AI-200 Practice Test 16 — 15 Questions

Question 1

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

Accepted Answer

Azure Private Link with private endpoints mapped to your virtual network. Private endpoints via Azure Private Link and disabling public network access on PaaS resources ensure complete network isolation from the public internet.

Answer

Enabling anonymous access on Application Insights data ingestion endpoints

Answer

Using Azure Front Door with global public anycast IPs

Answer

Assigning public IP addresses to all backend scoring containers

Question 2

Your organization requires that container images stored in Azure Container Registry (ACR) comply with security standards. Which TWO actions can you take to secure container images in ACR? (Choose two.)

Accepted Answer

Enable Microsoft Defender for Cloud vulnerability scanning for ACR registries. Option D is correct because enabling Microsoft Defender for Cloud's vulnerability scanning for ACR registries continuously scans images for known CVEs and provides remediation guidance, directly supporting image security compliance. Option E is correct because enabling content trust (Docker Content Trust) enforces image signing and verification, ensuring only trusted, signed images are pulled or deployed, which prevents tampered or unauthorized images from being used. Option A is wrong because granting Contributor permissions to every external guest user violates least-privilege and expands the attack surface rather than securing images. Option B is wrong because storing registry administrator credentials in public GitHub repositories exposes secrets and enables unauthorized access. Option C is wrong because disabling network firewalls and allowing unrestricted public pulling removes network-level protections and increases exposure of the registry.

Answer

Grant Contributor permissions to every external guest user

Answer

Store registry administrator credentials in public GitHub repositories for easy team access

Answer

Disable all network firewalls on the registry to allow unrestricted public pulling

Question 3

Your application uses Cosmos DB for NoSQL to store product metadata and vectors. You need to perform a vector search that combines similarity scores with specific filter criteria on the 'category' field. How should you define your index policy to support this?

Accepted Answer

Define a vector index policy and include the 'category' property in the indexing policy's included paths.. For vector search with pre-filtering in Cosmos DB for NoSQL, the index policy must include both a vector index policy for the embedding path and a regular indexing policy that includes the filter property (e.g., 'category'). This allows the query engine to apply the filter efficiently before or alongside the vector similarity search, reducing the candidate set and improving performance.

Answer

Create a vector index policy containing only the vector embedding path.

Answer

Enable auto-indexing for all properties to ensure vector search works.

Answer

Use a stored procedure to perform the filter after the vector search result set is returned.

Question 4

You are deploying an AI model container in Azure Container Apps. Which TWO authentication mechanisms can you configure for securely pulling the image from a private Azure Container Registry?

Accepted Answer

ACR administrator username and password. Option A (ACR administrator username and password) is correct because Azure Container Apps supports registry authentication using the registry's admin credentials, which are enabled on the ACR and supplied as username/password when configuring the registry in the container app. Option D (System-assigned managed identity) is correct because Container Apps can use a managed identity with the AcrPull role assignment on the registry, allowing image pulls without storing secrets. Option B is incorrect because a client certificate in public DNS is not a supported ACR authentication mechanism and public DNS is not a secure credential store. Option C is incorrect because an Azure Storage account connection string authenticates to Blob/File storage, not to Azure Container Registry. Option E is incorrect because anonymous public pull tokens do not provide authenticated access to a private registry.

Answer

Azure Active Directory client certificate stored in public DNS

Answer

Azure Storage account connection string

Answer

Anonymous public pull token

Question 5

Your application sends messages to an Azure Service Bus queue. A downstream worker needs to postpone processing of a specific message until a later time without losing its place in the queue or dead-lettering it. What method should the worker invoke?

Accepted Answer

DeferMessageAsync(). DeferMessageAsync() postpones processing of a message by setting it aside while preserving its sequence number, allowing the worker to retrieve it later by sequence number without losing its place or dead-lettering it. This is the correct method for temporarily postponing a specific message in Azure Service Bus.

Answer

CompleteMessageAsync()

Answer

AbandonMessageAsync()

Answer

DeadLetterMessageAsync()

Question 6

Your application uses Azure Service Bus Queues. A spike in traffic causes multiple worker instances to contend for messages. You want to ensure that when a worker locks a message, no other worker can process it, and the lock is automatically renewed in the background if processing takes longer than expected. Which client library feature should you use?

Accepted Answer

Enable Auto-Lock Renewal on the message processor client.. Auto-Lock Renewal is a feature of the Service Bus message processor client (e.g., ServiceBusProcessor in .NET, ServiceBusProcessorClient in Java) that automatically extends the message lock in the background while the handler is still processing. This prevents lock expiration and message redelivery to other workers during long-running processing.

Answer

Increase the LockDuration property on the queue to 2 hours permanently.

Answer

Use Event Grid advanced filters to throttle incoming messages.

Answer

Switch the queue to ReceiveAndDelete mode.

Question 7

Which THREE of the following are components of a standard Dockerfile for an AI application?

Accepted Answer

RUN (Installation of libraries/tools).. Option D (FROM) is correct because every Dockerfile must begin with a FROM instruction that specifies the base image (e.g., FROM nvidia/cuda:12.2.0-runtime-ubuntu22.04 or FROM python:3.11-slim) on which the AI application's layers are built. Option B (RUN) is correct because RUN executes build-time commands inside the image, such as pip install torch tensorflow or apt-get install, to install the libraries and tools the AI application needs. Option C (CMD/ENTRYPOINT) is correct because these instructions define the process command that starts when the container launches, such as CMD ["python", "app.py"], which is essential for running the AI workload. Option A (CLUSTER_CREATE) is not a Dockerfile instruction; it is a cluster-provisioning action performed by orchestration tooling, not image build syntax. Option E (AZURE_LOGIN) is not a Dockerfile instruction either; authentication to Azure is handled externally via the Azure CLI or service principals, not baked into the image build.

Answer

CLUSTER_CREATE.

Answer

AZURE_LOGIN (Manual login).

Question 8

You are integrating Azure OpenAI Service's text-embedding-ada-002 model with Azure AI Search. You want to automate the generation of embeddings directly inside the search service during data ingestion. Which component of Azure AI Search should you configure?

Accepted Answer

Azure AI Search Indexer with integrated vectorization. Azure AI Search's indexer with integrated vectorization natively invokes an embedding model (such as Azure OpenAI's text-embedding-ada-002) during the enrichment pipeline, so vectors are generated and written to the index automatically at ingestion time. This removes the need for external code to pre-compute embeddings and push them into the index. Configuring the indexer's vectorizer and embedding skill is the supported, first-party mechanism for this automation.

Answer

Semantic ranker configuration profile

Answer

Azure Function scheduled trigger for batch updates

Answer

Custom Web API skill in Azure AI Services enrichment pipeline

Question 9

An enterprise application calls multiple Azure AI Language services. You need to trace requests across multiple distributed microservices to diagnose high latency issues. Which Azure Monitor capability should you implement?

Accepted Answer

Application Insights Distributed Tracing. Distributed tracing in Application Insights tracks requests across multiple service boundaries using W3C Trace Context headers.

Answer

Azure Advisor cost recommendations

Answer

Log Analytics metric alerts without instrumentation

Answer

Azure Network Watcher Connection Monitor

Question 10

You are designing an asynchronous AI transaction pipeline using Azure Service Bus. You need to implement the Competing Consumers pattern where multiple worker instances process messages from a single queue without duplicating work. How does Azure Service Bus natively support this pattern?

Accepted Answer

Service Bus automatically locks and distributes messages across competing workers using PeekLock mode.. Azure Service Bus natively implements the Competing Consumers pattern through PeekLock receive mode: each worker receives a message, obtains an exclusive lock token, and other workers cannot see that message until the lock expires or is released. This broker-side locking distributes messages across competing workers without duplicate processing, as long as handlers settle messages within the lock duration.

Answer

Configure Event Hubs consumer groups with exclusive read locks.

Answer

You must write custom distributed locking logic using Azure Blob Leases in front of the queue.

Answer

You must deploy an Event Grid topic with a round-robin webhook load balancer.

Question 11

Which TWO of the following techniques help optimize the performance of containerized AI models in AKS?

Accepted Answer

Tune pod resource limits and requests.. Option A is correct because setting accurate CPU and memory requests lets the AKS scheduler place pods on nodes with sufficient capacity, while proper limits prevent noisy-neighbor contention and OOMKills, directly improving the stability and throughput of containerized AI inference or training workloads. Option E is correct because dedicating node pools with GPU-enabled VM SKUs (e.g., NC/ND series) to GPU tasks ensures AI pods get exclusive access to GPU resources, avoids scheduling conflicts with CPU-only workloads, and allows independent scaling and taints/tolerations for GPU nodes. Option B is wrong because disabling all logging removes observability needed to diagnose performance bottlenecks and does not improve runtime performance. Option C is wrong because switching from Azure CNI to standard (kubenet) CNI does not optimize AI model performance and can reduce networking capabilities. Option D is wrong because blindly increasing replicas to 100 for all services wastes resources, can cause scheduling pressure and cost blowups, and does not address per-pod performance.

Answer

Disable all logging.

Answer

Use the standard CNI instead of Azure CNI.

Answer

Increase the replica count to 100 for all services.

Question 12

You are developing a RAG solution and need to evaluate the quality of your vector retrieval results from Azure AI Search. Which metric is commonly used to measure the proportion of relevant documents retrieved in the top-k results?

Accepted Answer

Recall@k. Recall@k is the metric that measures the proportion of relevant documents retrieved in the top-k results. It is defined as the number of relevant documents retrieved in the top-k divided by the total number of relevant documents available. This metric is widely used in information retrieval and RAG evaluation to assess retrieval quality.

Answer

HNSW efSearch latency

Answer

Request Units per second (RU/s)

Answer

BM25 term frequency

Question 13

You are building an order processing system with Azure Service Bus. Multiple clients might accidentally submit the exact same order twice within a 60-second window due to network retries. You need to prevent duplicate orders from entering the queue. What should you configure?

Accepted Answer

Enable Duplicate Detection on the queue and set the history time window to 60 seconds.. Azure Service Bus Duplicate Detection uses a DuplicateDetectionHistoryTimeWindow to track MessageId values of recently sent messages. When enabled, the broker rejects messages with the same MessageId within the specified window. Setting the window to 60 seconds ensures that duplicate orders submitted within that timeframe are discarded, preventing duplicates from entering the queue.

Answer

Configure Auto-Forwarding to a dead-letter queue with a 60-second TTL.

Answer

Set the LockDuration property to 60 seconds.

Answer

Enable partitioning and set the partition key to the client IP address.

Question 14

You want to set up an alert when the availability of your Azure AI custom model endpoint drops below 99%. Which Azure service should you use?

Accepted Answer

Azure Monitor metric alerts configured on the 'Availability' or 'HttpServerErrors' metrics.. Azure Monitor metric alerts evaluate platform metrics such as Availability and HttpServerErrors against thresholds and fire notifications or actions when breached. Configuring a metric alert on Availability with a threshold below 99% is the direct way to detect endpoint availability drops.

Answer

Azure Policy definitions with audit effects.

Answer

Azure Cost Management anomaly detection.

Answer

Microsoft Defender for Cloud vulnerability assessment.

Question 15

You are troubleshooting slow inference latency in an AI application deployed on AKS. You suspect that network packets between inference pods are traversing unnecessary hops due to overlay routing. Which CNI mode should you have chosen for optimal direct routing?

Accepted Answer

Azure CNI with direct pod IP routing (no overlay). Azure CNI with direct pod IP routing assigns each pod a routable IP from the VNet subnet, so pod-to-pod traffic is routed natively by the Azure SDN fabric without encapsulation. This eliminates the overlay tunnel (VXLAN) hops that add latency and MTU overhead. For latency-sensitive inference traffic, direct routing is the optimal CNI choice.

Answer

Kubenet with host-port mapping

Answer

Kubenet with basic Linux bridge

Answer

Azure CNI Overlay