AI-200 Practice Exam 3 — 20 Questions

Question 1

You are designing an AI architecture that stores vector embeddings in Azure Cosmos DB for NoSQL. You need to implement role-based access control (RBAC) so that specific application microservices can only execute read-only queries against the database without having permission to write or delete documents. How should you configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom SQL role definition with read-only data actions and assign it to the microservice's managed identity. Azure Cosmos DB for NoSQL has a native RBAC system built on SQL role definitions and role assignments. A custom role definition can be scoped to specific data-plane actions such as 'Microsoft.DocumentDB/databaseAccounts/readMetadata' and 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/read', granting read-only access. Assigning that role to the microservice's managed identity enforces least privilege without exposing keys.

Answer

Configure Azure Blob Storage RBAC permissions on the Cosmos DB container

Answer

Share the primary master master-key with all microservices

Answer

Disable authentication on the Cosmos DB account during query execution

Question 2

Your organization requires that all data transmitted to an Azure Service Bus namespace is encrypted in transit using Transport Layer Security (TLS). What is the minimum required TLS version enforced by modern Azure Service Bus secure baselines?

Accepted Answer

TLS 1.2. Modern Azure Service Bus secure baselines require a minimum of TLS 1.2 for all data in transit. TLS 1.2 is the enforced floor because older protocols (SSL 3.0, TLS 1.0, TLS 1.1) have known cryptographic weaknesses and are deprecated across Azure services.

Answer

SSL 3.0

Answer

Plaintext HTTP with custom Base64 encoding

Answer

TLS 1.0

Question 3

Which Azure AI Search field property indicates whether the contents of a field can be returned in search query result documents?

Accepted Answer

retrievable. In Azure AI Search, the 'retrievable' attribute controls whether a field's contents are returned in search results. If retrievable is false, the field can still be searched, filtered, or sorted but its value is omitted from the returned document. This is the exact property that governs result payload inclusion.

Answer

searchable

Answer

facetable

Answer

filterable

Question 4

Your team needs to process high-volume clickstream data from a web application using Apache Kafka protocols while leveraging Azure-managed infrastructure. Which Azure service should you deploy?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is a fully managed, real-time data ingestion service that supports the Apache Kafka protocol via its Kafka endpoint. It is designed for high-throughput event streaming and can handle clickstream data at scale. By deploying Event Hubs, you can use Kafka producers and consumers without managing Kafka clusters.

Answer

Azure Event Grid

Answer

Azure Notification Hubs

Answer

Azure Service Bus

Question 5

You are building a hybrid search solution using Azure AI Search that combines BM25 full-text search with vector search. What is the name of the feature that intelligently combines and normalizes scores from different retrieval systems before presenting the final top results?

Accepted Answer

Reciprocal Rank Fusion (RRF). Reciprocal Rank Fusion (RRF) is the algorithm Azure AI Search uses to merge BM25 and vector result sets in hybrid queries. It converts each result's rank into a reciprocal score (1/(k+rank)) and sums them, producing a normalized combined ranking without needing to align raw score scales. This is why hybrid search in Azure AI Search 'just works' without manual score normalization.

Answer

Min-Max Score Scaling

Answer

Cosine Distance Normalization

Answer

Cross-Encoder Re-ranking

Question 6

You are developing a serverless AI notification workflow. When an AI model finishes training, it publishes an event to an Azure Event Grid topic. You want to trigger an Azure Logic App when this event occurs. Which Event Grid subscription event delivery schema and endpoint type should you select?

Accepted Answer

Select 'Webhook' as the endpoint type and provide the Logic Apps HTTP Request URL.. Azure Logic Apps expose an HTTP-triggered endpoint (the 'When an HTTP request is received' or Event Grid trigger URL) that Event Grid can invoke directly. Selecting 'Webhook' as the endpoint type and supplying the Logic App's HTTP Request URL lets Event Grid POST the event payload to the Logic App, which then parses it and runs the workflow. This is the standard, first-class integration pattern for Event Grid → Logic Apps.

Answer

Select 'Storage Queue' as the endpoint type.

Answer

Select 'Azure Service Bus Queue' as the endpoint type and provide the queue connection string.

Answer

Select 'Azure Event Hubs' as the endpoint type and provide the connection string.

Question 7

Your team is building an automated image moderation pipeline. When an image is uploaded to Azure Blob Storage, you need to trigger an Azure Function to process it using Azure AI Vision. You want to ensure the lowest latency and native cloud event integration. Which integration approach should you configure?

Accepted Answer

Configure an Azure Event Grid system topic and subscription for blob storage events targeting the Azure Function.. Azure Event Grid natively integrates with Blob Storage via system topics and delivers blob-created events to subscribers such as Azure Functions with near-real-time push delivery. This is the lowest-latency, event-driven pattern and requires no polling or intermediate queue.

Answer

Attach an Azure Event Hubs capture policy to the storage container.

Answer

Use an Azure Logic Apps polling trigger to check the storage container every minute for new files.

Answer

Write a background worker service that reads the Azure Service Bus queue populated by storage transactions.

Question 8

Your enterprise AI system processes sensitive Personal Identifiable Information (PII). Compliance regulations require that audit logs capturing who accessed the AI endpoints must be retained immutably for 5 years without possibility of deletion. Where should you configure this immutability policy?

Accepted Answer

Azure Storage account container immutability policies with time-based retention. Azure Storage account container immutability policies with time-based retention (WORM — Write Once, Read Many) enforce that blobs cannot be modified or deleted for a specified retention period, and when locked, the policy cannot be removed even by account owners. This directly satisfies the requirement for immutable 5-year audit log retention. Audit logs written to an immutable container remain tamper-proof for the full retention window.

Answer

Azure Active Directory audit log retention configuration

Answer

Application Insights retention settings configured via the portal

Answer

Azure Key Vault soft-delete and purge protection

Question 9

Your enterprise architecture uses Azure Service Bus Topics and Subscriptions with geo-disaster recovery paired namespaces. A disaster occurs, and you trigger a failover to the secondary region. What happens to the messages currently in the subscriptions of the primary namespace?

Accepted Answer

Messages remaining in the primary namespace are not automatically replicated to the secondary namespace; failover relies on metadata synchronization.. Service Bus geo-disaster recovery (Geo-DR) pairs a primary and secondary namespace and continuously replicates only the namespace metadata — queues, topics, subscriptions, filters, and authorization rules. Message data itself is not replicated, so messages sitting in the primary namespace's subscriptions at the moment of failover are not available in the secondary namespace and are effectively stranded until the primary is restored.

Answer

All queued messages are automatically migrated to the secondary region within 5 seconds.

Answer

Azure Event Grid automatically replays all lost messages from the storage capture.

Answer

The primary namespace messages are permanently deleted and cannot be recovered.

Question 10

You want to track the latency of your model inference API in production. Which Azure tool should you integrate into your containerized application?

Accepted Answer

Azure Application Insights.. Azure Application Insights is the Application Performance Management (APM) service within Azure Monitor, designed to capture request latency, dependency calls, exceptions, and custom telemetry from applications. Integrating the Application Insights SDK (or OpenTelemetry) into the containerized inference API automatically records request duration and end-to-end transaction traces. This directly answers the requirement to track inference API latency in production.

Answer

Azure Storage Queue.

Answer

Azure Event Hubs.

Answer

Azure Data Factory.

Question 11

You are designing a high-availability RAG architecture where search queries must succeed even if an entire Azure region experiences an outage. You deploy Azure AI Search in a primary region and a secondary region. How should client applications handle failover?

Accepted Answer

Use Azure Traffic Manager or Azure Front Door in front of regional search service endpoints with health probes. Azure Traffic Manager and Azure Front Door are the correct global load-balancing services to place in front of regional Azure AI Search endpoints, using health probes to detect regional outages and route client traffic to a healthy secondary region. Traffic Manager operates at the DNS layer with priority or performance routing, while Front Door provides anycast-based Layer 7 routing with faster failover and additional WAF/TLS offload. Both support health probe configuration that automatically removes an unhealthy regional endpoint from rotation.

Answer

Hardcode the secondary search IP address in client application configuration files

Answer

Rely on Cosmos DB automatic failover to replicate search indices

Answer

Configure SQL replication between search indexes

Question 12

You are deploying a custom AI model container to Azure Container Apps. The container listens on port 8080 and requires health probes to verify readiness before routing traffic. How should you configure the probes?

Accepted Answer

Configure an HTTP readiness probe targeting port 8080 on your health check endpoint. Azure Container Apps supports HTTP and TCP probes defined at the container level, and an HTTP readiness probe is the correct mechanism to signal that the app is ready to receive traffic on its listening port. Since the container listens on port 8080 and exposes a health check endpoint, an HTTP readiness probe targeting that port lets the platform delay traffic routing until the endpoint returns a success status code. This matches the Kubernetes-style probe model that Container Apps implements, where readiness probes control traffic admission rather than process restart.

Answer

Configure an Azure Front Door health probe pointing to the internal container IP

Answer

Configure a TCP liveness probe pointing to port 22 for SSH management

Answer

Configure a startup probe that restarts the container if CPU usage drops below 5 percent

Question 13

Your organization uses Azure Service Bus Topics. You need to ensure that messages published to a topic are delivered to subscriptions in a specific priority order (e.g., high priority messages processed before normal priority). What is the recommended Service Bus design pattern to achieve this?

Accepted Answer

Create separate queues or subscriptions for high-priority and normal-priority messages, and have workers poll the high-priority entity first.. Service Bus does not natively support message priority ordering, so the recommended pattern is to create separate queues or subscriptions for each priority level and have consumers drain the high-priority entity first. This gives deterministic priority handling because the broker processes each entity independently and the consumer controls polling order. It is the standard workaround for the absence of a built-in priority property.

Answer

Set the Priority property on the Service Bus message header to 99.

Answer

Configure Event Hubs partition key hashing to group priority messages.

Answer

Enable Event Grid priority filters on the topic.

Question 14

You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?

Accepted Answer

http. Azure Container Apps supports built-in KEDA-based scale rules, and the 'http' scale rule type scales based on concurrent HTTP requests. This is the correct choice for scaling a container that receives HTTP traffic and needs to handle concurrent requests.

Answer

azure-service-bus

Answer

cpu

Answer

tcp

Question 15

You are deploying an AI model container to Azure Container Apps. The container application needs to securely connect to an Azure SQL Database without storing plain-text database credentials in environment variables or application code. What is the recommended feature to use?

Accepted Answer

Azure Key Vault references with managed identity. Azure Key Vault references combined with a managed identity let the container retrieve secrets at runtime without embedding credentials in code or environment variables. The managed identity authenticates to Key Vault, and the Key Vault reference resolves the secret into the app's configuration securely.

Answer

Azure Container Registry admin credentials

Answer

Container Apps encrypted environment variables

Answer

Kubernetes secrets mapped via sidecar proxy

Question 16

You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is a managed, private Docker registry service that allows you to store and manage container images and artifacts. It supports Docker and OCI images, and integrates with Azure services like AKS, App Service, and Azure Machine Learning. For AI workloads, ACR is the standard place to store custom container images used in training or inference.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Artifacts

Question 17

You are troubleshooting an Azure Function triggered by an Azure Event Grid subscription. The function is failing to receive events. Which TWO diagnostic steps should you take in the Azure Portal or via Azure CLI? Each correct answer is a valid troubleshooting action.

Accepted Answer

Inspect the configured dead-letter blob storage container for undelivered event files.. Option A is correct because Event Grid supports a dead-letter destination (a Storage blob container) where events are written when they cannot be delivered to the subscriber, so inspecting that container reveals undelivered event files and their failure reasons. Option C is correct because Event Grid exposes metrics such as Delivery Failed Events, Dropped Events, and Matched Events in Azure Monitor, which directly show whether events are being matched to the subscription and whether delivery to the function is failing. Option B is not applicable because AMQP port 5671 is used by Service Bus and Event Hubs, not by Event Grid, which delivers events over HTTPS (port 443) to webhook/function endpoints. Option D is not applicable because Service Bus session lock renewal is a Service Bus feature unrelated to Event Grid subscriptions. Option E is not applicable because Event Hubs consumer group checkpoints relate to Event Hubs consumption, not to Event Grid event delivery to an Azure Function.

Answer

Verify the AMQP listener port 5671 firewall rules on the function app.

Answer

Review Service Bus session lock renewal logs.

Answer

Check Event Hubs consumer group checkpoint offset status.

Question 18

Your team is developing an Azure Function that acts as an Event Grid webhook subscriber. You want to test the function locally using the Azure Functions Core Tools CLI. Which command starts the local runtime and enables local event ingestion?

Accepted Answer

func start. The Azure Functions Core Tools command `func start` launches the local Functions host, which exposes the HTTP trigger endpoint (typically http://localhost:7071/api/<function>) that Event Grid can target as a webhook subscriber. It also loads local.settings.json so you can point at a real Event Grid subscription for end-to-end local testing. This is the standard way to run and debug a function locally before deploying.

Answer

dotnet watch run-eventgrid

Answer

az eventgrid topic local-debug

Answer

az functionapp deployment source config

Question 19

You are configuring secure ingress and network isolation for an Azure Container Apps environment. Which THREE capabilities are supported when configuring networking for Container Apps? (Choose three.)

Accepted Answer

Exposing the environment with either external (public) or internal (private VNet) ingress. Option A is correct because Azure Container Apps environments support both external ingress, which exposes apps to the public internet via a public endpoint, and internal ingress, which restricts access to a private VNet or the environment's internal network. Option C is correct because you can deploy a Container Apps environment into a customer-managed Azure Virtual Network subnet, enabling network isolation, private endpoints, and control over inbound/outbound traffic. Option E is correct because Container Apps supports custom domain names with automated managed TLS/SSL certificates, including free managed certificates for custom domains and binding of existing certificates. Option B is incorrect because customers cannot directly modify physical Azure datacenter top-of-rack switches; Azure manages the physical network infrastructure. Option D is incorrect because attaching physical Fibre Channel SAN arrays is not a supported Container Apps networking capability; persistent storage in Container Apps is provided through Azure Files or managed storage abstractions, not direct SAN attachment.

Answer

Direct modification of physical Azure datacenter top-of-rack switches

Answer

Direct attachment of physical Fibre Channel storage SAN arrays

Question 20

You are designing a high-performance RAG data layer architecture using Azure AI Search. Which THREE indexing and retrieval strategies should you implement to maximize recall and precision? (Choose three)

Accepted Answer

Enable semantic ranker to re-order top results using deep learning models. Option A is correct because Azure AI Search's semantic ranker applies deep-learning language models (Microsoft's semantic re-ranking) to re-order the top BM25/vector results, improving precision by promoting semantically relevant documents that lexical or vector scoring alone may rank lower. Option C is correct because HNSW (Hierarchical Navigable Small World) is the approximate nearest neighbor algorithm used in Azure AI Search vector indexes, and tuning m (number of bi-directional links per node), efConstruction (index-time candidate list size), and efSearch (query-time candidate list size) directly controls the recall-versus-latency tradeoff — higher values increase recall at the cost of latency. Option E is correct because hybrid search fuses BM25 keyword scoring with vector similarity (via Reciprocal Rank Fusion in Azure AI Search), capturing both exact term matches and semantic similarity, which raises recall and precision versus either method alone. Option B is incorrect because disabling scoring and ranking would eliminate relevance ordering entirely, destroying precision rather than maximizing it. Option D is incorrect because embeddings must be stored in vector fields (Collection(Edm.Single) with a vector profile and HNSW configuration) to be searchable; storing them as plain text in unindexed fields makes them unusable for vector retrieval.

Answer

Disable all scoring and ranking algorithms to save CPU cycles

Answer

Store embeddings as plain text strings in unindexed fields