AI-200 Practice Test 19 — 15 Questions

Question 1

You are running a GPU-intensive AI workload in AKS. You want to ensure the pods are scheduled only on nodes that have GPUs. How do you enforce this?

Accepted Answer

Use a nodeSelector for 'sku=gpu'.. A nodeSelector in the pod spec constrains scheduling to nodes whose labels match the specified key-value pair, so 'sku=gpu' ensures the pod only lands on GPU-labeled nodes. This is the simplest and most direct scheduling constraint for hardware targeting in AKS. It works because the Kubernetes scheduler filters nodes by label before scoring them.

Answer

Use a DaemonSet.

Answer

Define a Resource Request for RAM.

Answer

Add a Kubernetes Taint to the GPU nodes.

Question 2

You are configuring diagnostic logging for an enterprise Azure OpenAI Service deployment. You need to forward logs to multiple destinations for security analysis and archiving. Which THREE of the following destinations are supported by Azure Monitor diagnostic settings? (Choose three)

Accepted Answer

Azure Event Hubs. Diagnostic settings support routing logs and metrics to Log Analytics workspaces, Azure Storage accounts, and Azure Event Hubs.

Answer

Azure Container Registry local image cache

Answer

Azure Bastion host memory dump

Question 3

You want to monitor the security posture and compliance score of your Azure AI resources. Which TWO of the following tools should you use? (Choose two)

Accepted Answer

Azure Policy compliance dashboard for regulatory standard evaluations. Option D is correct because the Azure Policy compliance dashboard evaluates resources against built-in and custom policy definitions, including regulatory standard initiatives such as ISO 27001, NIST SP 800-53, and PCI DSS, and reports each resource's compliance state, which directly addresses monitoring the compliance score of Azure AI resources. Option E is correct because Microsoft Defender for Cloud continuously assesses Azure resources, including AI services, against security benchmarks and surfaces security recommendations plus a Secure Score that quantifies the overall security posture. The two together cover the compliance dimension (Azure Policy) and the security-posture dimension (Defender for Cloud) requested in the scenario. Option A is incorrect because Azure Container Registry storage tiers only control image storage performance and cost, not security or compliance evaluation. Option B is incorrect because the Azure DNS zone editor manages DNS records and has no role in security posture or regulatory compliance scoring. Option C is incorrect because Azure Cost Management provides billing and cost forecasting data, not security recommendations or compliance assessments.

Answer

Azure Container Registry storage tiers

Answer

Azure DNS zone editor

Answer

Azure Cost Management for billing forecasts

Question 4

Your organization wants to ensure that all Azure AI development follows strict security and observability standards. Which TWO of the following practices should be enforced across teams? (Choose two)

Accepted Answer

Require Application Insights integration on all deployed web and AI applications.. Option C is correct because Application Insights provides the telemetry, distributed tracing, and logging needed to meet observability standards for deployed web and AI applications, enabling monitoring of requests, dependencies, and failures. Option D is correct because managed identities let Azure services authenticate to resources such as Key Vault, Storage, and Azure OpenAI without storing credentials in code, which directly enforces strict security standards for service-to-service authentication. Option A is wrong because disabling monitoring removes the observability required by the scenario and undermines incident detection and diagnostics. Option B is wrong because shared root passwords eliminate accountability and violate least-privilege and credential-hygiene principles. Option E is wrong because storing production database passwords in public README files exposes secrets and is a severe security violation.

Answer

Disable all monitoring to reduce cloud resource costs.

Answer

Use shared root passwords for all virtual machines.

Answer

Allow developers to store production database passwords in public README files.

Question 5

Your enterprise application uses Azure Service Bus Topics. A specific downstream billing system needs to receive only messages where the 'Region' property in the message application properties equals 'NorthAmerica'. What should you create on the Service Bus subscription?

Accepted Answer

A SQL Filter or Correlation Filter on the subscription. Azure Service Bus subscriptions support SQL Filters and Correlation Filters that evaluate message application properties (e.g., Region = 'NorthAmerica') and route only matching messages to the subscription. A Correlation Filter is especially efficient for equality checks on properties like Region, while SQL Filters allow more complex expressions. This is the native filtering mechanism for Service Bus Topics.

Answer

An Event Grid Advanced Filter on the namespace topic

Answer

A Storage Queue access policy

Answer

An Event Hubs Partition Key routing rule

Question 6

Which Azure AI Search capability allows you to extract text from images and PDF documents during indexer execution using AI cognitive skills?

Accepted Answer

Skillsets. Skillsets in Azure AI Search define a pipeline of cognitive skills (such as OCR, image analysis, entity recognition, and text translation) that run during indexer execution to enrich content. To extract text from images and PDFs, you attach a skillset to the indexer, and skills like OCR or Document Extraction process the content. Semantic configurations, scoring profiles, and vector profiles do not perform content extraction.

Answer

Semantic configurations

Answer

Scoring profiles

Answer

Vector profiles

Question 7

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Accepted Answer

Azure Advisor cost recommendations. Azure Advisor cost recommendations (A) is correct because it analyzes resource usage and configuration and surfaces actionable recommendations to reduce spend, such as rightsizing or shutting down idle resources, which directly helps prevent budget overruns. Azure Cost Management budgets and alerts (E) is correct because you can define a budget threshold and configure alerts that trigger when actual or forecasted costs approach or exceed that amount, enabling proactive governance. Azure Bastion subnet configuration (B) is incorrect because it concerns secure RDP/SSH connectivity to VMs, not cost monitoring or governance. Azure Key Vault access policies (C) is incorrect because it governs secrets, keys, and certificate permissions, not spending. Azure Service Health incident dashboard (D) is incorrect because it reports platform outages and service issues, not cost or budget data.

Answer

Azure Bastion subnet configuration

Answer

Azure Key Vault access policies

Answer

Azure Service Health incident dashboard

Question 8

You are optimizing an Azure Cosmos DB for NoSQL vector search container. Which THREE properties must be correctly configured inside the vectorEmbeddingPolicy JSON object? (Choose three)

Accepted Answer

path. The vectorEmbeddingPolicy JSON object in an Azure Cosmos DB for NoSQL container requires three properties: path, dataType, and distanceFunction. Option A (path) is correct because it specifies the JSON path to the array property in each document that holds the vector embedding, such as "/embedding". Option C (dataType) is correct because it defines the data type of the vector elements, with supported values like float32, float16, int8, and uint8, which must match the stored vector data. Option D (distanceFunction) is correct because it specifies the similarity metric used for vector search, such as cosine, dotproduct, or euclidean, and is required for the index to compute nearest neighbors. Options B (httpPort) and E (sslEnabled) are not part of the vectorEmbeddingPolicy; these are connection or endpoint settings, not properties of the vector embedding policy JSON object.

Answer

httpPort

Answer

sslEnabled

Question 9

You are integrating Azure Container Registry with Azure Kubernetes Service. You want to enable authentication without storing static credentials (username/password) in Kubernetes secrets. What is the recommended integration method?

Accepted Answer

Attach the ACR to the AKS cluster using Azure CLI attachment command. Attaching ACR to AKS using the Azure CLI (az aks update --attach-acr) configures the cluster's kubelet managed identity with the AcrPull role on the registry, enabling image pulls without static credentials. This is the native, supported integration that eliminates the need for Kubernetes image pull secrets.

Answer

Store ACR admin credentials in a Kubernetes Secret object

Answer

Configure a Docker daemon config.json file on every node manually

Answer

Enable anonymous pull on the Azure Container Registry

Question 10

When configuring an Azure Cosmos DB for NoSQL container to store embeddings, what data type must the vector property be stored as within the JSON document?

Accepted Answer

An array of 32-bit floating-point numbers. Azure Cosmos DB for NoSQL stores vector embeddings as a JSON array of 32-bit floating-point numbers (float32), which is the format its native vector indexing and DiskANN-based similarity search expect. Each element represents one dimension of the embedding, and the container's vector policy declares dimensions and the float32 data type.

Answer

A base64 encoded string

Answer

An array of integers

Answer

A binary blob

Question 11

You are deploying an Azure OpenAI Service resource and must ensure that all traffic from your virtual network reaches the endpoint without traversing the public internet. Which feature should you configure?

Accepted Answer

Configure a Private Endpoint for the Azure OpenAI resource. Private endpoints use private IP addresses from your VNet to securely bring services into your VNet, eliminating public exposure.

Answer

Enable public network access with selected IP address ranges

Answer

Configure a Service Endpoint without enabling virtual network rules

Answer

Deploy an Azure Application Gateway in front of the endpoint

Question 12

You are troubleshooting high latency in an AI inference workload on AKS. You suspect the issue is caused by container startup time (cold starts). Which feature helps mitigate this?

Accepted Answer

Azure Container Registry Artifact Streaming.. Azure Container Registry (ACR) Artifact Streaming (also called streaming artifacts) allows container image layers to be pulled on demand as the container starts, rather than downloading the entire image first. This dramatically reduces cold-start time for large AI inference images by letting the container begin execution while layers stream in the background. It directly addresses the container startup latency described.

Answer

Configuring Vertical Pod Autoscaler.

Answer

Increasing the memory limit for the pod.

Answer

Using a smaller base OS distribution.

Question 13

Your data science team pushes container images to Azure Container Registry (ACR). You need to ensure that every image pushed is automatically scanned for known vulnerabilities before being deployed to production. Which ACR feature should you enable?

Accepted Answer

Microsoft Defender for Cloud vulnerability scanning. Microsoft Defender for Cloud (specifically the Defender for Containers plan) integrates with ACR to automatically scan images on push and continuously rescan for newly disclosed CVEs. Findings surface as security recommendations and can gate deployment via Azure Policy. This is the native ACR vulnerability-scanning capability the question asks for.

Answer

ACR Tasks

Answer

Azure Policy geo-replication rules

Answer

Content Trust signing

Question 14

You are using Azure Container Apps. You need to deploy a new version of your AI model without downtime. Which deployment strategy should you configure?

Accepted Answer

Traffic splitting between revisions.. Azure Container Apps supports multiple revisions and allows you to split incoming traffic between them by percentage or label. By deploying the new model as a new revision and gradually shifting traffic, you achieve zero-downtime deployment and can perform canary or blue-green releases. This is the native mechanism for safe, progressive rollout in Container Apps.

Answer

Overwrite the current revision.

Answer

Rolling update.

Answer

Scale to zero and redeploy.

Question 15

You are deploying a model that requires a specific version of a non-standard OS library. You want to ensure the build environment is consistent across your team. What should you use?

Accepted Answer

A Dockerfile with fixed base image tags.. A Dockerfile with pinned base image tags (e.g., python:3.11.7-slim rather than python:latest) guarantees that every team member and CI run builds against the exact same OS libraries and toolchain. This reproducibility is the core requirement for consistent build environments.

Answer

Manual installation on the build agent.

Answer

Install the library via a post-deployment script.

Answer

Use the 'latest' tag for the base image.