Security And Observability

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

Your team is running an AI copilot application that uses Azure OpenAI. To comply with data residency regulations, you need to verify that prompts and completions are processed entirely within a specific Azure region and that no data is persisted outside that region. Where can you verify regional data processing and residency commitments?

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

You need to analyze log queries across multiple AI applications and infrastructure components to identify custom performance bottlenecks. Which query language is used in Azure Monitor Log Analytics to write queries against collected log data?

Your machine learning engineering team needs to run training jobs on Azure Machine Learning compute clusters. To minimize costs during off-peak hours, you need to configure the compute cluster to automatically scale down to zero nodes when no jobs are queued, and scale up when jobs are submitted. What setting should you configure on the compute cluster?

You are troubleshooting a live AI web application where users report intermittent 504 Gateway Timeout errors when submitting large text prompts to a custom model endpoint. You want to check if the backend inference container is timing out or crashing. Where should you examine container-level stdout/stderr logs in Azure Container Apps?

Your enterprise security team mandates that all outbound traffic from your Azure Machine Learning workspace must pass through a centralized Azure Firewall, and no public IP addresses can be associated with workspace compute instances. Which workspace network isolation configuration should you select?

You are debugging a Python application integrated with Application Insights. You notice that custom telemetry events generated in a background worker thread are not appearing in Application Insights. What is the most likely cause of this issue?

You want to view an end-to-end distributed trace of a user request flowing from an Azure Front Door through an API Management gateway, into an Azure Function, and finally to an Azure OpenAI model call. Which Application Insights feature visualizes this entire call chain and highlights latency bottlenecks?

You want to ensure that no AI services can be created in unauthorized Azure regions across your entire subscription. Which Azure governance tool should you use to enforce this restriction?

Your enterprise AI system processes sensitive Personal Identifiable Information (PII). Compliance regulations require that audit logs capturing who accessed the AI endpoints must be retained immutably for 5 years without possibility of deletion. Where should you configure this immutability policy?

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

Your team is developing an AI solution that uses Azure Cognitive Services. You need to ensure that the API keys cannot be extracted from the client-side mobile application. What is the recommended architectural pattern to achieve this?

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

Your application makes frequent calls to Azure AI Document Intelligence. You need to ensure that if a transient network failure or HTTP 503 service unavailable error occurs, the Python SDK automatically retries the failed requests with exponential backoff. How should you initialize the client to support robust retry behavior?

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

You need to export Azure Monitor metric and log data to an external SIEM solution for security auditing. Which Azure feature should you use to stream this telemetry in real-time to an external Event Hub?

You are troubleshooting a performance issue in an AI application where dependency calls to Azure OpenAI take significantly longer during periods of high traffic. You want to query Log Analytics to find the 95th percentile (p95) duration of all dependency calls to Azure OpenAI over the past 24 hours. Which KQL query should you execute?

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

Your enterprise AI solution runs across multiple subscriptions. You want to implement centralized cost allocation tags for all Azure AI resources to ensure every resource is tagged with 'CostCenter' and 'Environment'. Which Azure feature should you use to automatically audit and enforce these tags?

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

You want to create a centralized dashboard in the Azure portal that displays custom AI model performance metrics alongside infrastructure CPU and memory metrics. Which Azure Monitor feature should you create?

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

You are reviewing security logs in Azure Key Vault and notice unexpected access attempts from an unrecognized IP address. You need to immediately revoke all active Azure Active Directory tokens issued to a specific compromised user or service principal across your Azure AI applications. What action should you take?

Your data science team uses Azure Machine Learning notebooks. To prevent data exfiltration, you need to ensure that users cannot download datasets or trained model artifacts directly from the workspace to their local corporate laptops. Which feature should you configure?

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

You want to receive an email notification whenever monthly spending on your Azure OpenAI Service exceeds $5,000. Which Azure feature should you configure?

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Your enterprise AI application is deployed across multiple Azure regions for high availability. You need to ensure that logs from Application Insights instances in all regions are aggregated into a single central Log Analytics workspace for unified querying. How should you configure this?

You are designing a secure enterprise AI architecture on Azure. Which TWO of the following practices should you implement to secure credentials and service access? (Choose two)

Your Azure AI application relies on Azure OpenAI and Azure AI Search. You need to troubleshoot a sudden surge in HTTP errors and latency. Which THREE of the following Azure Monitor / Application Insights features or tools should you use to diagnose the issue? (Choose three)

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

When troubleshooting a Python AI application integrated with Application Insights, you want to ensure comprehensive error tracking and telemetry collection. Which TWO of the following SDK practices should you implement? (Choose two)

You are configuring diagnostic logging for an enterprise Azure OpenAI Service deployment. You need to forward logs to multiple destinations for security analysis and archiving. Which THREE of the following destinations are supported by Azure Monitor diagnostic settings? (Choose three)

You are auditing your Azure subscription for security best practices related to Azure AI resources. Which TWO of the following actions help enforce governance and security? (Choose two)

You are analyzing security and compliance logs in an Azure Log Analytics workspace. You want to write KQL queries to investigate potential security incidents or token acquisition failures. Which THREE of the following KQL tables or operators are valid and useful for this investigation? (Choose three)

You want to ensure that your Azure AI infrastructure costs are properly attributed to different business departments. Which TWO features should you configure? (Choose two)

Your team is preparing an Azure AI application for production release. You need to implement robust monitoring and observability. Which TWO of the following steps should be taken? (Choose two)

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

You are auditing an Azure AI platform for security vulnerabilities. You want to ensure that secrets, connection strings, and certificates are handled in compliance with security best practices. Which THREE of the following practices should you enforce? (Choose three)

You want to monitor the security posture and compliance score of your Azure AI resources. Which TWO of the following tools should you use? (Choose two)

When analyzing cost reports in Azure Cost Management for your machine learning and AI services, which TWO grouping or filtering options help identify spending anomalies? (Choose two)

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and connects to Azure OpenAI. You need to ensure comprehensive security across network, identity, and secrets. Which THREE of the following configurations should you deploy? (Choose three)

You are designing an operational dashboard in Azure Monitor. Which TWO visualization components can you include in an Azure Workbook? (Choose two)

Your organization wants to ensure that all Azure AI development follows strict security and observability standards. Which TWO of the following practices should be enforced across teams? (Choose two)

You are troubleshooting a scenario where an Azure App Service hosting an AI frontend cannot communicate with an Azure OpenAI endpoint secured by a private endpoint in a different virtual network. Which THREE of the following networking configurations should you verify? (Choose three)

When configuring Azure Monitor alerts for an AI application, which TWO action types can be included in an Action Group to notify operations personnel? (Choose two)

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

An enterprise application uses Azure AI Search and needs to authenticate securely to an Azure OpenAI backend without exposing credentials in connection strings. What is the recommended approach?

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

You need to monitor the monthly cost of an Azure AI Document Intelligence resource to ensure it does not exceed a specified budget. Where should you configure an automated notification when the cost reaches 80% of the budget?

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

An enterprise deployment of Azure OpenAI requires data encryption using a key that your security team fully manages and controls in Azure Key Vault. What must you configure?

You need to view real-time log streams from an Azure Container App running a custom LangChain agent. Which Azure CLI command should you execute?

Your company policy requires all outbound traffic from an Azure Machine Learning workspace to pass through a centralized firewall. Which feature must be implemented?

You need to restrict access to an Azure OpenAI resource so that only requests originating from a specific Azure Virtual Network are permitted. What should you configure?

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

You are auditing your Azure AI services to ensure that all API keys are rotated regularly. What is the recommended practice for managing credentials in an enterprise AI solution?

You want to set up an alert when the availability of your Azure AI custom model endpoint drops below 99%. Which Azure service should you use?

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Which TWO mechanisms can be used to monitor and optimize costs associated with Azure AI services?

You need to secure an Azure Machine Learning workspace against data exfiltration. Which THREE configurations should you implement?

You are deploying an Azure OpenAI Service resource and must ensure that all traffic from your virtual network reaches the endpoint without traversing the public internet. Which feature should you configure?

Which THREE logs or telemetry types should you collect in Azure Monitor to comprehensively troubleshoot an AI-powered web application?

Your development team needs to store API keys and connection strings for an Azure Cognitive Search service securely without embedding them in the source code. Where should you store these secrets?

You are configuring role-based access control for an Azure AI Search service. A data scientist needs to index content and query documents, but must not be permitted to manage service-level keys or change admin configurations. Which built-in role should you assign?

An enterprise application calls multiple Azure AI Language services. You need to trace requests across multiple distributed microservices to diagnose high latency issues. Which Azure Monitor capability should you implement?

Your team is using managed identities to connect an Azure App Service web app to an Azure OpenAI resource. The connection fails with a 403 Forbidden error. What is the most likely root cause?

You need to monitor the monthly spending on Azure OpenAI token consumption and receive an alert when expenditures exceed a predefined threshold. Which tool should you use?

You are troubleshooting intermittent HTTP 429 (Too Many Requests) errors from an Azure OpenAI deployment. Which metric in Azure Monitor should you inspect to confirm whether token rate limits are being exceeded?

Your company policy requires securing AI model endpoints by disabling public internet access and ensuring all API requests use secure managed identities. Which TWO actions must you take? (Choose two)

You are configuring comprehensive observability for an intelligent application built on Azure AI Document Intelligence and Azure OpenAI. Which THREE telemetry types or tools should you configure in Application Insights to capture complete operational insights? (Choose three)

You are configuring an Azure OpenAI service instance. You need to ensure that the service is only accessible from your corporate virtual network and that public internet access is completely disabled. Which configuration should you implement?

To optimize costs and monitor consumption for an Azure OpenAI deployment across multiple business units, which THREE practices should you implement? (Choose three)

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

A team member needs read-only access to view AI model deployment metrics in Azure Monitor but should not be able to change any resource settings. Which built-in role should you assign?

You are troubleshooting a latency issue with an AI model deployed in a Virtual Machine. You suspect the issue is related to storage IOPS limits. Which tool should you use to check the storage performance metrics?

You are securing an Azure AI Search service. Which THREE of the following actions are recommended for implementing a robust security posture? (Choose THREE)

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

You are deploying an AI-powered document processing solution that uses Azure Functions to call Azure OpenAI. The Azure Functions app runs in a Consumption plan. You need to ensure that the function can authenticate to Azure OpenAI without storing any secrets in code or configuration. You want to use a managed identity. What should you do first?

You are monitoring an Azure Machine Learning online endpoint that serves a real-time inference model. You need to detect when the model's input data distribution drifts from the training data and trigger an alert. Which Azure Machine Learning feature should you use?