AI-200 Practice Test 25 — 15 Questions

Question 1

You are designing a high-scale event ingestion pipeline using Azure Event Hubs in a secure enterprise environment. Public internet access must be disabled entirely. Producers and consumers reside in a peered Virtual Network (VNet). How should you configure network connectivity to the Event Hubs namespace?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Private Endpoints for the Event Hubs namespace and disable public network access.. Azure Private Endpoints create a private IP address for the Event Hubs namespace inside your VNet via Azure Private Link, and disabling public network access ensures all traffic flows over the Microsoft backbone rather than the internet. This is the canonical pattern for fully private, enterprise-grade Event Hubs connectivity from peered VNets.

Answer

Enable Service Bus Relay hybrid connections across the VNet gateway.

Answer

Deploy an Azure Bastion host in the subnet connected to the Event Hubs SAS key manager.

Answer

Configure IP firewall rules to allow the default gateway IP of the VNet.

Question 2

Your organization requires that all messages sent to an Azure Service Bus Premium namespace are encrypted using customer-managed keys (CMK) stored in Azure Key Vault. Where must you configure this encryption setting?

Accepted Answer

At the Service Bus Namespace level. Customer-managed key (CMK) encryption for Azure Service Bus is configured at the namespace level, where you specify the Key Vault key and managed identity used to access it. This setting applies to all queues and topics within the namespace, ensuring data at rest is encrypted with your key. Namespace-level configuration is the only supported scope for CMK in Service Bus.

Answer

Inside the Event Grid subscription endpoint URI

Answer

At the individual Queue or Topic level

Answer

Within the Azure Function consumer application configuration

Question 3

Your organization uses Azure Event Grid namespaces for MQTT client messaging in an industrial IoT scenario. Which authentication method should you configure for IoT devices connecting directly to the Event Grid namespace MQTT broker?

Accepted Answer

X.509 client certificates. Azure Event Grid namespaces support MQTT v3.1.1 and v5.0, and for direct device connections the recommended and supported authentication method is X.509 client certificates. Devices present a client certificate during the TLS handshake, and Event Grid validates it against a trusted CA or thumbprint. This is the standard for IoT device authentication in Event Grid MQTT broker.

Answer

SQL Database connection strings

Answer

Anonymous access with IP restriction headers

Answer

OAuth 2.0 client credentials grant via Service Bus endpoints

Question 4

You are managing an AKS cluster running resource-intensive AI training jobs. You want to ensure that nodes automatically scale up and down based on pending pod resource requests. Which component should you enable and configure?

Accepted Answer

Kubernetes Cluster Autoscaler. The Kubernetes Cluster Autoscaler is the component that adds or removes nodes in an AKS node pool based on pending pods that cannot be scheduled due to insufficient resources. It watches for unschedulable pods and scales the node pool up, then scales down underutilized nodes. This directly matches the requirement of scaling nodes based on pending pod resource requests.

Answer

KEDA (Kubernetes Event-driven Autoscaling)

Answer

Azure Load Balancer

Answer

Horizontal Pod Autoscaler

Question 5

You are designing an enterprise AI event-driven pipeline. Events from multiple SaaS applications are published to an Azure Event Grid domain. You need to ensure that a rogue tenant cannot exhaust the delivery throughput of other tenants. Which feature should you leverage?

Accepted Answer

Deploy separate Event Grid topics or distinct Event Domains per tenant with dedicated custom access keys or managed identities.. Deploying separate Event Grid topics or distinct Event Domains per tenant with dedicated access keys or managed identities isolates each tenant's publishing and delivery throughput, preventing a rogue tenant from exhausting shared resources. Event Grid domains allow multi-tenant publishing with per-tenant topics, but true throughput isolation requires separate domains or topics with separate authentication and quotas. This design ensures noisy-neighbor effects are contained.

Answer

Set the maximum delivery retry count to zero for all tenants.

Answer

Enable Azure DDoS Protection Standard on the storage account dead-letter container.

Answer

Configure Service Bus partitioned queues in front of the Event Grid domain.

Question 6

You are designing an application that stores vector embeddings in Azure Cosmos DB for NoSQL. You want to ensure that vectors are stored securely and that all data at rest is encrypted using customer-managed keys (CMK). How is this achieved in Cosmos DB?

Accepted Answer

Configure customer-managed keys (CMK) at the Azure Cosmos DB account level referencing Azure Key Vault. Customer-managed keys (CMK) for Azure Cosmos DB are configured at the account level, referencing an Azure Key Vault. This enables encryption of all data at rest, including vector embeddings, with keys managed by the customer. This is the correct and only way to achieve CMK encryption for Cosmos DB.

Answer

Enable encryption inside the vector embedding policy JSON definition

Answer

Encrypt each individual vector array in client application code before inserting

Answer

Store vectors in Azure Blob Storage with a CMK policy

Question 7

Your application publishes events to an Azure Event Grid topic. You want to ensure that event publishers must present a valid shared access signature or key in the HTTP request header. Which header name does Event Grid expect for key-based authentication?

Accepted Answer

aeg-sas-key. Azure Event Grid accepts key-based authentication via the 'aeg-sas-key' HTTP header, which carries the topic or domain access key. Publishers include this header to authenticate without needing an Microsoft Entra ID token, and Event Grid validates it against the topic's configured keys.

Answer

Authorization

Answer

x-functions-key

Answer

sb-connection-string

Question 8

You have a large image that takes a long time to pull. You want to speed up deployment in AKS. Which feature should you enable?

Accepted Answer

Enable Artifact Streaming in ACR.. Artifact Streaming in ACR (also called streaming artifacts) allows AKS nodes to start containers before the entire image is downloaded, by streaming only the layers needed at startup. This dramatically reduces cold-start time for large images because the kubelet doesn't wait for a full pull. It's the purpose-built ACR feature for accelerating large-image deployments in AKS.

Answer

Use a public mirror for the image.

Answer

Increase the AKS node count.

Answer

Use smaller base images.

Question 9

Which TWO of the following steps are required to enable GPU support for a pod in AKS?

Accepted Answer

Use a node pool with GPU-enabled VMs.. Option A is correct because GPU workloads in AKS can only be scheduled onto nodes backed by GPU-enabled VM sizes (for example NC, ND, or NV series), so the cluster must contain a GPU node pool. Option C is correct because the pod spec must request the GPU resource using the extended resource name 'nvidia.com/gpu' (for example, resources.limits: nvidia.com/gpu: 1), which is how the Kubernetes device plugin advertises and allocates GPUs to the container. Option B is incorrect because the Privileged flag in a Dockerfile is unrelated to GPU enablement and is not required for GPU scheduling. Option D is incorrect because running the pod as root is not a prerequisite for GPU access in AKS. Option E is incorrect because the NVIDIA drivers are installed and managed by AKS on the GPU nodes, not on the local client machine used to submit the pod.

Answer

Enable the 'Privileged' flag in the Dockerfile.

Answer

Set the pod to run as root.

Answer

Install the NVIDIA driver on the local machine.

Question 10

You are building an AI-powered order processing system. A web app publishes order events to an Azure Event Grid custom topic. A downstream Azure Function must process each event and, if processing fails, the event should be retried automatically by Event Grid. You configure the event subscription with a dead-letter destination. After a few days, you notice that some events were not processed successfully and were not delivered to the dead-letter destination. You need to ensure that failed events are captured for later analysis. What should you do?

Accepted Answer

Verify that the dead-letter destination (a storage account container) exists and that the managed identity has the necessary permissions.. Event Grid dead-letters an event only after all retry attempts are exhausted and if the dead-letter destination is properly configured. The most common reason for events not appearing in dead-letter storage is that the storage container does not exist or the managed identity used by the event subscription lacks write permissions. Verifying these settings ensures that failed events are captured for later analysis.

Answer

Change the event subscription endpoint type from Azure Function to Webhook.

Answer

Increase the event subscription's retry policy maximum delivery attempts.

Answer

Enable the 'Always deliver' option on the event subscription.

Question 11

Which Azure service provides a fully managed NoSQL database with native vector search capabilities and turnkey multi-region replication?

Accepted Answer

Azure Cosmos DB. Azure Cosmos DB is Microsoft's globally distributed, multi-model NoSQL database service that natively supports vector search through its integrated vector indexing and querying capabilities. It offers turnkey multi-region replication with configurable consistency levels and single-digit millisecond latency at the 99th percentile. The native vector search feature allows storing and querying high-dimensional embeddings directly alongside JSON documents without a separate vector store.

Answer

Azure Table Storage

Answer

Azure Blob Storage

Answer

Azure SQL Database

Question 12

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Accepted Answer

Deploy the private endpoint into a subnet within your Virtual Network.. Option B is correct because a private endpoint is a network interface created inside a subnet of your Virtual Network, so the endpoint must be deployed into a VNet subnet to give the Azure OpenAI resource a private IP address reachable from that network. Option C is correct because name resolution must map the Azure OpenAI FQDN (for example, <resource>.openai.azure.com) to the private endpoint's private IP; this is done by integrating with a private DNS zone such as privatelink.openai.azure.com and linking it to the VNet. Option E is correct because when creating the private endpoint you must specify the target sub-resource (group ID) of the Azure OpenAI service, which is 'account', so the endpoint connects to the correct service component. Option A is not required and is in fact contrary to the goal, since private endpoint access typically involves disabling or restricting public network access rather than enabling it with unrestricted IP ranges. Option D is incorrect because a private endpoint's network interface receives a private IP address from the subnet; it is not assigned a public IP address.

Answer

Enable public network access on the Azure OpenAI resource with unrestricted IP ranges.

Answer

Assign a public IP address directly to the private endpoint network interface.

Question 13

Which THREE of the following are security best practices for container registries?

Accepted Answer

Use Private Link for network access.. Option A is correct because using Azure Private Link (or an equivalent private endpoint) for registry access keeps traffic on the Microsoft backbone network and eliminates exposure of the registry to the public internet, preventing unauthorized access and data exfiltration. Option C is correct because applying Role-Based Access Control (RBAC) enforces least-privilege access, ensuring only authorized identities can push, pull, or manage registry resources such as repositories and images. Option E is correct because enabling vulnerability scanning (for example, Microsoft Defender for Containers or registry-integrated scanning) automatically detects known CVEs in image layers and base images, allowing remediation before deployment. Option B is not a best practice because disabling HTTPS exposes registry credentials and image layers to man-in-the-middle attacks and tampering; registries must enforce TLS. Option D is not a best practice because the 'latest' tag is mutable and non-deterministic, so production deployments should use immutable, version-specific tags or digests to guarantee reproducibility and traceability.

Answer

Disable HTTPS for faster access.

Answer

Use the 'latest' tag for production images.

Question 14

You are deploying a containerized machine learning inference service to Azure Container Apps. The model artifact is large (15 GB) and must be securely loaded during container startup. What is the most efficient way to mount this model data into the container app?

Accepted Answer

Mount an Azure Files volume to the container app. Mounting an Azure Files volume to the Container App is the most efficient approach because the 15 GB model is stored once in a durable share and mounted at container startup without bloating the image or re-downloading over the internet. Azure Files is the native persistent volume type for Container Apps and supports secure access via storage account keys or managed identity, satisfying the 'securely loaded' requirement.

Answer

Download the model over the public internet at container boot

Answer

Bake the model directly into the Docker image layer

Answer

Store the model in environment variables

Question 15

You are building an AI financial transactions ledger using Azure Service Bus. Each transaction must be processed strictly in order per account ID, and if a transaction fails, subsequent transactions for that specific account must wait until the issue is resolved. Which feature should you use?

Accepted Answer

Service Bus Sessions (SessionId set to the account ID). Service Bus Sessions provide FIFO ordering guarantees per SessionId, and setting SessionId to the account ID ensures all transactions for a given account are processed sequentially by a single receiver. Sessions also enable the receiver to lock the session, so if a transaction fails, subsequent messages in that session are not delivered until the lock is released or the message is completed/abandoned. This satisfies both the strict per-account ordering and the blocking-on-failure requirement.

Answer

Event Hubs partitions with round-robin load balancing

Answer

Azure Storage Queues with invisible timeout properties

Answer

Event Grid advanced filters keyed by account ID