AI-200 Practice Test 3 — 25 Questions

Question 1

You are designing a high-availability RAG architecture where search queries must succeed even if an entire Azure region experiences an outage. You deploy Azure AI Search in a primary region and a secondary region. How should client applications handle failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure Traffic Manager or Azure Front Door in front of regional search service endpoints with health probes. Azure Traffic Manager and Azure Front Door are the correct global load-balancing services to place in front of regional Azure AI Search endpoints, using health probes to detect regional outages and route client traffic to a healthy secondary region. Traffic Manager operates at the DNS layer with priority or performance routing, while Front Door provides anycast-based Layer 7 routing with faster failover and additional WAF/TLS offload. Both support health probe configuration that automatically removes an unhealthy regional endpoint from rotation.

Answer

Hardcode the secondary search IP address in client application configuration files

Answer

Rely on Cosmos DB automatic failover to replicate search indices

Answer

Configure SQL replication between search indexes

Question 2

You are deploying a custom AI model container to Azure Container Apps. The container listens on port 8080 and requires health probes to verify readiness before routing traffic. How should you configure the probes?

Accepted Answer

Configure an HTTP readiness probe targeting port 8080 on your health check endpoint. Azure Container Apps supports HTTP and TCP probes defined at the container level, and an HTTP readiness probe is the correct mechanism to signal that the app is ready to receive traffic on its listening port. Since the container listens on port 8080 and exposes a health check endpoint, an HTTP readiness probe targeting that port lets the platform delay traffic routing until the endpoint returns a success status code. This matches the Kubernetes-style probe model that Container Apps implements, where readiness probes control traffic admission rather than process restart.

Answer

Configure an Azure Front Door health probe pointing to the internal container IP

Answer

Configure a TCP liveness probe pointing to port 22 for SSH management

Answer

Configure a startup probe that restarts the container if CPU usage drops below 5 percent

Question 3

Your organization uses Azure Service Bus Topics. You need to ensure that messages published to a topic are delivered to subscriptions in a specific priority order (e.g., high priority messages processed before normal priority). What is the recommended Service Bus design pattern to achieve this?

Accepted Answer

Create separate queues or subscriptions for high-priority and normal-priority messages, and have workers poll the high-priority entity first.. Service Bus does not natively support message priority ordering, so the recommended pattern is to create separate queues or subscriptions for each priority level and have consumers drain the high-priority entity first. This gives deterministic priority handling because the broker processes each entity independently and the consumer controls polling order. It is the standard workaround for the absence of a built-in priority property.

Answer

Set the Priority property on the Service Bus message header to 99.

Answer

Configure Event Hubs partition key hashing to group priority messages.

Answer

Enable Event Grid priority filters on the topic.

Question 4

You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?

Accepted Answer

http. Azure Container Apps supports built-in KEDA-based scale rules, and the 'http' scale rule type scales based on concurrent HTTP requests. This is the correct choice for scaling a container that receives HTTP traffic and needs to handle concurrent requests.

Answer

azure-service-bus

Answer

cpu

Answer

tcp

Question 5

You are deploying an AI model container to Azure Container Apps. The container application needs to securely connect to an Azure SQL Database without storing plain-text database credentials in environment variables or application code. What is the recommended feature to use?

Accepted Answer

Azure Key Vault references with managed identity. Azure Key Vault references combined with a managed identity let the container retrieve secrets at runtime without embedding credentials in code or environment variables. The managed identity authenticates to Key Vault, and the Key Vault reference resolves the secret into the app's configuration securely.

Answer

Azure Container Registry admin credentials

Answer

Container Apps encrypted environment variables

Answer

Kubernetes secrets mapped via sidecar proxy

Question 6

You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is a managed, private Docker registry service that allows you to store and manage container images and artifacts. It supports Docker and OCI images, and integrates with Azure services like AKS, App Service, and Azure Machine Learning. For AI workloads, ACR is the standard place to store custom container images used in training or inference.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Artifacts

Question 7

You are troubleshooting an Azure Function triggered by an Azure Event Grid subscription. The function is failing to receive events. Which TWO diagnostic steps should you take in the Azure Portal or via Azure CLI? Each correct answer is a valid troubleshooting action.

Accepted Answer

Inspect the configured dead-letter blob storage container for undelivered event files.. Option A is correct because Event Grid supports a dead-letter destination (a Storage blob container) where events are written when they cannot be delivered to the subscriber, so inspecting that container reveals undelivered event files and their failure reasons. Option C is correct because Event Grid exposes metrics such as Delivery Failed Events, Dropped Events, and Matched Events in Azure Monitor, which directly show whether events are being matched to the subscription and whether delivery to the function is failing. Option B is not applicable because AMQP port 5671 is used by Service Bus and Event Hubs, not by Event Grid, which delivers events over HTTPS (port 443) to webhook/function endpoints. Option D is not applicable because Service Bus session lock renewal is a Service Bus feature unrelated to Event Grid subscriptions. Option E is not applicable because Event Hubs consumer group checkpoints relate to Event Hubs consumption, not to Event Grid event delivery to an Azure Function.

Answer

Verify the AMQP listener port 5671 firewall rules on the function app.

Answer

Review Service Bus session lock renewal logs.

Answer

Check Event Hubs consumer group checkpoint offset status.

Question 8

Your team is developing an Azure Function that acts as an Event Grid webhook subscriber. You want to test the function locally using the Azure Functions Core Tools CLI. Which command starts the local runtime and enables local event ingestion?

Accepted Answer

func start. The Azure Functions Core Tools command `func start` launches the local Functions host, which exposes the HTTP trigger endpoint (typically http://localhost:7071/api/<function>) that Event Grid can target as a webhook subscriber. It also loads local.settings.json so you can point at a real Event Grid subscription for end-to-end local testing. This is the standard way to run and debug a function locally before deploying.

Answer

dotnet watch run-eventgrid

Answer

az eventgrid topic local-debug

Answer

az functionapp deployment source config

Question 9

You are configuring secure ingress and network isolation for an Azure Container Apps environment. Which THREE capabilities are supported when configuring networking for Container Apps? (Choose three.)

Accepted Answer

Exposing the environment with either external (public) or internal (private VNet) ingress. Option A is correct because Azure Container Apps environments support both external ingress, which exposes apps to the public internet via a public endpoint, and internal ingress, which restricts access to a private VNet or the environment's internal network. Option C is correct because you can deploy a Container Apps environment into a customer-managed Azure Virtual Network subnet, enabling network isolation, private endpoints, and control over inbound/outbound traffic. Option E is correct because Container Apps supports custom domain names with automated managed TLS/SSL certificates, including free managed certificates for custom domains and binding of existing certificates. Option B is incorrect because customers cannot directly modify physical Azure datacenter top-of-rack switches; Azure manages the physical network infrastructure. Option D is incorrect because attaching physical Fibre Channel SAN arrays is not a supported Container Apps networking capability; persistent storage in Container Apps is provided through Azure Files or managed storage abstractions, not direct SAN attachment.

Answer

Direct modification of physical Azure datacenter top-of-rack switches

Answer

Direct attachment of physical Fibre Channel storage SAN arrays

Question 10

You are designing a high-performance RAG data layer architecture using Azure AI Search. Which THREE indexing and retrieval strategies should you implement to maximize recall and precision? (Choose three)

Accepted Answer

Enable semantic ranker to re-order top results using deep learning models. Option A is correct because Azure AI Search's semantic ranker applies deep-learning language models (Microsoft's semantic re-ranking) to re-order the top BM25/vector results, improving precision by promoting semantically relevant documents that lexical or vector scoring alone may rank lower. Option C is correct because HNSW (Hierarchical Navigable Small World) is the approximate nearest neighbor algorithm used in Azure AI Search vector indexes, and tuning m (number of bi-directional links per node), efConstruction (index-time candidate list size), and efSearch (query-time candidate list size) directly controls the recall-versus-latency tradeoff — higher values increase recall at the cost of latency. Option E is correct because hybrid search fuses BM25 keyword scoring with vector similarity (via Reciprocal Rank Fusion in Azure AI Search), capturing both exact term matches and semantic similarity, which raises recall and precision versus either method alone. Option B is incorrect because disabling scoring and ranking would eliminate relevance ordering entirely, destroying precision rather than maximizing it. Option D is incorrect because embeddings must be stored in vector fields (Collection(Edm.Single) with a vector profile and HNSW configuration) to be searchable; storing them as plain text in unindexed fields makes them unusable for vector retrieval.

Answer

Disable all scoring and ranking algorithms to save CPU cycles

Answer

Store embeddings as plain text strings in unindexed fields

Question 11

An event subscriber endpoint hosted on an Azure App Service web app is failing to receive events from an Azure Event Grid system topic. Upon investigation, you discover Event Grid received a handshake validation failure. What is the most likely cause?

Accepted Answer

The web app did not correctly handle and echo back the validation code during the Webhook handshake.. Event Grid requires a webhook validation handshake when a new event subscription is created. The subscriber endpoint must respond to the validation event by echoing back the validation code within a short timeout. If the web app fails to handle this handshake—for example, by not returning the validation code or returning an error—Event Grid marks the subscription as failed and does not deliver events. The most likely cause is that the web app did not correctly process and echo the validation code.

Answer

The event payload exceeded the 1 megabyte size limit.

Answer

The Service Bus connection string was incorrectly formatted.

Answer

The App Service pricing tier does not support HTTPS connections.

Question 12

Your enterprise requires that all container images deployed to Azure Kubernetes Service (AKS) must originate from approved corporate Azure Container Registries (ACRs). How can you enforce this restriction cluster-wide?

Accepted Answer

Configure Azure Policy for Kubernetes with the built-in initiative to restrict container registries. Azure Policy for Kubernetes extends Gatekeeper/OPA into AKS, allowing cluster-wide admission control that blocks pods whose images do not match approved ACR patterns. The built-in initiative 'Kubernetes cluster containers should only use allowed images' enforces this at admission time, before workloads are scheduled. This is the native, declarative, auditable mechanism Microsoft provides for exactly this governance requirement.

Answer

Configure standard Kubernetes Network Policies in the kube-system namespace

Answer

Set up ACR webhook notifications to trigger Azure Functions that delete unauthorized pods

Answer

Modify the kubelet configuration file on every cluster node manually

Question 13

You are optimizing an AI model container image size. Which technique is most effective for reducing the footprint of an image based on a large Python deep learning framework?

Accepted Answer

Implement multi-stage Docker builds.. Multi-stage Docker builds let you compile/install dependencies in a builder stage and copy only the runtime artifacts into a slim final stage, discarding build tools, caches, and intermediate files. For a large Python deep learning framework (e.g., PyTorch/TensorFlow), this can cut image size dramatically because compilers, pip caches, and dev headers never reach the final image. It is the standard technique for shrinking ML container images without losing functionality.

Answer

Enable ACR Georeplication.

Answer

Store model weights as image layers.

Answer

Use the 'latest' tag for all base images.

Question 14

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

Accepted Answer

Azure Monitor metrics with splitting on the 'DeploymentName' dimension.. Azure Monitor platform metrics for Azure OpenAI expose a 'DeploymentName' dimension on metrics such as TokenTransaction, ProcessedPromptTokens, and GeneratedCompletionTokens. Splitting on that dimension gives per-deployment token consumption, which is the most granular native view for attributing cost to a specific deployment.

Answer

Azure Advisor cost recommendations.

Answer

Application Insights logs via KQL query on the 'requests' table.

Answer

Azure Cost Management analysis on the resource group.

Question 15

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

Accepted Answer

IP firewall rules and virtual network service rules on the backend services restricting access to App Service. To prevent leaked credentials from being used from unauthorized networks, you should implement IP firewall rules and virtual network service rules on the backend services (Azure Cosmos DB and Azure OpenAI) to restrict access to only the App Service's outbound IP addresses or its virtual network. This ensures that even if credentials leak, they cannot be used from outside the allowed network.

Answer

Disabling managed identities across all application components

Answer

Configuring Azure Front Door with SSL offloading only

Answer

Enabling public anonymous access with client-side rate limiting

Question 16

When configuring an Azure AI Search vector index, which TWO parameters can be adjusted within the HNSW algorithm configuration to trade off between search speed, memory usage, and recall accuracy? (Choose two)

Accepted Answer

efSearch. Option A, efSearch, is correct because it sets the size of the dynamic candidate list used during query time in HNSW; increasing efSearch explores more neighbors, improving recall accuracy at the cost of slower searches, while decreasing it speeds up queries with lower recall. Option E, m, is correct because it defines the number of bidirectional links created for each node in the HNSW graph; a higher m improves recall and accuracy but consumes more memory, whereas a lower m reduces memory usage and speeds up indexing/search with reduced recall. Option B, replicaCount, is incorrect because it controls the number of replicas for high availability and query throughput in Azure AI Search, not the HNSW speed/memory/recall tradeoff. Option C, partitionCount, is incorrect because it controls index partitioning for storage and write scaling, not HNSW tuning. Option D, maxTextLength, is incorrect because it is a field/analyzer-related setting for text content length, unrelated to HNSW graph parameters.

Answer

replicaCount

Answer

partitionCount

Answer

maxTextLength

Question 17

When designing an Azure AI Search index schema, which TWO properties must be defined for every field in the index? (Choose two)

Accepted Answer

name. Option B (name) is correct because every field in an Azure AI Search index schema requires a unique name that identifies the field within the fields collection, and this name is used in queries, filters, and result documents. Option E (type) is correct because each field must declare an Edm data type (such as Edm.String, Edm.Int32, Edm.Boolean, Edm.DateTimeOffset, or Collection(Edm.String)) so the search engine knows how to index, store, and query the field's values. Option A (analyzerName) is not required for every field; analyzers apply only to searchable string fields and default to the standard Lucene analyzer when omitted. Option C (scoringProfile) is not a field-level property at all; scoring profiles are defined at the index level to influence relevance ranking. Option D (vectorDimensions) is only required for fields of type Collection(Edm.Single) that participate in vector search, not for every field.

Answer

analyzerName

Answer

scoringProfile

Answer

vectorDimensions

Question 18

You are managing multiple containerized AI models in AKS. You want to implement a service mesh to handle traffic splitting and mTLS. Which tool should you integrate?

Accepted Answer

Istio.. Istio is a full-featured service mesh that provides traffic splitting (via VirtualService and DestinationRule), mutual TLS (mTLS) between workloads, observability, and policy enforcement. It is the standard choice for AKS service mesh requirements, and AKS offers an Istio add-on for simplified installation and lifecycle management. This directly satisfies the traffic-splitting and mTLS requirements.

Answer

Calico.

Answer

Azure Application Gateway Ingress Controller (AGIC).

Answer

Azure Load Balancer.

Question 19

An application publishes custom events to an Azure Event Grid custom topic. You need to route events dynamically based on the event's 'department' property in the event payload. Which filtering mechanism should you configure on the Event Grid subscription?

Accepted Answer

Advanced Filters. Advanced Filters in Azure Event Grid allow filtering based on any property within the event payload, including custom properties like 'department'. They support operators such as string comparisons, numeric comparisons, and boolean logic, enabling dynamic routing based on event data. This is the correct mechanism because the requirement is to filter on a custom property in the event schema, which Advanced Filters are designed to handle.

Answer

Event Hubs Capture filters

Answer

Subject Begins With/Ends With filters

Answer

Service Bus Correlation Filters

Question 20

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

Accepted Answer

Dependency telemetry duration compared against custom client-side timers wrapping the API call. Application Insights dependency telemetry records the duration of outbound calls (including Azure OpenAI) as measured server-side by the SDK, so comparing that duration against a custom client-side timer that wraps the same API call isolates network/transport overhead from server processing time. If the client timer is much larger than the dependency duration, the delta is transport or client-side latency.

Answer

Azure Storage replication lag metrics

Answer

Azure Advisor performance score

Answer

Azure Policy compliance evaluation duration