AI-200 Practice Test 21 — 15 Questions

Question 1

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Cost Management Budgets with alert conditions. Azure Cost Management Budgets let you define a monetary threshold scoped to a subscription, resource group, or specific resource, and attach alert conditions (e.g., 80% of budget) that fire via email or Action Groups. This is the only native Azure feature that directly ties spend tracking to a departmental budget with automated threshold alerts. Budgets can be filtered by tag, resource group, or service, so each business unit's AI spend can be isolated.

Answer

Azure Advisor cost recommendations

Answer

Azure Monitor autoscale settings

Answer

Azure Service Health alerts

Question 2

You want to ensure your AI inference service is highly available across multiple regions. What is the recommended approach for container distribution?

Accepted Answer

Enable ACR Georeplication.. ACR geo-replication lets a single registry definition replicate images to multiple Azure regions automatically, so each regional inference endpoint pulls from a local replica with low latency and survives a regional outage. It also supports regional failover without manual image copying.

Answer

Store images in a public Docker Hub account.

Answer

Use a single global ACR endpoint.

Answer

Manually copy images using a script.

Question 3

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

Accepted Answer

Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace. Diagnostic settings are the native Azure mechanism for routing resource-level platform logs and metrics from individual PaaS resources (such as Azure OpenAI and Azure AI Language) to a Log Analytics workspace, Storage account, or Event Hub. Because diagnostic settings are configured per resource and can target a workspace in any resource group or subscription (as long as the caller has appropriate RBAC), this is the correct way to centralize telemetry across resource groups.

Answer

Enable Application Insights dependency tracking on the subscription level via Azure Policy

Answer

Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints

Answer

Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances

Question 4

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

Accepted Answer

Azure Active Directory sign-in logs or AzureDiagnostics table capturing managed identity token requests. Token acquisition failures against Microsoft Entra ID (Entra ID) are logged in the Microsoft Entra ID sign-in logs and, for managed identity token requests, in the AzureDiagnostics table within Log Analytics. These logs capture the exact HTTP status codes (e.g., 400, 401, 403) and error descriptions such as AADSTS error codes returned during the OAuth 2.0 client credentials flow. Analyzing these tables lets you pinpoint whether the failure is due to misconfigured credentials, missing role assignments, or conditional access policies.

Answer

Azure Cost Management amortization tables

Answer

Azure Storage blob access audit logs

Answer

Azure Key Vault secret version history

Question 5

You are designing a disaster recovery strategy for an Azure Event Hubs namespace. You configure Geo-Disaster Recovery pairing between a primary region (East US) and a secondary region (West US). During a disaster drill, you trigger a failover. What happens to the DNS alias pointing to the Event Hubs namespace?

Accepted Answer

The alias is automatically updated to point to the secondary namespace, enabling client reconnection without changing connection strings.. Geo-Disaster Recovery in Azure Event Hubs uses a DNS alias (namespace hostname) that abstracts the primary and secondary namespaces. When you trigger a failover, the alias's DNS CNAME record is automatically repointed to the secondary namespace, so clients using the alias connection string reconnect without any configuration change. This is the core value of the alias-based failover model.

Answer

The primary namespace automatically becomes the replica of the secondary namespace without breaking the pair.

Answer

The alias enters a Read-Only state for 24 hours while DNS propagation finishes globally.

Answer

The alias is permanently deleted and clients must be hardcoded with the secondary namespace connection string.

Question 6

You are configuring an Azure Kubernetes Service (AKS) cluster for enterprise AI workloads. Which THREE practices should you implement to enhance cluster security and isolation? (Choose three.)

Accepted Answer

Configure Microsoft Entra Workload Identity for pod-to-Azure service authentication. Option A is correct because Microsoft Entra Workload Identity federates Kubernetes service accounts with Microsoft Entra ID via OIDC, letting pods authenticate to Azure services (Key Vault, Storage, etc.) without storing secrets or using a shared service principal. Option D is correct because Azure Policy for Kubernetes (via the Gatekeeper admission controller) enforces governance and compliance at the cluster level, such as restricting privileged containers, hostPath mounts, and allowed registries. Option E is correct because integrating Microsoft Entra ID with Azure RBAC for Kubernetes authorization enables centralized, identity-based access control to the API server, replacing static local accounts and supporting least-privilege role assignments. Option B is incorrect because disabling TLS on the API server exposes credentials and traffic to interception and violates security best practices; performance gains do not justify it. Option C is incorrect because sharing a single service principal across all namespaces eliminates isolation, creates a single credential to compromise, and prevents per-workload least-privilege scoping.

Answer

Disable TLS on the API server to improve inter-node communication speed

Answer

Share a single service principal across all namespaces for simplified administration

Question 7

You want to view an end-to-end distributed trace of a user request flowing from an Azure Front Door through an API Management gateway, into an Azure Function, and finally to an Azure OpenAI model call. Which Application Insights feature visualizes this entire call chain and highlights latency bottlenecks?

Accepted Answer

Application Map and Transaction Diagnostics. Application Map in Application Insights visualizes the topology of distributed components and their call relationships, while Transaction Diagnostics drills into a single end-to-end transaction to show each dependency call and its latency. Together they trace a request from Front Door through APIM, Functions, and Azure OpenAI, highlighting the slowest hop.

Answer

Azure Cost Analysis

Answer

Azure Advisor security recommendations

Answer

Azure Policy compliance dashboard

Question 8

You are managing an Azure Service Bus Standard namespace. Your development team requests the ability to use Topics and Subscriptions. What action must you take to support this requirement?

Accepted Answer

Ensure the Service Bus namespace is at the Standard or Premium tier.. Azure Service Bus Topics and Subscriptions are only available in the Standard and Premium tiers. The Basic tier does not support topics; it only supports queues. Therefore, to use Topics and Subscriptions, the namespace must be at the Standard or Premium tier.

Answer

Enable AMQP 1.0 multiplexing on the Basic tier namespace.

Answer

Create an Event Hubs capture rule to simulate topic subscriptions.

Answer

Upgrade the namespace to Azure Event Grid Premium.

Question 9

When configuring an Azure Container Instances container group, which TWO properties can you define?

Accepted Answer

DNS name label for public IP resolution. Option B is correct because an Azure Container Instances container group can be exposed with a public IP address that includes a DNS name label, allowing resolution via ..azurecontainer.io. Option E is correct because container groups support defining environment variables (including secure values) that are passed to the container runtime at startup, which is a core configuration property of ACI containers. Options A and C are incorrect because AKS node pool sizing and VM scale set autoscaling rules belong to AKS and Virtual Machine Scale Sets respectively, not to ACI container group configuration. Option D is incorrect because Kubernetes namespace allocation is a Kubernetes/AKS concept and is not a property you define when configuring an ACI container group.

Answer

AKS node pool sizing

Answer

Virtual machine scale set autoscaling rules

Answer

Kubernetes namespace allocation

Question 10

You are implementing an asynchronous AI processing pipeline using Azure Event Hubs. Multiple worker instances consume events from the same Event Hub. To prevent duplicate processing and ensure load balancing across workers, how should you manage consumer checkpoints?

Accepted Answer

Use the Azure Event Hubs EventProcessorClient with an Azure Blob Storage checkpoint store.. The EventProcessorClient is the recommended high-level client for consuming events from Event Hubs in .NET and other languages. It uses an Azure Blob Storage checkpoint store to persist checkpoints and partition ownership, enabling load balancing across multiple worker instances and preventing duplicate processing by resuming from the last checkpoint.

Answer

Configure Azure Service Bus auto-forwarding from Event Hubs to a queue.

Answer

Set the Event Hub partition retention period to zero.

Answer

Write custom code to maintain consumer offsets in a local memory cache on each worker instance.

Question 11

You are designing a secure MLOps pipeline using Azure Container Registry. Which THREE practices should you implement to secure your AI container images?

Accepted Answer

Use managed identities instead of admin credentials for registry authentication. Option B is correct because managed identities let Azure services (e.g., AKS, Azure ML) authenticate to ACR without storing admin username/password secrets, eliminating credential leakage and enabling least-privilege RBAC assignments. Option C is correct because signing images with Notation (Notary Project) and verifying signatures at deploy time ensures image integrity and provenance, preventing tampered or unauthorized images from running. Option D is correct because Microsoft Defender for Cloud's container registry scanning continuously detects OS and language-level CVEs in pushed images, so vulnerable images can be remediated before deployment. Option A is wrong because disabling RBAC removes fine-grained access control and weakens registry security rather than simplifying it safely. Option E is wrong because anonymous pull access exposes images to anyone, violating the principle of least privilege and risking IP theft or supply-chain abuse.

Answer

Disable role-based access control (RBAC) on the registry to simplify management

Answer

Enable anonymous pull access for all public developers

Question 12

You need to ensure that your vector data in Azure AI Search is protected at rest. Which setting should you verify?

Accepted Answer

Configure Customer-Managed Keys (CMK) for the search service.. Customer-Managed Keys (CMK) in Azure AI Search provide encryption at rest for the service's data, including vector indexes, by allowing you to use your own Azure Key Vault key to encrypt the service's internal storage. This ensures that vector data is protected at rest with a key you control, meeting compliance requirements. The other options address in-transit encryption (TLS), network access, or a different service (Cosmos DB), not at-rest encryption for Azure AI Search.

Answer

Enable TLS 1.3 on the search service.

Answer

Disable public network access.

Answer

Enable Always Encrypted on the Cosmos DB container.

Question 13

An AKS cluster is configured with KEDA for autoscaling an AI inferencing service based on Azure Queue Storage length. The pods fail to scale. Which component should you inspect first?

Accepted Answer

The ScaledObject resource status.. KEDA works by creating and managing a Horizontal Pod Autoscaler behind the scenes, but the user-facing configuration object is the ScaledObject, which defines the trigger (Azure Queue Storage), min/max replicas, and target workload. If scaling fails, the ScaledObject's status conditions and events reveal authentication errors, trigger misconfiguration, or missing metadata. Inspecting it first is the fastest path to the root cause.

Answer

The Azure Container Registry webhook settings.

Answer

The Horizontal Pod Autoscaler (HPA) resource directly.

Answer

The Cluster Autoscaler logs.

Question 14

You are designing a data architecture on Azure where embeddings are generated offline by an Azure Databricks pipeline and stored in Azure AI Search. You want to minimize ingestion latency and optimize throughput when uploading millions of pre-computed vectors. Which client library API pattern should you use?

Accepted Answer

Use SearchClient batch upload APIs with up to 1000 documents per batch. The Azure AI Search SDK's SearchClient supports batch indexing via IndexDocumentsBatch or the mergeOrUpload/upload actions, and the service accepts up to 1000 documents (or ~16 MB) per batch request. Batching pre-computed vectors this way amortizes HTTP overhead and maximizes indexing throughput, which is exactly what you want when pushing millions of embeddings generated offline by Databricks. This is the documented, supported high-throughput ingestion pattern.

Answer

Stream vectors directly through the Azure AI Search integrated vectorizer skillset

Answer

Send documents one-by-one using synchronous CreateOrUpdate API calls

Answer

Execute direct SQL INSERT statements against the underlying search partition nodes

Question 15

You are designing a data layer architecture for an enterprise AI assistant that requires high-performance vector search, structured filtering, and multi-tenant isolation. Which THREE design patterns should you consider? (Choose three)

Accepted Answer

Combining vector similarity with metadata filters to narrow search scope. Option A is correct because combining vector similarity with metadata filters (pre-filtering or post-filtering on structured attributes) narrows the candidate set, improving both relevance and latency for an AI assistant that needs structured filtering alongside semantic search. Option C is correct because tenant-specific partition keys or metadata filter tags enforce logical isolation in a shared vector index, ensuring queries only return a tenant's own data and satisfying multi-tenant isolation requirements. Option E is correct because hybrid search fuses dense vector similarity with sparse keyword matching (for example BM25 plus embeddings, often combined via reciprocal rank fusion), capturing both exact term matches and conceptual similarity for higher recall and precision. Option B is wrong because an unindexed JSON blob with no partition keys destroys search performance and provides no tenant isolation. Option D is wrong because hardcoding user prompts into the index schema is brittle, non-scalable, and violates separation of data from schema design.

Answer

Storing all tenant data in a single unindexed JSON blob without partition keys

Answer

Hardcoding all user prompts directly into the search index schema