AI-200 Practice Exam 4 — 20 Questions

Question 1

An event subscriber endpoint hosted on an Azure App Service web app is failing to receive events from an Azure Event Grid system topic. Upon investigation, you discover Event Grid received a handshake validation failure. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The web app did not correctly handle and echo back the validation code during the Webhook handshake.. Event Grid requires a webhook validation handshake when a new event subscription is created. The subscriber endpoint must respond to the validation event by echoing back the validation code within a short timeout. If the web app fails to handle this handshake—for example, by not returning the validation code or returning an error—Event Grid marks the subscription as failed and does not deliver events. The most likely cause is that the web app did not correctly process and echo the validation code.

Answer

The event payload exceeded the 1 megabyte size limit.

Answer

The Service Bus connection string was incorrectly formatted.

Answer

The App Service pricing tier does not support HTTPS connections.

Question 2

Your enterprise requires that all container images deployed to Azure Kubernetes Service (AKS) must originate from approved corporate Azure Container Registries (ACRs). How can you enforce this restriction cluster-wide?

Accepted Answer

Configure Azure Policy for Kubernetes with the built-in initiative to restrict container registries. Azure Policy for Kubernetes extends Gatekeeper/OPA into AKS, allowing cluster-wide admission control that blocks pods whose images do not match approved ACR patterns. The built-in initiative 'Kubernetes cluster containers should only use allowed images' enforces this at admission time, before workloads are scheduled. This is the native, declarative, auditable mechanism Microsoft provides for exactly this governance requirement.

Answer

Configure standard Kubernetes Network Policies in the kube-system namespace

Answer

Set up ACR webhook notifications to trigger Azure Functions that delete unauthorized pods

Answer

Modify the kubelet configuration file on every cluster node manually

Question 3

You are optimizing an AI model container image size. Which technique is most effective for reducing the footprint of an image based on a large Python deep learning framework?

Accepted Answer

Implement multi-stage Docker builds.. Multi-stage Docker builds let you compile/install dependencies in a builder stage and copy only the runtime artifacts into a slim final stage, discarding build tools, caches, and intermediate files. For a large Python deep learning framework (e.g., PyTorch/TensorFlow), this can cut image size dramatically because compilers, pip caches, and dev headers never reach the final image. It is the standard technique for shrinking ML container images without losing functionality.

Answer

Enable ACR Georeplication.

Answer

Store model weights as image layers.

Answer

Use the 'latest' tag for all base images.

Question 4

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

Accepted Answer

Azure Monitor metrics with splitting on the 'DeploymentName' dimension.. Azure Monitor platform metrics for Azure OpenAI expose a 'DeploymentName' dimension on metrics such as TokenTransaction, ProcessedPromptTokens, and GeneratedCompletionTokens. Splitting on that dimension gives per-deployment token consumption, which is the most granular native view for attributing cost to a specific deployment.

Answer

Azure Advisor cost recommendations.

Answer

Application Insights logs via KQL query on the 'requests' table.

Answer

Azure Cost Management analysis on the resource group.

Question 5

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

Accepted Answer

IP firewall rules and virtual network service rules on the backend services restricting access to App Service. To prevent leaked credentials from being used from unauthorized networks, you should implement IP firewall rules and virtual network service rules on the backend services (Azure Cosmos DB and Azure OpenAI) to restrict access to only the App Service's outbound IP addresses or its virtual network. This ensures that even if credentials leak, they cannot be used from outside the allowed network.

Answer

Disabling managed identities across all application components

Answer

Configuring Azure Front Door with SSL offloading only

Answer

Enabling public anonymous access with client-side rate limiting

Question 6

When configuring an Azure AI Search vector index, which TWO parameters can be adjusted within the HNSW algorithm configuration to trade off between search speed, memory usage, and recall accuracy? (Choose two)

Accepted Answer

efSearch. Option A, efSearch, is correct because it sets the size of the dynamic candidate list used during query time in HNSW; increasing efSearch explores more neighbors, improving recall accuracy at the cost of slower searches, while decreasing it speeds up queries with lower recall. Option E, m, is correct because it defines the number of bidirectional links created for each node in the HNSW graph; a higher m improves recall and accuracy but consumes more memory, whereas a lower m reduces memory usage and speeds up indexing/search with reduced recall. Option B, replicaCount, is incorrect because it controls the number of replicas for high availability and query throughput in Azure AI Search, not the HNSW speed/memory/recall tradeoff. Option C, partitionCount, is incorrect because it controls index partitioning for storage and write scaling, not HNSW tuning. Option D, maxTextLength, is incorrect because it is a field/analyzer-related setting for text content length, unrelated to HNSW graph parameters.

Answer

replicaCount

Answer

partitionCount

Answer

maxTextLength

Question 7

When designing an Azure AI Search index schema, which TWO properties must be defined for every field in the index? (Choose two)

Accepted Answer

name. Option B (name) is correct because every field in an Azure AI Search index schema requires a unique name that identifies the field within the fields collection, and this name is used in queries, filters, and result documents. Option E (type) is correct because each field must declare an Edm data type (such as Edm.String, Edm.Int32, Edm.Boolean, Edm.DateTimeOffset, or Collection(Edm.String)) so the search engine knows how to index, store, and query the field's values. Option A (analyzerName) is not required for every field; analyzers apply only to searchable string fields and default to the standard Lucene analyzer when omitted. Option C (scoringProfile) is not a field-level property at all; scoring profiles are defined at the index level to influence relevance ranking. Option D (vectorDimensions) is only required for fields of type Collection(Edm.Single) that participate in vector search, not for every field.

Answer

analyzerName

Answer

scoringProfile

Answer

vectorDimensions

Question 8

You are managing multiple containerized AI models in AKS. You want to implement a service mesh to handle traffic splitting and mTLS. Which tool should you integrate?

Accepted Answer

Istio.. Istio is a full-featured service mesh that provides traffic splitting (via VirtualService and DestinationRule), mutual TLS (mTLS) between workloads, observability, and policy enforcement. It is the standard choice for AKS service mesh requirements, and AKS offers an Istio add-on for simplified installation and lifecycle management. This directly satisfies the traffic-splitting and mTLS requirements.

Answer

Calico.

Answer

Azure Application Gateway Ingress Controller (AGIC).

Answer

Azure Load Balancer.

Question 9

An application publishes custom events to an Azure Event Grid custom topic. You need to route events dynamically based on the event's 'department' property in the event payload. Which filtering mechanism should you configure on the Event Grid subscription?

Accepted Answer

Advanced Filters. Advanced Filters in Azure Event Grid allow filtering based on any property within the event payload, including custom properties like 'department'. They support operators such as string comparisons, numeric comparisons, and boolean logic, enabling dynamic routing based on event data. This is the correct mechanism because the requirement is to filter on a custom property in the event schema, which Advanced Filters are designed to handle.

Answer

Event Hubs Capture filters

Answer

Subject Begins With/Ends With filters

Answer

Service Bus Correlation Filters

Question 10

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

Accepted Answer

Dependency telemetry duration compared against custom client-side timers wrapping the API call. Application Insights dependency telemetry records the duration of outbound calls (including Azure OpenAI) as measured server-side by the SDK, so comparing that duration against a custom client-side timer that wraps the same API call isolates network/transport overhead from server processing time. If the client timer is much larger than the dependency duration, the delta is transport or client-side latency.

Answer

Azure Storage replication lag metrics

Answer

Azure Advisor performance score

Answer

Azure Policy compliance evaluation duration

Question 11

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

Accepted Answer

Use IHttpClientFactory to manage client lifecycles instead of instantiating new HttpClient objects per request.. In .NET, creating a new HttpClient per request leads to socket exhaustion because each instance holds its own connection pool and disposed clients leave sockets in TIME_WAIT. IHttpClientFactory pools and reuses HttpMessageHandler instances, resolving the exhaustion while still allowing per-request client configuration.

Answer

Configure a private endpoint between the App Service and Azure OpenAI.

Answer

Enable Always On in the App Service configuration settings.

Answer

Increase the TCP keep-alive timeout on the Azure App Service instance configuration.

Question 12

You are designing a RAG solution where documents are dynamically updated in Azure AI Search. You notice that search results return outdated information immediately after document updates. What is the cause of this behavior?

Accepted Answer

The indexer has not yet run its scheduled synchronization cycle to process changes from the data source. In Azure AI Search, data source changes are not automatically reflected in the index; an indexer must run to pull, transform, and load updated content. If the indexer is on a schedule (e.g., every 5 minutes or hourly), there is an inherent delay between the source update and the index refresh. Until that synchronization cycle completes, queries hit the old index data, returning outdated results. This is expected behavior, not a bug, and can be mitigated by triggering the indexer on-demand or using a change detection policy.

Answer

Semantic ranker caches search results for exactly 30 days

Answer

Azure OpenAI embedding models require a 24-hour cool-down period before new embeddings become valid

Answer

Vector indexes in Azure AI Search are read-only after creation and cannot accept updates

Question 13

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

Accepted Answer

Cost Analysis grouped by Resource Group and filtered by Service Name 'Machine Learning'. Cost Analysis in Azure Cost Management allows you to group and filter costs by subscription, resource group, and resource type.

Answer

Azure Advisor security dashboard

Answer

Application Insights availability tests

Answer

Azure Monitor Metric alerts

Question 14

You are troubleshooting a containerized AI model deployment in Azure Container Apps that fails to pass its HTTP readiness probe. You need to inspect the container logs and runtime diagnostics. Which THREE tools or commands can you use to troubleshoot this issue? Each correct answer presents a complete solution.

Accepted Answer

Access the Azure Portal and use the Console diagnostic tool for the specific container app revision.. Option A is correct because the Azure Portal's Console diagnostic tool for a specific container app revision opens an interactive shell inside the running container, letting you inspect the filesystem, processes, and probe-related runtime behavior directly. Option B is correct because 'az containerapp logs show' retrieves the system and console log streams for a container app (with parameters like --name, --resource-group, and --revision), which is exactly what you need to see why the HTTP readiness probe is failing. Option C is correct because Container Apps environments can send console and system logs to a Log Analytics workspace, where you can query them with KQL (for example, the ContainerAppConsoleLogs_CL and ContainerAppSystemLogs_CL tables) to diagnose probe failures. Option D is not correct because 'az aks browse' targets Azure Kubernetes Service clusters, not Azure Container Apps, and it opens a Kubernetes dashboard rather than exposing container logs. Option E is not correct because 'kubectl describe pod' works against a Kubernetes API server and pods, whereas Container Apps is a serverless platform that abstracts away pods and does not expose them to kubectl.

Answer

Execute az aks browse to open the Kubernetes dashboard.

Answer

Use kubectl describe pod to inspect Kubernetes events.

Question 15

Your development team is planning to deploy a containerized natural language processing model to Azure Container Apps. Which TWO features are natively supported by Azure Container Apps for managing application lifecycle and traffic? (Choose two.)

Accepted Answer

Built-in KEDA-based autoscaling including scaling to zero. Azure Container Apps natively supports KEDA-based autoscaling, including scale-to-zero, which is option B — this is a core platform capability that lets containerized workloads (such as an NLP model) scale based on event sources like HTTP traffic or queues without managing Kubernetes infrastructure. Option C is also correct because Azure Container Apps provides native revision management, allowing immutable revisions of an app to be created and traffic splitting (for example, weighted percentages) between revisions for blue-green or canary deployments. Option A is incorrect because Azure Container Apps is a serverless container platform and does not deploy or expose bare-metal hypervisors to users. Option D is incorrect because Azure Container Apps does not provide direct root SSH access to individual container instances; debugging is done via logs, console, or exec into containers without root host access. Option E is incorrect because the Kubernetes control plane is fully managed by Azure and users cannot manually configure master nodes.

Answer

Automatic deployment of bare-metal hypervisors

Answer

Direct root SSH access to individual container instances for interactive debugging

Answer

Direct manual configuration of control plane Kubernetes master nodes

Question 16

Your enterprise application uses Azure Event Grid. Which TWO event schemas are natively supported when publishing events to an Event Grid custom topic? (Choose two)

Accepted Answer

CloudEvents 1.0 schema. Azure Event Grid custom topics natively support two event schemas for publishing: the CloudEvents 1.0 schema (option D) and the proprietary Azure Event Grid schema (option E). CloudEvents 1.0 is the CNCF-standardized, interoperable envelope format that Event Grid accepts directly, while the Azure Event Grid schema is the service's original native format with fields like 'eventType', 'subject', 'data', and 'dataVersion'. Both are selectable via the topic's input schema setting and are the only two schemas Event Grid accepts for custom topic publishing. Options A, B, and C are incorrect: Apache Kafka record batch binary, AMQP 1.0 binary stream envelopes, and SOAP 1.2 XML are not supported input schemas for Event Grid custom topics, even though Event Grid can deliver to Kafka or use AMQP internally for its own transport.

Answer

Apache Kafka record batch binary schema

Answer

AMQP 1.0 binary stream envelope

Answer

SOAP 1.2 XML messaging schema

Question 17

You need to deploy a set of batch AI processing containers in Azure Container Instances that run to completion and then terminate. Which container group restart policy should you select?

Accepted Answer

Never. For Azure Container Instances running batch workloads that execute to completion and then terminate, the restart policy must be Never. This tells ACI not to restart the container after it exits, allowing the container group to reach a terminal Succeeded state. It is the correct choice for run-once batch AI processing jobs.

Answer

Always

Answer

UnlessStopped

Answer

OnFailure

Question 18

You are designing an IoT data ingestion architecture using Azure Event Hubs. Devices occasionally send malformed JSON payloads that cause stream processing jobs to crash. You need to route these invalid messages to a separate error container without stopping the main ingestion stream. What should you implement?

Accepted Answer

Use Azure Stream Analytics with an error output data stream configured for malformed events.. Azure Stream Analytics supports an error output data stream that captures malformed or deserialization-failed events, allowing the main query to continue processing valid events while routing bad records to a separate sink (e.g., Blob Storage container). This is the documented pattern for handling malformed JSON without stopping the stream. Configuring the error output to point at an 'error' container satisfies the requirement.

Answer

Enable Event Hubs Capture with the JSON validation flag set to strict.

Answer

Set up an Event Grid system topic filter for 'MalformedEvent'.

Answer

Configure the Service Bus dead-letter queue on the Event Hub producer client.

Question 19

You need to view the logs of a container that recently crashed in an AKS cluster. Which command is used?

Accepted Answer

kubectl logs --previous.. The `kubectl logs --previous` command retrieves the logs from the previous (crashed) container instance in a pod. When a container crashes and restarts, the current container's logs may be empty or show only the new startup, so the `--previous` flag is essential to access the terminated container's output. This is the standard kubectl mechanism for post-mortem debugging of crashed containers in AKS.

Answer

kubectl get pods.

Answer

az aks logs.

Answer

kubectl describe pod.

Question 20

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

Accepted Answer

Configure a Private Endpoint for the Azure AI Search service and integrate your App Service with the virtual network.. Azure Private Endpoint provides private IP addresses from your VNet to securely connect to Azure AI Search, keeping traffic off the public internet.

Answer

Enable Cross-Origin Resource Sharing (CORS) with a restricted origin list.

Answer

Enable TLS mutual authentication (mTLS) on the Azure AI Search service.

Answer

Configure IP access control lists on the Azure AI Search firewall to allow only the App Service outbound IPs.