AI-200 Practice Test 24 — 15 Questions

Question 1

You are troubleshooting intermittent network timeout errors between microservices in an AKS cluster running an AI pipeline. You suspect that network policies are blocking required inter-pod communication. Which CNI plugin must be configured in AKS to enforce these network policies?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure CNI with Azure Network Policies or Calico enabled. AKS network policies are only enforced when the cluster uses Azure CNI (or Azure CNI Overlay) with a policy engine — either Azure Network Policy Manager or Calico — enabled at cluster creation. Kubenet does not support NetworkPolicy enforcement, and kube-proxy/NAT Gateway are unrelated to pod-level policy enforcement. Therefore Azure CNI plus Azure Network Policies or Calico is the required configuration.

Answer

Kubernetes standard kube-proxy in IPVS mode only

Answer

Azure Virtual Network NAT Gateway

Answer

Kubenet basic networking without network policies

Question 2

You are implementing a robust data layer architecture for an enterprise generative AI application. Which THREE factors should you evaluate when deciding between Azure AI Search and Azure Cosmos DB for vector search? (Choose three)

Accepted Answer

Need for automated multi-region replication with single-digit millisecond latency reads. Option A is correct because Azure Cosmos DB is designed for global distribution with turnkey multi-region replication and single-digit millisecond read/write latencies at the 99th percentile, which is a decisive factor when the vector store must serve globally distributed users; Azure AI Search does not provide the same multi-master, multi-region replication model. Option B is correct because Azure AI Search natively provides full-text search with BM25 ranking, scoring profiles, and semantic re-ranking (semantic ranker/L2 reranking), capabilities that Cosmos DB's vector search does not offer out of the box. Option E is correct because Cosmos DB is a transactional NoSQL database offering low-latency CRUD operations (point reads/writes, optimistic concurrency via ETags) in the same store as vector indexes, which matters when the application must mutate documents and query embeddings together. Option C is not relevant because neither service runs Hadoop MapReduce jobs directly over vector indexes, and vector search is not a MapReduce workload. Option D is incorrect because Cosmos DB is a NoSQL document database, not a relational engine with SQL tables and foreign key constraints, and Azure AI Search is not relational either.

Answer

Requirement to run Hadoop MapReduce jobs directly over the vector indexes

Answer

Requirement to store vector embeddings as relational SQL tables with foreign key constraints

Question 3

You are designing an event-driven architecture that needs to integrate multiple Azure services. Which THREE statements accurately describe the ideal use cases for Azure Event Grid, Azure Service Bus, and Azure Event Hubs respectively? (Choose three)

Accepted Answer

Azure Event Hubs is designed for high-throughput big data streaming and telemetry ingestion pipelines.. Option A is correct because Azure Event Hubs is a big-data streaming platform built for ingesting millions of events per second from telemetry, logs, and IoT sources into pipelines like Azure Stream Analytics or Spark. Option C is correct because Azure Event Grid is a reactive, push-based pub/sub service that routes discrete event notifications from Azure resource events and custom topics to subscribers such as Functions, Logic Apps, and webhooks. Option E is correct because Azure Service Bus provides enterprise brokering with queues, topics/subscriptions, sessions, transactions, dead-lettering, and guaranteed FIFO ordering via sessions. Option B is wrong because Kafka-protocol streaming is a feature of Event Hubs (Kafka endpoint), not Event Grid. Option D is wrong because Service Bus is a brokered messaging service with at-least-once delivery and store-and-forward semantics, not a stateless sub-millisecond webhook notifier like Event Grid.

Answer

Azure Event Grid is designed for high-speed Kafka protocol big data telemetry streaming.

Answer

Azure Service Bus is optimized for stateless event notifications with sub-millisecond webhook delivery.

Question 4

You are troubleshooting an AI inference container deployed in Azure Container Apps that is failing health probes. Which TWO diagnostic tools or logs can you examine in the Azure portal to investigate the failure?

Accepted Answer

Log stream in the Azure portal for the container app replica. Option A, the Log stream in the Azure portal for the container app replica, is correct because Azure Container Apps exposes real-time stdout/stderr and system logs per replica, letting you see probe failures, application startup errors, and health endpoint responses directly. Option C, the Container Apps console for interactive terminal access, is correct because it opens a shell session inside the running container (via the platform's built-in exec capability), so you can manually curl the health endpoint, inspect environment variables, check listening ports, and verify the process is running. Option B is wrong because Azure Bastion connects to Azure VMs, not to Container Apps, which run on a managed serverless platform without a directly accessible host VM. Option D is wrong because AKS control plane audit logs apply to Azure Kubernetes Service clusters, not to Container Apps. Option E is wrong because Azure Storage blob metrics report on storage account usage and performance, which are unrelated to container health probe failures.

Answer

Azure Bastion connection to the container host VM

Answer

AKS control plane audit logs

Answer

Azure Storage Account blob container metrics

Question 5

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

Accepted Answer

Use the TelemetryClient class and its TrackEvent method with a dictionary of custom dimensions.. The TelemetryClient class in the Application Insights SDK is the primary API for sending custom telemetry, and its TrackEvent method accepts a dictionary of custom dimensions (properties) that are indexed and queryable in Application Insights. This allows you to attach arbitrary key-value pairs such as prompt token counts and user IDs to a custom event, which then appear as customDimensions in the telemetry schema. Unlike plain logging, this approach preserves structured data and integrates with the full Application Insights analytics and filtering capabilities.

Answer

Configure the AzureMonitorLogExporter in the standard logging pipeline.

Answer

Use the DiagnosticSource class to emit unstructured string logs to Console.

Answer

Use the AzureKeyVaultClient to store transient custom properties.

Question 6

You have an Azure Container Registry and an Azure Kubernetes Service cluster in different Azure regions. You want to ensure that AKS nodes pull container images from a local regional endpoint to minimize latency and cross-region data transfer fees. What feature should you configure on ACR?

Accepted Answer

ACR Geo-Replication. ACR Geo-Replication lets you replicate a registry to multiple Azure regions so that each AKS cluster pulls from a regional replica endpoint, reducing latency and eliminating cross-region egress charges. When geo-replication is enabled, ACR automatically routes pull requests to the closest replica based on the client's region. This is the native, supported way to achieve regional image locality.

Answer

Azure ExpressRoute global reach

Answer

ACR Import command scheduled daily

Answer

Azure Traffic Manager DNS routing

Question 7

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

Accepted Answer

Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search. The most secure approach is to enable a system-assigned managed identity on the App Service and grant it the Search Index Data Reader role on the Azure AI Search service. Managed identities eliminate secrets entirely — Microsoft Entra ID issues and rotates the credentials automatically, and the app authenticates to Search using its identity. This follows the zero-trust, secretless best practice for service-to-service authentication.

Answer

Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service

Answer

Store the primary admin API key in Azure App Service configuration environment variables

Answer

Use shared access signatures (SAS) tokens generated by a client script

Question 8

When configuring vector search in Azure AI Search, which TWO components are required to successfully define and execute a vector search query? (Choose two)

Accepted Answer

A vector query payload specifying the query vector and target field. Option D is correct because Azure AI Search requires the index schema to include a vector field (created with the Collection(Edm.Single) data type and a dimensions value) before any vector search can be performed against it; without a defined vector field there is nothing to query. Option C is correct because executing a vector search requires a query payload that supplies the query vector (for example, "vectorQueries" with "kind": "vector", "vector": [...], and "fields": "<vectorFieldName>") along with the target vector field, which the search engine uses to compute similarity. Options A, B, and E are incorrect because a Cosmos DB partition key, an Azure SQL connection string, and an HDInsight Hadoop endpoint are unrelated to Azure AI Search vector query definition and execution; vector search relies on the search index schema and query payload, not on those external data-store or big-data components.

Answer

A Cosmos DB container partition key

Answer

An Azure SQL Server database connection string

Answer

An HDInsight Hadoop cluster endpoint

Question 9

When designing an Azure AI Search solution, you need to store high-dimensional embeddings. Which field type must be used to store these vector representations correctly?

Accepted Answer

Collection(Edm.Single). Azure AI Search stores vector embeddings in fields of type Collection(Edm.Single), which is a collection of single-precision floats. This matches the float32 output of models like text-embedding-ada-002 and is the required type for vector fields. The field must also have a vector search profile and dimensions defined.

Answer

Edm.Double

Answer

Edm.String

Answer

Collection(Edm.Int32)

Question 10

An AI pipeline uses Azure Service Bus Queues. You want to inspect the number of messages currently residing in a queue waiting to be processed without actually receiving or locking them. Which Azure Portal section or metric should you check?

Accepted Answer

The Service Bus Queue 'Overview' blade displaying Active Message Count metrics.. The Service Bus Queue 'Overview' blade in the Azure Portal displays the Active Message Count metric, which reports the number of messages currently in the queue that are ready to be received. This is a non-destructive metric — it does not lock or receive messages — and is the standard way to inspect queue depth.

Answer

The Azure Storage Account queued message monitoring graphs.

Answer

The Event Grid subscription delivery status log.

Answer

The Event Hubs capture storage container file list.

Question 11

You need to configure network security for an Azure Container Apps environment that hosts an internal AI scoring API. The API must only be reachable from a specific Azure Virtual Network (VNet) and blocked from public internet access. How should you configure the environment?

Accepted Answer

Deploy the Container Apps environment with an internal Virtual Network integration and internal load balancer. To make a Container Apps environment reachable only from a specific VNet and block public internet access, you deploy the environment with VNet integration and configure it to use an internal load balancer. This gives the environment a private IP in your subnet and removes the public ingress endpoint entirely.

Answer

Attach a Private Endpoint to the Azure Container Registry hosting the app

Answer

Enable IP security restrictions on the default public ingress

Answer

Configure an Azure Front Door instance with WAF rules in front of the public endpoint

Question 12

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Accepted Answer

Purchase Azure reservations or provisioned throughput commitments for steady-state workloads.. Option B is correct because Azure reservations and provisioned throughput commitments (for example, Azure OpenAI Provisioned Throughput Units or Azure AI Search provisioned capacity) offer significant discounts over pay-as-you-go pricing for predictable, steady-state workloads, lowering cost while maintaining guaranteed capacity and reliability. Option C is correct because right-sizing VM and GPU SKUs using historical Azure Monitor utilization metrics ensures you pay only for the compute capacity actually needed, eliminating over-provisioning waste without reducing the performance required by the workload. Option D is correct because Azure Machine Learning compute clusters support min_nodes=0, which automatically scales the cluster down to zero nodes when idle, so you incur no compute charges during idle periods while still scaling back up on demand, preserving availability. Option A is incorrect because deleting Application Insights workspaces and halting telemetry removes observability, degrading reliability, troubleshooting, and performance tuning rather than reducing spend responsibly. Option E is incorrect because running all development and production workloads on the highest-tier enterprise GPUs 24/7 regardless of usage maximizes cost and wastes capacity, directly contradicting the goal of cost optimization.

Answer

Delete all Application Insights workspaces and stop collecting any monitoring telemetry.

Answer

Run all development and production workloads on the highest tier enterprise GPUs 24/7 regardless of usage.

Question 13

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Accepted Answer

Azure ExpressRoute or Site-to-Site VPN with Azure Private Link to workspace private endpoints. To reach a private-endpoint-secured Azure Machine Learning workspace from on-premises without exposing management ports, you combine private connectivity with Azure Private Link. ExpressRoute or a Site-to-Site VPN provides the encrypted hybrid path from the corporate network into Azure, and Private Link resolves the workspace's private endpoint to a private IP inside the VNet, so notebook and compute traffic never traverses the public internet.

Answer

Public IP addresses assigned to all developer workstations with NSG allow rules

Answer

Turning off all network security groups and opening all ports on the Azure firewall

Answer

Azure Bastion deployed on the on-premises physical router

Question 14

You are troubleshooting an AI application container in an AKS cluster that cannot resolve external domain names (e.g., huggingface.co). Which TWO Kubernetes components should you investigate?

Accepted Answer

kube-dns service endpoint mapping. Option A (kube-dns service endpoint mapping) is correct because in AKS the kube-dns Service in kube-system is the ClusterIP endpoint that pods use for DNS queries; if its selector does not match the CoreDNS pods, the endpoint list is empty and name resolution fails. Option E (CoreDNS deployment and pod health in the kube-system namespace) is correct because CoreDNS pods actually serve DNS; if they are crashlooping, unready, or scaled to zero, external names like huggingface.co cannot be resolved. Option B is irrelevant because the Horizontal Pod Autoscaler only adjusts replica counts based on metrics and has no role in DNS resolution. Option C is irrelevant because PVC binding affects storage mounting, not name resolution. Option D is irrelevant because an expired Ingress TLS certificate only breaks HTTPS trust for inbound traffic, not outbound DNS lookups from the container.

Answer

Horizontal Pod Autoscaler configuration

Answer

Persistent Volume Claim binding state

Answer

Ingress controller SSL certificate expiration

Question 15

You are troubleshooting event delivery failures in Azure Event Grid. Which TWO mechanisms can help you analyze or recover undeliverable events? (Choose two)

Accepted Answer

Configuring a Dead-Letter destination pointing to an Azure Blob Storage container. Option A is correct because Azure Event Grid supports a dead-letter destination (typically an Azure Blob Storage container) where events that cannot be delivered after all retry attempts are stored, allowing you to inspect and later reprocess the undeliverable events. Option C is correct because enabling Azure Monitor diagnostic settings on the Event Grid topic or subscription lets you route delivery and publish metrics plus resource logs (e.g., DeliveryFailures, DroppedEvents) to Log Analytics, Storage, or Event Hubs, which is the standard way to analyze delivery failures. Option B is not applicable because Service Bus session locks are a Service Bus feature for ordered, session-aware message consumption, not an Event Grid delivery-recovery mechanism. Option D is wrong because 'az servicebus queue purge' deletes messages from a Service Bus queue and has nothing to do with Event Grid undeliverable events. Option E is wrong because Event Hubs Capture writes event data to storage in Avro format and does not replay webhook HTTP headers for Event Grid.

Answer

Enabling Service Bus message session locks on the event subscription

Answer

Running the az servicebus queue purge command

Answer

Using Event Hubs Capture to replay webhook HTTP headers