AI-103 Plan And Manage AN Azure AI Solution — Timed 20 Questions

Question 1

You are designing a monitoring solution for an Azure AI Document Intelligence resource that processes thousands of invoices daily. You need to track custom metric alerts when HTTP 429 (Too Many Requests) errors exceed a specific threshold over a 5-minute window. Where should you configure this alert?

20 minute time limit — choose an answer to begin.

Accepted Answer

Azure Monitor metric alerts. Azure Monitor metric alerts evaluate platform metrics emitted by Azure resources, including Azure AI Document Intelligence, and can trigger when a metric such as HTTP 429 errors exceeds a threshold over a 5-minute window. Metric alerts support dimensions and aggregation, making them the correct place to configure threshold-based alerts on service metrics.

Answer

Application Insights availability web tests

Answer

Microsoft Defender for Cloud threat protection policies

Answer

Azure AI Studio diagnostics dashboard

Question 2

You are managing an enterprise Azure OpenAI deployment with high traffic volumes. To prevent unexpected bill increases due to sudden usage spikes, you need to implement a cost-control mechanism that halts requests once a specific financial limit is reached. What is the native approach to achieve this?

Accepted Answer

Configure an Azure API Management (APIM) policy to track token usage and reject requests when the quota is exceeded.. Azure API Management (APIM) is the native Azure service for enforcing token-based quotas and rate limits on Azure OpenAI endpoints. An APIM policy can inspect the response's token usage, maintain a running counter per subscription, and return 429 once a financial threshold is reached — providing the hard stop the scenario requires.

Answer

Set a hard spending limit directly inside the Azure AI Services resource properties pane.

Answer

Create an Azure Cost Management budget with an action group running a script to delete the OpenAI resource.

Answer

Enable Microsoft Defender for Cloud auto-remediation rules for high billing.

Question 3

Your organization uses Azure Monitor diagnostic settings to route logs and metrics for all Azure AI services to a centralized Log Analytics workspace. You need to write a Kusto Query Language (KQL) query to find all incoming API requests that resulted in an HTTP 500 server error over the last 24 hours. Which table should you query?

Accepted Answer

AzureDiagnostics. Azure Monitor diagnostic settings route resource logs and metrics to a Log Analytics workspace, and those records land in the AzureDiagnostics table when using the diagnostic settings destination. To find incoming API requests that returned HTTP 500, you query AzureDiagnostics and filter on fields such as Category, OperationName, and ResultSignature or status code fields. AzureDiagnostics is the standard table for resource-level diagnostic logs from Azure AI services.

Answer

AppTraces

Answer

AzureActivity

Answer

SecurityEvent

Question 4

You are deploying an Azure AI Speech resource. Your compliance team stipulates that all data sent to the speech service must be processed strictly within the geographical boundaries of the European Union and must not be used for Microsoft's model training. How should you ensure this compliance?

Accepted Answer

Deploy the Speech resource in an EU-based region (such as West Europe) and review the data privacy and residency terms.. To ensure EU data residency and prevent data use for model training, you should deploy the Azure AI Speech resource in an EU-based region (e.g., West Europe) and review the data privacy and residency terms. Azure regional deployments keep data at rest and in processing within the chosen geography, and Microsoft's terms specify that data from paid Speech services is not used to train models without consent.

Answer

Enable Azure Policy to encrypt all audio files using customer-managed keys (CMK).

Answer

Configure an Azure Firewall instance to inspect and drop audio payloads destined outside the EU.

Question 5

You are designing an automated pipeline to deploy Azure AI Custom Vision projects using Infrastructure as Code (IaC) with Bicep. You need to reference an existing Custom Vision training resource in your deployment script without hardcoding its endpoint URL or primary key. Which Bicep construct should you use to retrieve these properties dynamically?

Accepted Answer

The Bicep 'existing' keyword reference. The Bicep 'existing' keyword allows you to reference an already-deployed resource by name and resource group, then access its properties (such as endpoint and keys) dynamically without hardcoding. This is the idiomatic Bicep way to retrieve properties from an existing resource during deployment.

Answer

The ARM template 'reference()' function inside a Bicep file

Answer

An Azure Key Vault secret data source

Answer

A Bicep module output parameter from a separate template

Question 6

Your company is deploying an Azure OpenAI gpt-4 model. You need to implement model versioning so that when Microsoft releases a newer model version, you can test it on a small subset of user traffic before rolling it out to all users. Which feature should you configure?

Accepted Answer

Create multiple model deployments with different version tags and configure traffic splitting weights.. Azure OpenAI supports deploying the same model with different version tags as separate deployments, and traffic splitting weights let you route a percentage of requests to a canary deployment for A/B testing. This is the native mechanism for controlled rollout of a new model version.

Answer

Enable dynamic scaling rules in Azure Kubernetes Service (AKS).

Answer

Configure Azure Traffic Manager with two regional endpoints.

Answer

Use Azure Application Gateway URL path-based routing.

Question 7

You are deploying an Azure AI Document Intelligence container in an on-premises disconnected environment. The container requires periodic license validation against Azure. What is the maximum duration the container can operate offline before requiring reconnection to Azure for billing and metering validation?

Accepted Answer

Up to 30 days. Azure AI Document Intelligence (formerly Form Recognizer) containers, like most Azure Cognitive Services containers, can run disconnected but must periodically report billing/metering data to Azure. Microsoft documents that the container will continue to operate offline for up to 30 days before it stops processing and requires reconnection for license validation. This 30-day window is the standard for Azure Cognitive Services disconnected containers.

Answer

Exactly 7 days

Answer

Maximum of 24 hours

Answer

Indefinitely without any connection required

Question 8

You need to programmatically check the health status of an Azure OpenAI service endpoint. Which HTTP method and path suffix should your health-check script use?

Accepted Answer

GET /openai/operations. Azure AI Services provide standard health check endpoints to verify service availability.

Answer

DELETE /openai/keys/revoke

Answer

POST /openai/deployments/delete

Answer

PUT /openai/models/update

Question 9

You are deploying an Azure AI resource and want to organize it logically within your Azure hierarchy. Which scope is the highest level at which you can assign Azure RBAC roles for your AI resource?

Accepted Answer

Management Group. Management Groups sit above subscriptions in the Azure hierarchy and are the highest scope at which Azure RBAC roles can be assigned for resources like Azure AI services. Assigning at a management group propagates permissions down to all subscriptions, resource groups, and resources within it.

Answer

Tenant root group

Answer

Resource Group

Answer

Azure AI Resource instance

Question 10

Your organization operates in a highly regulated financial sector. You are required to ensure that all data stored by your Azure AI services resource is encrypted using a custom encryption key managed by your team in Azure Key Vault, rather than a Microsoft-managed key. Which feature must you configure during resource creation?

Accepted Answer

Customer-Managed Keys (CMK) with Azure Key Vault. Customer-Managed Keys (CMK) with Azure Key Vault is the correct feature because it allows you to encrypt data at rest using your own encryption key stored in Azure Key Vault, rather than relying on Microsoft-managed keys. This satisfies regulatory requirements for key ownership and control. For Azure AI services resources that support CMK, you configure the key during resource creation so that training data and model artifacts stored in the associated storage account are encrypted with your key.

Answer

Storage Account Shared Access Signatures (SAS)

Answer

Microsoft Defender for Key Vault threat detection

Answer

Azure Information Protection sensitivity labels

Question 11

You are designing a secure hybrid network architecture for an Azure OpenAI resource. Virtual machines inside a spoke virtual network must access the OpenAI service via a Private Endpoint. Additionally, domain name resolution must rely on an enterprise private DNS server hosted on-premises connected via ExpressRoute. Which DNS zone must you configure in Azure?

Accepted Answer

privatelink.openai.azure.com Private DNS zone. Azure OpenAI resources are part of the Cognitive Services family, and their Private Endpoint DNS records are published under the privatelink.openai.azure.com zone. When using a Private Endpoint, the private DNS zone must match the service's privatelink subdomain. For Azure OpenAI, the correct zone is privatelink.openai.azure.com, not the generic cognitiveservices zone. Configuring this zone ensures that FQDNs like <resource>.openai.azure.com resolve to the private endpoint IP from on-premises via ExpressRoute.

Answer

privatelink.cognitiveservices.azure.com Private DNS zone

Answer

azurewebsites.net public DNS zone

Answer

cognitiveservices.azure.com public DNS zone

Question 12

You are reviewing security settings for an Azure AI Services account. You need to verify whether local authentication using API keys is enabled or disabled. Where in the Azure portal can you find this setting?

Accepted Answer

Resource management -> Resource normalization / Networking / Security settings. The setting to enable or disable local authentication (API key access) for an Azure AI Services account is found in the Azure portal under the resource's 'Resource management' section, specifically in 'Security settings' or 'Networking' depending on the exact UI. The correct path is Resource management -> Resource normalization / Networking / Security settings.

Answer

Azure Cost Management -> Billing scope

Answer

Microsoft Entra ID -> App registrations

Answer

Azure Monitor -> Diagnostic settings

Question 13

Your organization is running multiple Azure AI services. You need to configure alerts so that when the availability of any AI service drops below 99.% over a 15-minute window, an incident is created in ServiceNow. Which Azure Monitor feature should you use?

Accepted Answer

Azure Monitor metric alerts combined with Action Groups configured with a Webhook receiver. Azure Monitor metric alerts combined with Action Groups configured with a Webhook receiver is correct because metric alerts evaluate availability metrics over a specified window and trigger actions. Action Groups can send a webhook to ServiceNow's REST API to create an incident. This provides the required integration and threshold-based alerting.

Answer

Azure Cost Management alerts

Answer

Azure Advisor performance recommendations

Answer

Microsoft Defender for Cloud threat detection

Question 14

Your organization requires that all Azure AI resources maintain rigorous logging and diagnostic tracking. Which TWO data categories can you collect using Azure Monitor diagnostic settings for Azure AI services? Each correct answer presents part of the solution.

Accepted Answer

Request and response telemetry logs (such as Audit and Request logs). Option B is correct because Azure Monitor diagnostic settings for Azure AI services can route request/response telemetry such as Audit logs, Request logs, and Trace logs to destinations like Log Analytics, Storage, or Event Hubs. Option D is correct because Azure AI services emit platform metrics—including Total Calls, Latency, and Failed Requests—that diagnostic settings can forward alongside resource logs for monitoring and alerting. Option A is incorrect because Microsoft 365 Exchange mailbox audit logs come from Microsoft Purview/Exchange Online, not Azure AI diagnostic settings. Option C is incorrect because Windows registry hives from hypervisors are not a data category exposed by Azure Monitor diagnostic settings. Option E is incorrect because Active Directory SYSVOL replication status is a domain controller concern, unrelated to Azure AI services diagnostics.

Answer

Microsoft 365 Exchange mailbox audit logs

Answer

Windows registry hives from underlying hypervisors

Answer

Active Directory domain controller SYSVOL replication status

Question 15

You are planning the deployment of Azure AI containers in an on-premises disconnected environment. Which THREE prerequisites and operational considerations must you address? Each correct answer presents part of the solution.

Accepted Answer

Submit an online application and obtain billing approval from Microsoft to use disconnected containers.. Option A is correct because disconnected Azure AI containers require an approved application and billing approval from Microsoft before they can be deployed, since usage is tracked and billed through a special offline mechanism rather than standard Azure metering. Option B is correct because disconnected containers must periodically connect to Azure (at least once every 30 days) to upload billing/usage data and refresh their entitlement; failing to do so causes the container to stop running. Option D is correct because Microsoft supplies a license file that must be mounted locally and provided to the container at startup so it can validate its right to run in the disconnected mode. Option C is wrong because disconnected containers are not perpetual-offline; they still must report usage telemetry to Azure on the required schedule. Option E is wrong because disconnected deployments are specifically designed to operate without continuous public-internet dependencies such as an Azure SQL connection.

Answer

Rely on perpetual offline execution without ever reporting telemetry to Azure.

Answer

Connect the container permanently to an active Azure SQL database over the public internet.

Question 16

Your organization is implementing a model versioning and rollout strategy for Azure OpenAI deployments. Which TWO practices ensure safe deployment and quick rollback capabilities? Each correct answer presents part of the solution.

Accepted Answer

Deploy new model versions with distinct deployment names alongside existing versions.. Option C is correct because Azure OpenAI deployments are referenced by deployment name, so creating a new deployment name for each model version lets the old deployment keep serving traffic while the new version is validated, and rollback simply means pointing clients back to the previous deployment name. Option D is correct because Azure OpenAI supports weighted traffic distribution across multiple deployments, enabling a canary release where a small percentage of requests hit the new model version while the majority continue using the stable version, so problems can be detected before full rollout and traffic weights can be reverted instantly. Option A is wrong because deleting the resource group removes all deployments, endpoints, and configuration, eliminating any rollback path and causing an outage. Option B is wrong because overwriting weights in place with the same deployment name destroys the previous version, so there is nothing to roll back to. Option E is wrong because hardcoding version numbers in immutable binaries prevents dynamic switching or rollback without recompiling and redeploying clients.

Answer

Delete the entire Azure AI resource group prior to every model update.

Answer

Overwrite existing model weights in place without changing deployment names.

Answer

Hardcode model version numbers directly inside immutable compiled client binaries.

Question 17

You are provisioning a new Azure AI multi-service account in the West US region for an enterprise application. Which pricing tier should you select to ensure the account supports all available Azure AI capabilities including Custom Neural Voice and Content Moderator?

Accepted Answer

Standard (S0). The Standard (S0) pricing tier is the only Azure AI multi-service account tier that supports the full range of Azure AI capabilities, including premium features like Custom Neural Voice and Content Moderator. Free (F0) has strict quota limits and excludes many advanced features, while B0 and I0 are not valid multi-service tiers for this purpose. S0 is the production-grade tier required for enterprise deployments needing all capabilities.

Answer

Free (F0)

Answer

Isolated (I0)

Answer

Basic (B0)

Question 18

Your enterprise organization operates under strict data residency and sovereignty requirements. You are deploying Azure OpenAI and Azure AI Language services. Which THREE architectural decisions ensure compliance with data residency mandates? Each correct answer presents part of the solution.

Accepted Answer

Verify Microsoft's data privacy commitments guaranteeing that customer data is not used to train base models.. Option A is correct because Microsoft's data privacy commitments for Azure OpenAI and Azure AI Language explicitly state that customer data (prompts, completions, and training data) is not used to train or improve the base foundation models, which is a foundational contractual safeguard for data sovereignty and residency compliance. Option B is correct because diagnostic logs can contain request/response metadata and customer content, so storing them in a storage account within the same region and compliance boundary prevents data from leaving the mandated jurisdiction, satisfying residency requirements. Option E is correct because deploying all Azure AI resources (Azure OpenAI and Azure AI Language) exclusively in the compliant domestic Azure region, such as Australia Southeast, ensures that data at rest and in processing remains within that geographic boundary, which is the core technical control for data residency. Option C is incorrect because storing unencrypted customer prompts on public GitHub repositories exposes sensitive data globally and violates both residency and security mandates. Option D is incorrect because routing inference requests through public relay nodes in foreign countries transfers data across borders, directly breaching data residency and sovereignty requirements.

Answer

Store unencrypted customer prompts on public GitHub repositories.

Answer

Route all inference requests through public relay nodes located in foreign countries to save bandwidth costs.

Question 19

You are migrating an Azure AI Speech service resource to a different Azure subscription within the same tenant. Which mechanism should you use to preserve the existing custom voice models and configurations?

Accepted Answer

Use the Azure portal resource move feature to transfer the Speech resource to the target subscription.. The Azure portal resource move feature supports moving a Cognitive Services (Azure AI Speech) resource to another subscription within the same tenant, and custom voice models and configurations associated with the resource are preserved because the resource's identity and data move with it. This is the supported mechanism for cross-subscription migration within a tenant. Recreating or redeploying would lose the custom models.

Answer

Export custom models as JSON and import them via the Speech Studio in the new subscription.

Answer

Export the resource ARM template and deploy it to the target subscription.

Answer

Recreate the custom models from scratch in the new subscription using a new Speech resource.

Question 20

You need to restrict access to an Azure AI Custom Vision training resource so that only members of a specific Azure AD security group can manage projects and train models. How should you configure access control?

Accepted Answer

Assign the Cognitive Services Contributor role to the Azure AD security group at the resource scope.. Azure RBAC is the correct mechanism to restrict management and training operations to a specific Microsoft Entra ID security group. Assigning the Cognitive Services Contributor role at the resource scope grants members of that group the necessary permissions to manage projects and train models, while excluding all other users. This follows the principle of least privilege using built-in roles.

Answer

Configure IP firewall rules on the networking blade.

Answer

Enable managed identity on the resource and assign it to the security group.

Answer

Generate and distribute secondary API keys to group members.