AI-200 Practice Test 18 — 15 Questions

Question 1

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Action group. Action groups in Azure Monitor define notification channels such as SMS, email, webhook, and Azure App push notifications when alerts fire.

Answer

Azure Service Health

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 2

You are auditing your Azure AI services to ensure that all API keys are rotated regularly. What is the recommended practice for managing credentials in an enterprise AI solution?

Accepted Answer

Eliminate API keys by migrating authentication to Microsoft Entra ID managed identities.. Using managed identities eliminates API keys entirely, aligning with zero-trust security architecture.

Answer

Hardcode primary and secondary keys in application configuration files with failover logic.

Answer

Store API keys in plain text in Azure DevOps variable groups.

Answer

Rotate API keys manually every 7 days using the Azure portal.

Question 3

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides continuous security assessments, recommendations, and a secure score across Azure resources.

Answer

Azure Cost Management

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 4

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

Accepted Answer

Azure Monitor Activity Log alert. Azure Activity Log alerts monitor management-plane operations (such as resource creation, deletion, or modification) and trigger action groups when matched.

Answer

Azure Cost Management budget alert

Answer

Azure Advisor recommendation alert

Answer

Application Insights availability test

Question 5

Your enterprise security team mandates that all outbound traffic from your Azure Machine Learning workspace must pass through a centralized Azure Firewall, and no public IP addresses can be associated with workspace compute instances. Which workspace network isolation configuration should you select?

Accepted Answer

Workspace with a managed virtual network and outbound rules configured for user-defined routing through Azure Firewall. A fully private workspace with outbound rules (user-defined routes / Azure Firewall) ensures all traffic stays within private networks and outbound internet is controlled.

Answer

Public workspace with basic password authentication enabled on compute instances

Answer

Workspace using dynamic public IP allocation with Network Security Group (NSG) allow rules

Answer

Serverless compute instances with public endpoint access enabled

Question 6

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

Accepted Answer

Azure Active Directory sign-in logs or AzureDiagnostics table capturing managed identity token requests. Azure Active Directory sign-in logs and MSI (Managed Service Identity) token acquisition telemetry captured via Azure Monitor diagnostic settings (SignInLogs or AzureDiagnostics) record token acquisition attempts and failures.

Answer

Azure Cost Management amortization tables

Answer

Azure Storage blob access audit logs

Answer

Azure Key Vault secret version history

Question 7

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Accepted Answer

Azure Advisor cost recommendations. Azure Cost Management budgets allow setting spend thresholds with alerts, and Azure Advisor provides cost optimization recommendations.

Answer

Azure Bastion subnet configuration

Answer

Azure Key Vault access policies

Answer

Azure Service Health incident dashboard

Question 8

When monitoring an Azure OpenAI Service deployment using Azure Monitor, which TWO metrics are commonly tracked to evaluate throughput and capacity limits? (Choose two)

Accepted Answer

Active Connections / Request Count. Processed prompts/tokens and generated tokens are key performance and usage metrics tracked for Azure OpenAI deployments.

Answer

Azure SQL Database DTU percentage utilization

Answer

Virtual Machine disk IOPS performance counters

Answer

Azure Backup vault storage consumption

Question 9

You are analyzing security and compliance logs in an Azure Log Analytics workspace. You want to write KQL queries to investigate potential security incidents or token acquisition failures. Which THREE of the following KQL tables or operators are valid and useful for this investigation? (Choose three)

Accepted Answer

The exceptions table to analyze application error stack traces and failure types.. The dependencies, exceptions, and traces tables (or security audit tables) along with operators like where, summarize, and percentile are standard KQL elements.

Answer

The SELECT * FROM command syntax traditionally used in relational SQL databases.

Answer

The DROP TABLE administrative command inside Application Insights log streams.

Question 10

You are investigating an incident where an AI model endpoint experienced a spike in memory consumption, resulting in Out-Of-Memory (OOM) container crashes. You want to query Log Analytics to find the exact container memory working set percentage across all replicas during the past 2 hours. Which table and KQL query should you use?

Accepted Answer

InsightsMetrics | where TimeGenerated > ago(2h) | where Namespace == 'container' and Name == 'MemoryWorkingSetBytes' | summarize avg(Val) by Computer. Container metrics in Azure Monitor are stored in the `InsightsMetrics` table where `Namespace == 'container'` and `Name == 'memoryWorkingSetBytes'` or similar performance counters.

Answer

SecurityEvent | where TimeGenerated > ago(2h) | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(2h) | summarize count() by OperationName

Answer

AppTraces | where TimeGenerated > ago(2h) | summarize count() by Message

Question 11

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

Accepted Answer

Configure a Private Endpoint for the Azure AI Search service and integrate your App Service with the virtual network.. Azure Private Endpoint provides private IP addresses from your VNet to securely connect to Azure AI Search, keeping traffic off the public internet.

Answer

Enable Cross-Origin Resource Sharing (CORS) with a restricted origin list.

Answer

Enable TLS mutual authentication (mTLS) on the Azure AI Search service.

Answer

Configure IP access control lists on the Azure AI Search firewall to allow only the App Service outbound IPs.

Question 12

You need to restrict access to an Azure OpenAI resource so that only requests originating from a specific Azure Virtual Network are permitted. What should you configure?

Accepted Answer

Configure the Azure OpenAI resource networking settings to allow access from 'Selected networks' and add your Virtual Network subnet.. Virtual network rules (service endpoints or private endpoints) on the Azure OpenAI firewall can restrict access to specific VNets.

Answer

Enable Cross-Origin Resource Sharing (CORS) and specify the VNet IP range.

Answer

Assign the Cognitive Services Contributor role to the Virtual Network principal.

Answer

Enable Microsoft Defender for Cloud on the Virtual Network.

Question 13

Your Azure AI application relies on Azure OpenAI and Azure AI Search. You need to troubleshoot a sudden surge in HTTP errors and latency. Which THREE of the following Azure Monitor / Application Insights features or tools should you use to diagnose the issue? (Choose three)

Accepted Answer

Application Map in Application Insights to identify downstream dependency latency bottlenecks.. Application Map visualizes dependencies and latency bottlenecks, Metrics explorer tracks token consumption and throttling counters, and Log Analytics enables KQL queries for specific exception traces.

Answer

Azure Cost Management recommendation advisor for server resizing.

Answer

Azure Bastion diagnostic logs for RDP login failures.

Question 14

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and connects to Azure OpenAI. You need to ensure comprehensive security across network, identity, and secrets. Which THREE of the following configurations should you deploy? (Choose three)

Accepted Answer

Azure AD Workload Identity for Kubernetes pods to securely access Azure OpenAI without static keys.. Azure AD Workload Identity for pods, Network Policies for pod-to-pod isolation, and Azure Key Vault CSI secret driver secure the AKS AI workload.

Answer

Grant cluster-admin permissions to every unauthenticated container image.

Answer

Disable all TLS encryption on Kubernetes ingress controllers.

Question 15

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

Accepted Answer

Implement fallback routing or secondary region endpoints for high availability.. Implementing retry logic with exponential backoff in SDK clients and configuring circuit breaker patterns or fallback endpoints helps handle transient failures.

Answer

Disable all exception handling so unhandled errors crash the server.

Answer

Terminate the application process immediately on the first transient timeout.

Answer

Remove all timeout configurations from HTTP client connections.