AI-200 Practice Test 15 — 15 Questions

Question 1

You are designing a high-scale vector search architecture using Azure AI Search. Which THREE operational and architectural best practices should you follow to ensure optimal performance and cost-efficiency? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Balance replica and partition counts based on your query throughput and index size requirements. Option A is correct because Azure AI Search scales along two independent dimensions: replicas provide query throughput and high availability, while partitions provide index storage and write parallelism, so right-sizing both to your QPS and index size is the core capacity-planning practice. Option C is correct because scalar quantization compresses float32 vectors to narrower types (for example int8), cutting memory usage and speeding up HNSW graph traversal with only modest recall loss, which improves cost-efficiency at high scale. Option D is correct because Azure Monitor exposes search unit metrics such as CPU, memory, and storage utilization, letting you detect saturation and resize replicas or partitions before performance degrades. Option B is wrong because vector fields hold numeric embeddings, not raw PDF binaries, which belong in blob storage or a separate content field. Option E is wrong because the Free tier has no SLA, tiny storage and index limits, and cannot support a high-scale production workload.

Answer

Store all raw PDF files inside the vector float32 array fields

Answer

Deploy all indexes on the Free tier to eliminate infrastructure costs

Question 2

You are writing a Python application using the Azure Cosmos DB Python SDK to perform a vector search. You execute a parameterized SQL query containing VectorDistance(). What must be passed as a query parameter for the VectorDistance function to evaluate correctly against the container's vector property?

Accepted Answer

A Python list of float values representing the query embedding. VectorDistance() in the Cosmos DB Python SDK expects the query embedding as a native array of floats, which the SDK serializes to the JSON array the server compares against the stored vector property. Passing a Python list of floats (C) is the correct and only supported form for the parameter. The function then computes cosine, dot product, or Euclidean distance per the container's vector policy.

Answer

A base64 encoded string of the text

Answer

A connection string to Azure OpenAI Service

Answer

A file path pointing to a local .npy numpy file

Question 3

You are reviewing security logs in Azure Key Vault and notice unexpected access attempts from an unrecognized IP address. You need to immediately revoke all active Azure Active Directory tokens issued to a specific compromised user or service principal across your Azure AI applications. What action should you take?

Accepted Answer

Revoke user refresh tokens using Azure AD PowerShell (Revoke-AzureADUserAllRefreshToken) or Microsoft Entra admin center. Revoking refresh tokens invalidates the user's or service principal's ability to silently obtain new access tokens, effectively terminating the session across all clients. The Revoke-AzureADUserAllRefreshToken cmdlet (or the equivalent 'Revoke sessions' action in the Microsoft Entra admin center) sets the refreshTokensValidFromDateTime to now, so any token issued before that timestamp is rejected. This is the correct immediate containment step for a compromised identity.

Answer

Restart the Azure portal browser session

Answer

Change the Azure subscription display name

Answer

Delete the Azure Monitor Log Analytics workspace

Question 4

Which type of registry is most suitable for storing images that are shared across an entire organization?

Accepted Answer

Azure Container Registry.. Azure Container Registry (ACR) is the Azure-native private registry designed for organization-wide image sharing. It supports Azure RBAC, Microsoft Entra ID authentication, geo-replication, private endpoints, and integration with AKS, Container Apps, and ACI, making it the correct choice for enterprise-scale image distribution.

Answer

Docker Hub (Free).

Answer

GitHub Container Registry.

Answer

Local hard drive.

Question 5

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Accepted Answer

Allow Azure services and resources to access this server firewall setting combined with Virtual Network rules. Service endpoints or private endpoints on Azure SQL Database allow Azure services (such as AI Search) to connect securely within the Microsoft backbone network while disabling public access.

Answer

Open firewall port 1433 for all IP addresses globally

Answer

Use Azure Front Door to load balance SQL TCP connections

Answer

Configure an HTTP proxy inside an Azure VM to forward SQL queries

Question 6

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

Accepted Answer

Azure Monitor metrics explorer on the Azure OpenAI resource.. Azure Monitor metrics explorer surfaces the built-in Azure OpenAI metrics, including Prompt Tokens, Completion Tokens, and Total Tokens, as pre-built charts on the Azure OpenAI resource. These metrics are emitted automatically per deployment and can be split by model or deployment name, making them the fastest way to trend token consumption for capacity forecasting.

Answer

Microsoft Purview data lineage maps.

Answer

Azure Advisor cost optimization recommendations.

Answer

Azure Log Analytics workspace without Application Insights configured.

Question 7

Your data science team uses Azure Machine Learning notebooks. To prevent data exfiltration, you need to ensure that users cannot download datasets or trained model artifacts directly from the workspace to their local corporate laptops. Which feature should you configure?

Accepted Answer

Workspace configured with a managed virtual network and outbound rules blocking public internet egress, plus disabled local file downloads in compute instance settings. To prevent exfiltration from AML, you combine a workspace managed virtual network with outbound rules that block public internet egress, plus disabling local file downloads on compute instances. The managed VNet isolates compute and controls egress via private endpoints and FQDNs, while the compute instance setting removes the ability to download files to a local laptop. Together these enforce the no-exfiltration requirement.

Answer

Using Azure Front Door with Web Application Firewall disabled

Answer

Disabling Azure Monitor diagnostic logging

Answer

Assigning the Contributor role to all external collaborators

Question 8

You are designing a secure data layer architecture for financial documents using Azure Cosmos DB for NoSQL and Azure AI Search. Which THREE compliance and security controls should you implement? (Choose three)

Accepted Answer

Enable diagnostic logging and audit log streaming to Azure Monitor / Log Analytics. Option B is correct because enabling diagnostic logging and streaming audit logs to Azure Monitor / Log Analytics provides the tamper-evident activity trail and monitoring required for regulatory compliance (e.g., PCI DSS, SOX) on financial document workloads. Option D is correct because configuring Customer-Managed Keys (CMK) via Azure Key Vault gives the organization control over the encryption keys protecting data at rest in Cosmos DB, satisfying requirements for key ownership, rotation, and revocation that Microsoft-managed keys do not meet. Option E is correct because restricting network access with Virtual Network service endpoints and Azure Private Link removes public internet exposure, ensuring only approved private endpoints within the VNet can reach the Cosmos DB and Azure AI Search resources. Option A is wrong because storing backups in unencrypted public blob containers directly violates encryption-at-rest and access-control mandates. Option C is wrong because disabling authentication keys and allowing anonymous public access eliminates authentication and authorization, which is unacceptable for sensitive financial data.

Answer

Store all database backup files in unencrypted public blob storage containers

Answer

Disable authentication keys and allow anonymous public access for easy integration

Question 9

Your enterprise AI solution runs across multiple subscriptions. You want to implement centralized cost allocation tags for all Azure AI resources to ensure every resource is tagged with 'CostCenter' and 'Environment'. Which Azure feature should you use to automatically audit and enforce these tags?

Accepted Answer

Azure Policy with tag governance rules (e.g., 'Inherit a tag from the resource group' or 'Require specified tag'). Azure Policy is the governance service that audits and enforces resource properties, including tags, across subscriptions. Built-in tag policies such as 'Require a tag and its value on resources' and 'Inherit a tag from the resource group' let you deny non-compliant deployments or auto-remediate missing tags, and policy assignments can target management groups so they cover every subscription in the enterprise. This is the only option that provides automatic audit plus enforcement.

Answer

Application Insights telemetry initializers

Answer

Azure Advisor security rules

Answer

Azure Cost Management budgets

Question 10

You are designing an event-driven AI application that requires routing custom events from an Azure resource to multiple downstream serverless webhooks. Which Azure messaging service should you use to publish and route these events reliably?

Accepted Answer

Azure Event Grid. Azure Event Grid is a fully managed event routing service designed for event-driven architectures. It natively supports custom events published to a topic, and can route them to multiple subscribers—including serverless webhooks—via event subscriptions. It provides reliable delivery with retries, dead-lettering, and filtering, making it the ideal choice for routing custom events to multiple downstream webhooks.

Answer

Azure Service Bus

Answer

Azure Event Hubs

Answer

Azure Storage Queues

Question 11

You are troubleshooting a high-throughput stream processing pipeline using Azure Event Hubs. Consumers are experiencing lag because messages are accumulating faster than they can be processed. You want to temporarily replay historical events from 2 hours ago without altering the current consumer group offsets permanently. What should you do?

Accepted Answer

Create a new temporary consumer group and initialize the event receiver with a custom starting offset based on enqueued timestamp.. Creating a new temporary consumer group and initializing the event receiver with a custom starting offset based on enqueued timestamp is correct because it allows replaying historical events without affecting the existing consumer group's offsets. The new consumer group starts from a specified time, and the original group continues from its current position. Other options do not achieve this.

Answer

Enable Geo-Disaster Recovery to force the secondary region to sync historical logs.

Answer

Delete the existing consumer group and recreate it with a 2-hour retention limit.

Answer

Purge all messages from the Event Hub using the Azure CLI az eventhubs purge command.

Question 12

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

Accepted Answer

Use the Application Insights TelemetryClient track_metric() method. The Application Insights SDK for Python provides the TelemetryClient class with a track_metric() method specifically designed to record custom metrics. Calling track_metric() sends the value to Application Insights, where it becomes queryable in the customMetrics table and can be charted over time. This is the native, supported way to instrument custom metrics from any Python process, including one running in an Azure Container Instance.

Answer

Save the metrics as text files in an Azure Blob Storage account and run hourly KQL queries

Answer

Print JSON strings to standard output and rely on Log Analytics automatic table parsing

Answer

Update Azure Key Vault secrets with the metric values

Question 13

An AI application uses Azure Service Bus queues for task distribution. A background worker receives a message, but needs more time to complete the lengthy AI inference task before the message lock expires. Which method should the worker invoke?

Accepted Answer

RenewLockAsync. RenewLockAsync extends the lock on a message, giving the worker more time to process it before the lock expires. This prevents the message from being delivered to another worker while the current one is still processing.

Answer

AbandonAsync

Answer

DeadLetterAsync

Answer

CompleteAsync

Question 14

Your development team needs to store API keys and connection strings for an Azure Cognitive Search service securely without embedding them in the source code. Where should you store these secrets?

Accepted Answer

Azure Key Vault. Azure Key Vault is the dedicated Azure service for storing and tightly controlling access to secrets, keys, and certificates. Storing API keys and connection strings there keeps them out of source code and enables RBAC, auditing, and managed identity access.

Answer

An Azure Storage Table with public read permissions

Answer

An environment variable in the application's appsettings.json file

Answer

The Azure AI Studio model deployment configuration metadata

Question 15

You are setting up image builds for a multi-architecture (AMD64 and ARM64) AI model container using Azure Container Registry Tasks. Which command or feature should you use to build images for both architectures simultaneously?

Accepted Answer

az acr build with a multi-step task or docker buildx configuration. Azure Container Registry Tasks supports multi-architecture image builds through `az acr build` with either a multi-step YAML task or a Dockerfile leveraging `docker buildx` for cross-platform builds (linux/amd64 and linux/arm64). ACR Tasks runs the build in Azure, so you don't need local buildx/QEMU setup, and it can push a single manifest list referencing both architecture variants. This is the native, supported path for producing multi-arch images in ACR.

Answer

Azure DevOps pipeline running docker push directly

Answer

az aks create with --node-os-sku

Answer

az acr import