AI-200 Practice Test 19 — 15 Questions

Question 1

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

Accepted Answer

Disable local authentication on the Azure OpenAI resource and grant users the Cognitive Services OpenAI User role.. Azure role-based access control (Azure RBAC) can be used to authenticate requests to Azure OpenAI by disabling local authentication (API keys) via the 'disableLocalAuth' property.

Answer

Configure a managed identity on the app service and store the API key in Azure Key Vault.

Answer

Implement Cross-Origin Resource Sharing (CORS) rules on the Azure OpenAI resource.

Answer

Enable soft-delete on the Azure OpenAI resource.

Question 2

You want to receive an email notification whenever monthly spending on your Azure OpenAI Service exceeds $5,000. Which Azure feature should you configure?

Accepted Answer

Cost Management budget with an alert threshold set at the desired dollar amount. Azure Cost Management budgets allow you to define spending thresholds and attach action groups or email recipients for notifications.

Answer

Azure Service Health incident alert

Answer

Azure Advisor security recommendation

Answer

Azure Monitor Metric alert on CPU utilization

Question 3

You want to ensure that your Azure AI infrastructure costs are properly attributed to different business departments. Which TWO features should you configure? (Choose two)

Accepted Answer

Azure resource tags for department identification (e.g., Department=Finance). Resource tagging and Cost Management export/cost views help organize and attribute costs by department.

Answer

Azure Key Vault cryptographic keys

Answer

Application Insights availability probes

Answer

Azure Firewall network rules

Question 4

An enterprise application calls multiple Azure AI Language services. You need to trace requests across multiple distributed microservices to diagnose high latency issues. Which Azure Monitor capability should you implement?

Accepted Answer

Application Insights Distributed Tracing. Distributed tracing in Application Insights tracks requests across multiple service boundaries using W3C Trace Context headers.

Answer

Azure Advisor cost recommendations

Answer

Log Analytics metric alerts without instrumentation

Answer

Azure Network Watcher Connection Monitor

Question 5

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

Accepted Answer

Cost Analysis grouped by Resource Group and filtered by Service Name 'Machine Learning'. Cost Analysis in Azure Cost Management allows you to group and filter costs by subscription, resource group, and resource type.

Answer

Azure Advisor security dashboard

Answer

Application Insights availability tests

Answer

Azure Monitor Metric alerts

Question 6

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Accepted Answer

Allow Azure services and resources to access this server firewall setting combined with Virtual Network rules. Service endpoints or private endpoints on Azure SQL Database allow Azure services (such as AI Search) to connect securely within the Microsoft backbone network while disabling public access.

Answer

Open firewall port 1433 for all IP addresses globally

Answer

Use Azure Front Door to load balance SQL TCP connections

Answer

Configure an HTTP proxy inside an Azure VM to forward SQL queries

Question 7

An enterprise application uses Azure AI Search and needs to authenticate securely to an Azure OpenAI backend without exposing credentials in connection strings. What is the recommended approach?

Accepted Answer

Configure a system-assigned managed identity on the Azure AI Search service and assign the Cognitive Services OpenAI User role on the Azure OpenAI resource.. A system-assigned or user-assigned managed identity should be enabled on the Azure AI Search service and granted the Cognitive Services OpenAI User role on the Azure OpenAI resource.

Answer

Create a shared access signature (SAS) token for the Azure OpenAI endpoint and rotate it every 30 days.

Answer

Use HTTP basic authentication with a pre-shared service principal secret.

Answer

Store the Azure OpenAI primary key in an Azure App Configuration service and reference it via Key Vault.

Question 8

You are investigating performance degradation in an Azure AI Search vector search index. You need to run a Kusto Query Language (KQL) query in Application Insights to analyze dependency durations for search queries. Which table should you query?

Accepted Answer

Query the 'traces' table where message contains 'SearchLatency'.. Dependencies in Application Insights are stored in the 'dependencies' table, which records outgoing HTTP calls to Azure AI Search.

Question 9

You are auditing your Azure subscription for security best practices related to Azure AI resources. Which TWO of the following actions help enforce governance and security? (Choose two)

Accepted Answer

Use Azure Policy to enforce allowed deployment regions and mandatory tagging.. Applying resource locks prevents accidental deletion, and enforcing Azure Policy ensures regional and configuration compliance.

Answer

Grant every user Contributor rights to the entire Azure subscription.

Answer

Share the master subscription co-administrator password with all external contractors.

Answer

Disable all firewall rules on Azure Key Vault.

Question 10

You are designing a secure enterprise AI architecture on Azure. Which TWO of the following practices should you implement to secure credentials and service access? (Choose two)

Accepted Answer

Use system-assigned or user-assigned managed identities for Azure service-to-service authentication.. Using managed identities eliminates hardcoded credentials, and storing runtime configuration secrets in Azure Key Vault ensures centralized, secure secret management.

Answer

Store API keys and connection strings as plain text in Git repository configuration files.

Answer

Grant subscription Owner permissions to all mobile client applications.

Answer

Disable TLS encryption on internal microservice communication to improve network throughput.

Question 11

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

Accepted Answer

Container Insights in Azure Monitor.. Container Insights (part of Azure Monitor) provides integrated monitoring for AKS, allowing you to correlate pod restarts and node resource exhaustion with application errors.

Answer

Azure Key Vault audit logs.

Answer

Log Analytics Workspace 'AppRequests' table.

Answer

Azure Machine Learning studio 'Endpoints' monitoring tab.

Question 12

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

Accepted Answer

Azure Private Link with private endpoints mapped to your virtual network. Private endpoints via Azure Private Link and disabling public network access on PaaS resources ensure complete network isolation from the public internet.

Answer

Enabling anonymous access on Application Insights data ingestion endpoints

Answer

Using Azure Front Door with global public anycast IPs

Answer

Assigning public IP addresses to all backend scoring containers

Question 13

You are auditing an Azure AI platform for security vulnerabilities. You want to ensure that secrets, connection strings, and certificates are handled in compliance with security best practices. Which THREE of the following practices should you enforce? (Choose three)

Accepted Answer

Implement automated secret rotation policies for API keys and service credentials.. Enforcing Key Vault soft-delete/purge protection, using managed identities, and rotating secrets regularly are key security practices.

Answer

Commit production database passwords to public GitHub repositories for easy developer access.

Answer

Grant every employee administrator access to all Key Vault secrets.

Question 14

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Private Endpoint for the Azure OpenAI resource. Private endpoints use private IP addresses from your VNet to securely bring services into your VNet, eliminating public exposure.

Answer

Enable public network access with selected IP address ranges

Answer

Configure a Service Endpoint without enabling virtual network rules

Answer

Deploy an Azure Application Gateway in front of the endpoint

Question 15

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

Accepted Answer

Use Application Insights to examine the 'Dependencies' and 'Requests' logs for duration outliers.. Analyzing telemetry through Application Insights and checking endpoint logs in the workspace are the standard methods to isolate performance issues.

Answer

Change the SKU of the underlying compute cluster to a lower tier.

Answer

Restart the Azure Machine Learning workspace to clear cache.

Answer

Delete and recreate the deployment without checking logs.