Microsoft · Free Practice Questions · Last reviewed May 2026
24 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?
Kubernetes Service Account tokens mapped to Key Vault access policies via static connection strings
A Kubernetes CronJob that pulls keys from Key Vault and creates sealed secrets
Azure Container Instances virtual nodes with managed system-assigned identities
Azure Key Vault Provider for Secrets Store CSI Driver with Microsoft Entra ID Workload Identity
The Secrets Store CSI Driver mounts Key Vault secrets directly into pods as volumes, while Microsoft Entra ID Workload Identity federates the pod's Kubernetes service account with Microsoft Entra ID, issuing short-lived tokens. This eliminates stored connection strings or environment variables, satisfying the credential-less access constraint.
You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?
Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search
A system-assigned managed identity lets App Service obtain Microsoft Entra ID tokens automatically, so no API keys sit in configuration files. Assigning the Search Index Data Reader role on Azure AI Search grants least-privilege query access, satisfying the requirement to query indices without embedded credentials.
Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service
Store the primary admin API key in Azure App Service configuration environment variables
Use shared access signatures (SAS) tokens generated by a client script
You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?
Azure Advisor cost recommendations
Azure Monitor autoscale settings
Azure Cost Management Budgets with alert conditions
Azure Cost Management Budgets let you set a monetary threshold scoped to a department and trigger alert conditions when actual or forecast spend reaches 80%. This directly satisfies the requirement to track expenditure against specific budgets with automated notifications.
Azure Service Health alerts
You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?
Azure Advisor
Microsoft Defender for Cloud
Azure Policy
Application Insights
Application Insights provides distributed tracing, dependency tracking and custom telemetry through the Azure Monitor SDK, capturing outbound calls to the external model endpoint and their failures. This satisfies the requirement to trace dependencies and monitor custom telemetry.
You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?
Service endpoints with default deny rules on the public firewall
Azure Application Gateway with Web Application Firewall (WAF)
Azure Bastion deployed in the management subnet
Azure Private Link with a private endpoint for the Azure OpenAI resource
Correct. Private endpoints securely map the service endpoint to a private IP within your VNet and allow you to disable public access.
Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?
Enable Application Insights dependency tracking on the subscription level via Azure Policy
Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace
Diagnostic settings are configured per resource, so each Azure OpenAI and Azure AI Language resource needs its own setting pointing at the shared Log Analytics workspace. This centralises logs and metrics across resource groups without moving or recreating the services.
Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints
Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances
Want more Security And Observability practice?
Practice this domainYour team is building an asynchronous order processing pipeline. If a downstream AI service fails to process a message from a Service Bus queue after 5 delivery attempts, the message must be automatically removed from active processing and preserved for manual inspection. What should you configure?
Enable Duplicate Detection with a history window of 5 attempts.
Configure the Max Delivery Count property on the queue and enable dead-lettering on message expiration or failure.
Setting Max Delivery Count to five moves the message to the dead-letter queue once the sixth delivery attempt would occur, satisfying the automatic removal requirement. Dead-lettering on failure preserves the message for manual inspection rather than discarding it, which matches the stem's constraint exactly.
Set the AutoDeleteOnIdle property on the queue to 5 minutes.
Implement Event Grid dead-lettering pointing to an Azure Blob Storage container.
Your enterprise application uses Azure Service Bus Topics to distribute orders to inventory and billing services. A transient database outage occurs in the billing service. You must ensure that billing messages are not lost and can be retried without interfering with the inventory service. What feature should you configure?
Enable partitioned queues on the sender application.
Use Event Grid filters to duplicate the messages into two separate storage accounts.
Configure separate subscriptions for each service under the Service Bus Topic.
Separate subscriptions give each service an independent copy of every order message, so the billing subscription retains messages during its database outage while inventory continues processing unaffected. This satisfies the stem's isolation requirement, which a shared subscription with competing consumers could not.
Implement Azure Relay to tunnel the database connection.
An application publishes custom events to an Azure Event Grid custom topic. You need to route events dynamically based on the event's 'department' property in the event payload. Which filtering mechanism should you configure on the Event Grid subscription?
Event Hubs Capture filters
Advanced Filters
Advanced Filters evaluate payload properties using operators such as StringIn, NumberGreaterThan and BoolEquals, so the subscription matches on the 'department' value inside the event data. Subject-prefix filtering only inspects the event subject string, which cannot express this payload-based routing condition.
Subject Begins With/Ends With filters
Service Bus Correlation Filters
You are designing an asynchronous AI image classification workflow. Client applications upload images to Azure Blob Storage and need to be notified immediately when processing completes. The notification must include custom metadata generated by the AI worker. Which architecture should you implement?
Use Azure Service Bus topics with session IDs set to the image hash.
Configure an Azure Storage queue that triggers whenever a blob is modified.
Poll the Azure Blob Storage container metadata every 5 seconds from the client app.
The AI worker publishes a custom event to an Azure Event Grid Topic upon completion.
Event Grid delivers the worker's custom event payload, including your metadata properties, to subscribers within seconds via push delivery. This satisfies the immediate notification requirement with custom metadata, which Blob Storage change events alone cannot carry.
Your organization requires that all messages sent to an Azure Service Bus Premium namespace are encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Where must you configure this encryption setting?
At the Service Bus Namespace level
Customer-managed key encryption for Service Bus is configured on the namespace itself, where the Key Vault key and managed identity are referenced. Setting it at the namespace level applies the CMK to all queues and topics within that Premium namespace.
Inside the Event Grid subscription endpoint URI
At the individual Queue or Topic level
Within the Azure Function consumer application configuration
You are architecting an AI-driven video analytics pipeline using Azure Event Hubs. You need to ensure that frames belonging to the exact same video session are processed in strict chronological order by the same backend stream analytics worker. How should you partition your Event Hub?
Increase the consumer group count to match the number of active video sessions.
Set the message TTL to zero and enable capture mode on the Event Hub namespace.
Include the video session ID as the Partition Key when publishing events to the Event Hub.
Partition keys determine which partition receives an event, and Event Hubs preserves order only within a single partition. Using the video session ID as the partition key routes every frame of one session to the same partition, so one stream analytics worker processes them chronologically.
Deploy an Azure Service Bus Session-enabled queue in front of the Event Hubs ingestion layer.
Want more Event Driven Integration practice?
Practice this domainWhen configuring an Azure Cosmos DB for NoSQL container to store embeddings, what data type must the vector property be stored as within the JSON document?
A base64 encoded string
An array of integers
An array of 32-bit floating-point numbers
Azure Cosmos DB for NoSQL stores vector embeddings as a JSON array of 32-bit floating-point numbers, matching the VectorDistance system function's expected input. This satisfies the stem's requirement that the vector property be a native JSON array, since Cosmos DB has no dedicated vector column type and rejects other numeric precisions.
A binary blob
You are configuring an Azure AI Search index schema via the REST API. You need to define a field that will hold a 1536-dimensional vector. Which field type must you assign to this field?
Edm.Vector
Edm.SingleCollection
Edm.SingleCollection stores a collection of single-precision floats, which is exactly what a 1536-dimensional embedding requires. Azure AI Search represents vector fields as arrays of Edm.Single, so this type satisfies the stem's dimensional constraint. Edm.Single alone holds one float, and Edm.DoubleCollection would waste space and break vector search compatibility.
Edm.String
Edm.DoubleCollection
You are configuring semantic ranking in Azure AI Search to improve search relevance for your enterprise application. Which tier of Azure AI Search is required to enable semantic ranking?
Storage Optimized (L1)
Standard (S1 or higher)
Semantic ranking is unavailable on Free or Basic tiers; it requires Standard S1 or above. Selecting Standard satisfies the tier constraint in the stem, enabling the semantic reranker to reorder results and improve relevance for the enterprise application.
Free
Basic
You are building a hybrid search solution using Azure AI Search that combines BM25 full-text search with vector search. What is the name of the feature that intelligently combines and normalizes scores from different retrieval systems before presenting the final top results?
Min-Max Score Scaling
Cosine Distance Normalization
Cross-Encoder Re-ranking
Reciprocal Rank Fusion (RRF)
RRF merges the BM25 and vector result sets by fusing each document's reciprocal rank rather than raw scores, so incomparable scoring scales never need normalising. This directly satisfies the stem's requirement to intelligently combine and normalise scores from different retrieval systems into one ranked result list.
Your company stores product catalog items in Azure Cosmos DB for NoSQL and needs to implement vector search for recommendation capabilities. Which indexing policy property must you add to enable vector indexing on a container?
compositeIndexes
vectorIndexes
The vectorIndexes property in the container's indexing policy defines vector paths, types, and similarity metrics, which Cosmos DB for NoSQL requires before it will index and serve vector search queries. Omitting it leaves embeddings unindexed, so VectorDistance queries fail or scan.
spatialIndexes
fullTextIndexes
You are writing a query in Azure Cosmos DB for NoSQL to retrieve documents based on vector similarity against a target embedding. Which built-in SQL function should you use in the ORDER BY clause?
CosSimilarity()
EmbeddingDistance()
GetVectorDistance()
VectorDistance()
VectorDistance() computes cosine, dot product or Euclidean distance between stored vectors and the query embedding, so ordering by it returns the nearest neighbours first. It is the only built-in NoSQL function that satisfies the vector similarity ranking constraint in the ORDER BY clause.
Want more Data Management Services And Vector Search practice?
Practice this domainYou have an AI model container hosted in Azure Container Registry. You want to ensure that every container image pushed to the registry is automatically scanned for known vulnerabilities before deployment. Which ACR feature should you enable?
ACR Tasks auto-purge
Content Trust
ACR geo-replication
Microsoft Defender for Cloud vulnerability scanning
Defender for Cloud's registry integration scans images on push, surfacing OS and language-package vulnerabilities per digest. Enabling it satisfies the requirement that every pushed image is automatically assessed before deployment, without altering the build pipeline.
You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?
Azure Blob Storage
Azure Managed Disks
Azure Artifacts
Azure Container Registry
Azure Container Registry provides a managed, private Docker registry within Azure, storing and versioning container images natively. It satisfies the requirement for private hosting of custom AI container images, integrating with Microsoft Entra ID for authentication and supporting geo-replication, webhooks and tasks for automated image builds.
You are optimizing a large language model container inference deployment on AKS using GPU-enabled nodes (NC-series). The inference server experiences frequent out-of-memory errors on the GPU device itself during high context lengths. Which Kubernetes configuration metric should you monitor and alert on?
container_memory_working_set_bytes via kubelet
container_cpu_cfs_throttled_periods_total
node_net_bytes_total
container_gpu_memory_used_bytes via NVIDIA DCGM Exporter
container_gpu_memory_used_bytes, exposed by NVIDIA DCGM Exporter, reports actual GPU device memory consumption. Monitoring it directly detects the high-context-length memory pressure causing device-level out-of-memory errors, unlike node-level or CPU metrics which cannot reveal GPU memory exhaustion.
You are managing an AKS cluster running resource-intensive AI training jobs. You want to ensure that nodes automatically scale up and down based on pending pod resource requests. Which component should you enable and configure?
KEDA (Kubernetes Event-driven Autoscaling)
Azure Load Balancer
Horizontal Pod Autoscaler
Kubernetes Cluster Autoscaler
The Cluster Autoscaler watches for pods that cannot be scheduled due to insufficient node resources and adds nodes to the node pool, then removes underused ones. This directly satisfies the stem's requirement for automatic scale up and down driven by pending pod resource requests.
You are running an AI inference workload in an Azure Kubernetes Service (AKS) cluster. The pods require access to an Azure Machine Learning workspace data store via managed identity without storing credentials in code. Which Kubernetes feature should you configure?
Azure CNI Overlay
Kubernetes Secrets CSI driver
Node-level Managed Identity
Microsoft Entra ID Workload Identity
Workload Identity federates a Kubernetes service account with a Microsoft Entra ID identity via OIDC, letting pods obtain tokens for the Azure Machine Learning data store without embedded credentials. This satisfies the no-stored-credentials constraint, unlike pod-managed identity or secrets.
You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?
azure-service-bus
cpu
tcp
http
The http scale rule scales replicas according to concurrent HTTP requests, which matches the stated trigger. Azure Container Apps evaluates this built-in rule against incoming request concurrency, adding or removing replicas to meet demand without custom KEDA configuration.
Want more Containerized AI Workloads practice?
Practice this domainThe vendor does not publish an exact question count for the AI-200; the exam lasts 100 minutes. The passing score is 700 (scaled 1–1,000). Always confirm current details on the vendor's official exam page.
Scenario-based questions covering exam objectives with detailed answer explanations.
The exam covers 4 domains: Security And Observability, Event Driven Integration, Data Management Services And Vector Search, Containerized AI Workloads. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AI-200 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.