment without backups offers no redundancy and cannot meet high-availability requirements.

Answer

Hardcode the primary region IP address in all client applications without using a routing DNS layer.

Answer

Rely exclusively on a single-region deployment without backups to minimize operational complexity.

Question 2

When establishing a governance strategy for Azure AI resources across multiple cloud teams, which THREE administrative tasks should an administrator perform? (Choose three.)

Accepted Answer

Apply Role-Based Access Control (RBAC) following the principle of least privilege.. Option A is correct because applying Role-Based Access Control (RBAC) with least privilege ensures each cloud team member receives only the permissions needed for their role, such as Reader, Contributor, or specific custom roles, reducing the blast radius of misconfiguration or compromise across Azure AI resources. Option B is correct because Azure Policy can enforce organizational standards such as naming conventions and allowed regions by evaluating resource properties during creation and updates, and it can deny noncompliant deployments or flag them for remediation, which is essential for consistent multi-team governance. Option C is correct because organizing subscriptions under Azure Management Groups creates a hierarchy where policies and RBAC assignments inherit down to child subscriptions, giving administrators a single governance control plane across multiple cloud teams without configuring each subscription individually. Option D is incorrect because disabling Azure Activity Logs would remove the administrative audit trail needed for compliance, security monitoring, and incident investigation, directly undermining governance. Option E is incorrect because assigning the Owner role to all developers violates least privilege and grants excessive control over access and billing, increasing risk rather than establishing sound governance.

Answer

Disable Azure Activity Logs to prevent administrative audit trails.

Answer

Assign the Owner role to all developers to streamline resource creation.

Question 3

Your company wants to track and allocate Azure AI service costs by department. Which TWO mechanisms can assist with this requirement? (Choose two.)

Accepted Answer

Using Azure Cost Management filters and cost allocation rules to generate chargeback reports.. Option A is correct because Azure Cost Management supports filters (by resource group, tag, service, subscription, etc.) and cost allocation rules that let you split shared costs across departments, enabling accurate chargeback/showback reports for Azure AI services. Option E is correct because applying department-specific tags such as Department: Marketing to Azure AI resources lets Cost Management group and filter spend by tag, which is the standard way to attribute AI service costs to each department. Option B is incorrect because a single untagged, unsegmented subscription provides no dimension to separate or allocate costs by department. Option C is incorrect because deactivating Azure Cost Management removes the very reporting and allocation capability needed for cost tracking. Option D is incorrect because the Free (F0) tier only affects pricing/limits of certain AI services and does not provide any cost tracking or allocation mechanism.

Answer

Sharing a single Azure subscription across all departments without using tags or resource groups.

Answer

Deactivating Azure Cost Management to reduce management overhead.

Answer

Provisioning all AI resources in the Free (F0) tier.

Question 4

You are configuring network isolation and security for an Azure AI Search service that connects to an Azure SQL Database backend. Which THREE features can you utilize to secure this data flow? (Choose three.)

Accepted Answer

IP firewall rules restricting Azure SQL Database access to the Azure AI Search service outbound IPs.. Option A is correct because Azure SQL Database supports server-level and database-level IP firewall rules, and you can allow the specific outbound IP addresses of the Azure AI Search service (its public egress IPs) so only that traffic reaches the SQL server. Option B is correct because Azure Private Endpoint creates a private IP address in your VNet for both Azure AI Search and Azure SQL Database, so the data flow stays on the Microsoft backbone/private network instead of traversing the public internet, and it can be combined with disabling public access. Option C is correct because Azure AI Search indexers can use a managed identity (system-assigned or user-assigned) to authenticate to Azure SQL Database with Microsoft Entra ID, and secure connection strings avoid embedding credentials in code or configuration. Option D is wrong because disabling TLS would remove encryption in transit and weaken security, not legitimately secure the data flow, and TLS does not meaningfully slow query execution in this context. Option E is wrong because storing plain-text admin credentials in a search index configuration file exposes secrets and is a security anti-pattern, not a supported or recommended way to secure the connection.

Answer

Disabling all transport layer security (TLS) requirements to speed up query execution.

Answer

Storing plain-text database admin credentials in the search index configuration file.

Question 5

Your company is provisioning a new Azure AI Services multi-service resource. The security team mandates that all network traffic between the client applications and the Azure AI endpoint must remain entirely within the Microsoft backbone network without traversing the public internet. Which feature should you configure?

Accepted Answer

Azure Private Endpoint. Azure Private Endpoint creates a private IP address for the Azure AI Services resource inside your virtual network, so traffic between clients and the endpoint stays on the Microsoft backbone and never traverses the public internet. This is the standard feature for meeting private-connectivity mandates.

Answer

Cross-Origin Resource Sharing (CORS)

Answer

Service Principal Authentication

Answer

Azure AI Custom Subdomain

Question 6

You are deploying a custom text classification model using Azure AI Language. You need to implement cost management controls and track exact expenditures by tagging the Azure AI resource with the internal project cost center 'CC-409'. Where should you configure these tags in the Azure Portal?

Accepted Answer

Under the Resource management > Tags section of the Azure AI Services resource blade. Tags in Azure are configured under the Resource management > Tags section of the Azure AI Services resource blade. This allows you to assign metadata such as cost center 'CC-409' to the resource, which is then used for cost tracking and management. Tags are key-value pairs that can be applied to resources, resource groups, and subscriptions for organizational and billing purposes.

Answer

Within the Networking blade under Private endpoint connections

Answer

In the Access control (IAM) settings as a custom role assignment

Answer

In the Diagnostic settings by creating a new metric alert rule

Question 7

Your development team requires secure, passwordless authentication from an Azure Function to an Azure AI Vision resource. Which authentication mechanism should you implement to adhere to security best practices?

Accepted Answer

Microsoft Entra managed identity. Microsoft Entra managed identity lets the Azure Function authenticate to the Azure AI Vision resource without storing any secret — the platform issues and rotates the token automatically, and you grant the function's identity the appropriate RBAC role (e.g., Cognitive Services User) on the target resource. This is the passwordless, least-privilege pattern Microsoft recommends for service-to-service auth. Keys and SAS tokens are shared secrets that can leak; managed identity eliminates that class of risk entirely.

Answer

Shared Access Signature (SAS) tokens with read-only permissions

Answer

Basic authentication using service administrator username and password

Answer

Primary API Key passed in the Ocp-Apim-Subscription-Key header

Question 8

You are monitoring the performance of a deployed Azure OpenAI model. You notice occasional HTTP 429 (Too Many Requests) errors occurring during peak traffic hours. Which monitoring and management action should you take to resolve this issue?

Accepted Answer

Configure Azure Monitor metric alerts for 'Token Generation Rate' and scale up your provisioned throughput deployment capacity.. HTTP 429 from Azure OpenAI indicates rate limiting — the deployment's tokens-per-minute (TPM) or requests-per-minute (RPM) quota is being exceeded. The correct response is to monitor token consumption metrics via Azure Monitor and either increase the provisioned throughput (PTU) capacity or raise the standard deployment's TPM quota, which directly addresses the throttling. Configuring metric alerts on token generation rate provides early warning before 429s spike during peak hours.

Answer

Disable content safety filters to reduce processing latency and throughput overhead.

Answer

Rotate the primary API key immediately to clear the server-side connection cache.

Answer

Update the Network Security Group rules to increase the maximum allowed packet size for the API endpoint.

Question 9

You need to provision an Azure AI resource that allows developers to access multiple AI capabilities (such as Vision, Speech, and Language) using a single endpoint and a single API key. Which resource type should you create?

Accepted Answer

Azure AI multi-service account. An Azure AI multi-service account (Cognitive Services multi-service resource) bundles Vision, Speech, Language, Translator, and other services under one endpoint and one API key, simplifying provisioning and billing. It is the correct resource type when developers need multiple AI capabilities through a single credential. Single-service resources like Custom Vision or Azure OpenAI expose only their own capability.

Answer

Azure Cognitive Search resource

Answer

Azure OpenAI resource

Answer

Azure AI Custom Vision resource

Question 10

Your organization has strict compliance policies requiring all Azure AI Services endpoints to reject connections that do not use Transport Layer Security (TLS) version 1.3. Where can you enforce this minimum TLS version setting?

Accepted Answer

In the Configuration blade of the Azure AI resource in the Azure Portal. The minimum TLS version for an Azure AI Services resource is configured in the Configuration blade of the resource in the Azure Portal, where you can set the minimum inbound TLS version (e.g., 1.2 or 1.3). This setting enforces that connections using older TLS versions are rejected. It is a resource-level network security control, not an IAM or monitoring setting.

Answer

Within the Data residency tab of the Overview blade

Answer

In the Access control (IAM) settings under role assignments

Answer

In Application Insights under the Availability blade

Question 11

Your enterprise architecture team is reviewing the security posture of an Azure AI deployment that handles sensitive financial documents. Which TWO actions should you implement to secure data in transit and at rest? (Choose two.)

Accepted Answer

Enforce a minimum TLS version of 1.2 or higher for all API requests to secure data in transit.. Option A is correct because enforcing a minimum TLS version of 1.2 (or higher) on all API requests protects sensitive financial documents while they travel over the network, preventing downgrade attacks and use of deprecated protocols such as TLS 1.0/1.1. Option B is correct because configuring customer-managed keys (CMK) through Azure Key Vault gives the organization control over the encryption keys used for data at rest, satisfying compliance and key-ownership requirements for sensitive financial data. Option C is not appropriate because granting 'Contributor' to all developer accounts violates least privilege and does not itself secure data in transit or at rest; key rotation should be handled through Key Vault access policies or RBAC scoped narrowly. Option D is wrong because disabling diagnostic logging reduces auditability and incident response rather than protecting data, and logging can be configured to avoid storing sensitive content. Option E is wrong because relying exclusively on Microsoft-managed keys removes customer control over key lifecycle and does not meet the requirement to integrate Azure Key Vault for encryption at rest.

Answer

Grant 'Contributor' permissions to all developer accounts to simplify key rotation.

Answer

Disable diagnostic logging to prevent sensitive document text from being stored in Log Analytics.

Answer

Use Microsoft-managed keys exclusively without integrating Azure Key Vault.

Question 12

When planning an Azure AI solution deployment strategy, what are THREE key considerations for model versioning and lifecycle management? (Choose three.)

Accepted Answer

Implementing automated regression testing in CI/CD pipelines when upgrading model versions.. Option A is correct because automated regression testing in CI/CD pipelines validates that a new model version meets quality, accuracy, and safety baselines before promotion, catching behavioral drift or breaking changes introduced by the upgrade. Option B is correct because Microsoft publishes deprecation and retirement schedules for specific model versions in Azure OpenAI and Azure AI services, and solutions must track these dates to migrate before a version is retired and API calls begin failing. Option E is correct because model upgrades can introduce unexpected behavior, so a documented rollback plan—such as pinning the previous version or using deployment slots to revert traffic—ensures continuity if the new version underperforms. Option C is not appropriate because deleting older versions immediately removes the ability to roll back and may break pinned deployments still serving production traffic. Option D is not appropriate because hardcoding a 'latest' model string without explicit version specifiers makes behavior non-deterministic and can silently break when Microsoft updates or retires that alias.

Answer

Deleting older model versions immediately upon release of a new version to save cloud storage costs.

Answer

Hardcoding the latest model version string into production code without version specifiers.

Question 13

You are troubleshooting an intermittent connectivity issue between a client application and an Azure AI Speech service that sits behind an Azure Firewall and a Virtual Network. Which THREE diagnostic steps or tools should you utilize? (Choose three.)

Accepted Answer

Use Azure Network Watcher IP Flow Verify to check if traffic is being blocked by network security groups.. Option A is correct because Azure Network Watcher IP Flow Verify tests a specific 5-tuple (source/destination IP, port, protocol) against the effective NSG rules on a VM's NIC and reports whether traffic is allowed or denied, which directly isolates NSG-caused intermittent blocking. Option C is correct because enabling Azure AI service diagnostic settings routes request/response logs and metrics to a Log Analytics workspace, letting you correlate service-side failures and latency with client-side symptoms. Option D is correct because NSG flow logs capture inbound and outbound flow metadata (allowed/denied, source/destination, ports, bytes) that reveals intermittent drops and asymmetric traffic patterns over time. Option B is wrong because Azure Advisor cost recommendations address pricing and utilization, not connectivity diagnostics. Option E is wrong because the ARM template visualizer only shows resource deployment dependencies and cannot trace live network traffic or firewall/NSG behavior.

Answer

Run the Azure Advisor cost recommendation analyzer to optimize resource pricing tiers.

Answer

Use the Azure Resource Manager template visualizer to inspect regional resource dependencies.

Question 14

You need to ensure that an Azure AI services resource is accessible only from a specific virtual network. Which configuration should you update in the Azure portal?

Accepted Answer

The Networking blade to configure Private endpoints.. To restrict an Azure AI services (Cognitive Services) resource so it is reachable only from a specific virtual network, you configure a Private Endpoint on the resource's Networking blade. A Private Endpoint creates a private IP address from your VNet, mapping the service into your network via Azure Private Link, so public internet access can be disabled entirely. This is the standard portal-based approach for VNet-level isolation of Azure AI resources.

Answer

The Resource tags to add a network security group.

Answer

The Authentication blade to disable local keys.

Answer

The Identity blade to assign a User Assigned Managed Identity.

Question 15

You are managing costs for a multi-tenant Azure AI project. You need to attribute usage costs specifically to the 'Research' department. What is the most effective approach?

Accepted Answer

Implement Azure Policy to enforce mandatory tags on all new resources.. Azure Policy can enforce mandatory tags (such as Department=Research) on resource creation, ensuring consistent cost attribution across the multi-tenant project. Once tags are enforced, Azure Cost Management can group and filter costs by the Department tag, giving accurate per-department chargeback. This is the most effective and scalable approach because it prevents untagged resources from being created in the first place.

Answer

Disable diagnostic logging for the research resources to reduce billing.

Answer

Create a separate resource group for each department.

Answer

Change the pricing tier of the resource to 'Free'.