AI-200 Practice Test 4 — 25 Questions

Question 1

Your enterprise application uses Azure Event Grid. Which TWO event schemas are natively supported when publishing events to an Event Grid custom topic? (Choose two)

Accepted Answer

CloudEvents 1.0 schema. Azure Event Grid custom topics natively support two event schemas for publishing: the CloudEvents 1.0 schema (option D) and the proprietary Azure Event Grid schema (option E). CloudEvents 1.0 is the CNCF-standardized, interoperable envelope format that Event Grid accepts directly, while the Azure Event Grid schema is the service's original native format with fields like 'eventType', 'subject', 'data', and 'dataVersion'. Both are selectable via the topic's input schema setting and are the only two schemas Event Grid accepts for custom topic publishing. Options A, B, and C are incorrect: Apache Kafka record batch binary, AMQP 1.0 binary stream envelopes, and SOAP 1.2 XML are not supported input schemas for Event Grid custom topics, even though Event Grid can deliver to Kafka or use AMQP internally for its own transport.

Answer

Apache Kafka record batch binary schema

Answer

AMQP 1.0 binary stream envelope

Answer

SOAP 1.2 XML messaging schema

Question 2

You need to deploy a set of batch AI processing containers in Azure Container Instances that run to completion and then terminate. Which container group restart policy should you select?

Accepted Answer

Never. For Azure Container Instances running batch workloads that execute to completion and then terminate, the restart policy must be Never. This tells ACI not to restart the container after it exits, allowing the container group to reach a terminal Succeeded state. It is the correct choice for run-once batch AI processing jobs.

Answer

Always

Answer

UnlessStopped

Answer

OnFailure

Question 3

You are designing an IoT data ingestion architecture using Azure Event Hubs. Devices occasionally send malformed JSON payloads that cause stream processing jobs to crash. You need to route these invalid messages to a separate error container without stopping the main ingestion stream. What should you implement?

Accepted Answer

Use Azure Stream Analytics with an error output data stream configured for malformed events.. Azure Stream Analytics supports an error output data stream that captures malformed or deserialization-failed events, allowing the main query to continue processing valid events while routing bad records to a separate sink (e.g., Blob Storage container). This is the documented pattern for handling malformed JSON without stopping the stream. Configuring the error output to point at an 'error' container satisfies the requirement.

Answer

Enable Event Hubs Capture with the JSON validation flag set to strict.

Answer

Set up an Event Grid system topic filter for 'MalformedEvent'.

Answer

Configure the Service Bus dead-letter queue on the Event Hub producer client.

Question 4

You need to view the logs of a container that recently crashed in an AKS cluster. Which command is used?

Accepted Answer

kubectl logs --previous.. The `kubectl logs --previous` command retrieves the logs from the previous (crashed) container instance in a pod. When a container crashes and restarts, the current container's logs may be empty or show only the new startup, so the `--previous` flag is essential to access the terminated container's output. This is the standard kubectl mechanism for post-mortem debugging of crashed containers in AKS.

Answer

kubectl get pods.

Answer

az aks logs.

Answer

kubectl describe pod.

Question 5

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

Accepted Answer

Configure a Private Endpoint for the Azure AI Search service and integrate your App Service with the virtual network.. Azure Private Endpoint provides private IP addresses from your VNet to securely connect to Azure AI Search, keeping traffic off the public internet.

Answer

Enable Cross-Origin Resource Sharing (CORS) with a restricted origin list.

Answer

Enable TLS mutual authentication (mTLS) on the Azure AI Search service.

Answer

Configure IP access control lists on the Azure AI Search firewall to allow only the App Service outbound IPs.

Question 6

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

Accepted Answer

Action group. An action group in Azure Monitor defines the set of notifications and actions that fire when an alert rule is triggered. When you create a metric alert for search query latency, you attach an action group that contains the SMS receiver (phone number) for the on-call engineer. The action group is the binding layer between the alert rule's condition and the notification channel, so it is the correct component here.

Answer

Azure Service Health

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 7

An enterprise deployment of Azure OpenAI requires data encryption using a key that your security team fully manages and controls in Azure Key Vault. What must you configure?

Accepted Answer

Configure Customer-Managed Keys (CMK) using an Azure Key Vault key with soft-delete and purge protection enabled, linked via a managed identity.. Customer-Managed Keys (CMK) let you encrypt Azure OpenAI data with a key you own in Azure Key Vault, and the resource accesses it via a managed identity. Soft-delete and purge protection must be enabled on the vault so the key cannot be permanently destroyed, which would render the data unrecoverable. This is the only option that gives the security team full control of the key lifecycle.

Answer

Store the API keys in Azure Key Vault and enable automatic rotation every 7 days.

Answer

Configure infrastructure encryption at rest using a Microsoft-managed default key.

Answer

Enable Always Encrypted on the Azure OpenAI resource configuration plane.

Question 8

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

Accepted Answer

azure-identity package with DefaultAzureCredential and azure-keyvault-secrets. The azure-identity package with DefaultAzureCredential combined with azure-keyvault-secrets is the correct approach: DefaultAzureCredential automatically chains managed identity, environment credentials, and developer credentials, so the app authenticates to Key Vault without hardcoded secrets, then retrieves the storage connection string at runtime. This eliminates secrets from source code and supports passwordless authentication. It is the Microsoft-recommended pattern for secure secret retrieval in Python.

Answer

pyodbc with direct ODBC connection strings containing embedded passwords

Answer

azure-storage-blob with StorageSharedKeyCredential initialized with plain-text keys

Answer

requests library making direct REST calls with master subscription keys

Question 9

You are configuring continuous deployment for an AI model container using Azure DevOps and Azure Container Registry (ACR). You need to ensure that when a new container image is pushed to ACR, an event triggers an automated webhook that notifies an Azure Function to run post-deployment validation tests. Which event type should you subscribe to in the ACR webhook configuration?

Accepted Answer

imagePush. The imagePush event fires whenever a new container image or tag is pushed to the registry, which is exactly the trigger needed to invoke a webhook that notifies an Azure Function for post-deployment validation. ACR webhooks subscribe to specific event types, and imagePush is the canonical event for CI/CD pipelines reacting to new images.

Answer

artifactDelete

Answer

chartPush

Answer

quarantineStatusChange

Question 10

You are configuring network policies in an AKS cluster to isolate your AI inference pods from other namespaces. You notice that traffic is still flowing between namespaces despite applying a NetworkPolicy. What is the most likely cause?

Accepted Answer

The AKS cluster was deployed with a network plugin that does not enforce Kubernetes network policies. Kubernetes NetworkPolicy enforcement in AKS depends on the CNI/network plugin. The default 'kubenet' plugin and Azure CNI without a policy engine do not enforce NetworkPolicy objects — they are accepted by the API server but silently ignored. To enforce them you must use Azure CNI with Calico, Azure NPM (Network Policy Manager), or Cilium. This is why traffic continues to flow between namespaces despite the policy being applied.

Answer

Network policies require IPv6 enablement on the cluster subnet

Answer

Network policies apply only to ingress controllers, not pod-to-pod traffic

Answer

Azure Firewall is blocking the network policy controller

Question 11

Your containerized AI application needs to access sensitive API keys. What is the most secure way to provide these to your application in Azure Container Apps?

Accepted Answer

Use Azure Key Vault references.. Azure Key Vault references let Container Apps pull secrets at runtime from Key Vault using the app's managed identity, so the secret value never appears in the YAML, image, or environment in plaintext. This centralizes secret management, enables rotation without redeploying, and provides audit trails. It is the recommended pattern for sensitive API keys in Container Apps.

Answer

Store them in environment variables in the YAML file.

Answer

Hardcode them in the application code.

Answer

Store them in a sidecar container.

Question 12

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

Accepted Answer

Container Insights in Azure Monitor.. Container Insights (part of Azure Monitor) provides integrated monitoring for AKS, allowing you to correlate pod restarts and node resource exhaustion with application errors.

Answer

Azure Key Vault audit logs.

Answer

Log Analytics Workspace 'AppRequests' table.

Answer

Azure Machine Learning studio 'Endpoints' monitoring tab.

Question 13

When troubleshooting a Python AI application integrated with Application Insights, you want to ensure comprehensive error tracking and telemetry collection. Which TWO of the following SDK practices should you implement? (Choose two)

Accepted Answer

Wrap unhandled exception handling with telemetry_client.track_exception() to capture stack traces.. Option B is correct because telemetry_client.track_exception() explicitly records exception details, including the exception type, message, and stack trace, into Application Insights, which is essential for diagnosing unhandled errors in a Python AI application. Option D is correct because the Application Insights SDK buffers telemetry and sends it asynchronously; calling telemetry_client.flush() before the process exits ensures buffered items are transmitted rather than lost, which is critical in short-lived or containerized workloads. Option A is wrong because disabling the telemetry client in production eliminates the error tracking and telemetry collection the scenario requires. Option C is wrong because routing logs only to local text files on ephemeral container storage means they are lost when the container is recycled and never reach Application Insights. Option E is wrong because storing plain-text passwords in custom dimensions exposes secrets in telemetry data and violates security best practices.

Answer

Disable the Application Insights telemetry client entirely in production to save bandwidth.

Answer

Route all application logs exclusively to local text files on ephemeral container storage.

Answer

Store plain-text passwords in telemetry custom dimensions.

Question 14

You are designing a high-throughput RAG pipeline where documents are continuously ingested and queried. You choose Azure Cosmos DB for NoSQL as your vector store. How does Cosmos DB handle vector indexing updates when new documents are inserted?

Accepted Answer

Vector indexes are updated asynchronously in the background by the database engine. Azure Cosmos DB for NoSQL automatically updates vector indexes asynchronously in the background when new documents are inserted. This means that after insertion, there may be a slight delay before the new vectors are indexed and available for vector search queries. The database engine handles the indexing without manual intervention.

Answer

You must manually trigger an index rebuild stored procedure every hour

Answer

Vector search is completely unavailable until the entire collection is re-indexed from scratch

Answer

New documents cannot be queried using VectorDistance until the container is restarted

Question 15

You are developing a serverless application using Azure Functions that reacts to Azure Blob Storage creation events. Which event schema format should your function code expect by default when triggered by an Event Grid subscription?

Accepted Answer

Azure Event Grid schema. Azure Functions triggered by an Event Grid subscription receive events in the Azure Event Grid schema by default. This schema includes fields like `id`, `subject`, `data`, `eventType`, `eventTime`, and `dataVersion`, with the actual blob details nested under `data`. The function code must deserialize this JSON structure to access properties such as the blob URL. No additional configuration is needed to use this default schema.

Answer

Apache Kafka record batch schema

Answer

AMQP 1.0 message envelope

Answer

SOAP XML envelope

Question 16

You are developing an enterprise retrieval-augmented generation (RAG) application using Azure AI Search. You need to configure a vector index to store dense vector embeddings alongside traditional text fields. Which property within the Azure AI Search index definition must be explicitly configured with a vector search profile to enable HNSW (Hierarchical Navigable Small World) algorithm indexing?

Accepted Answer

vectorSearchProfile. In an Azure AI Search index, the vectorSearchProfile property on a vector field binds that field to a named profile defined in the index's vectorSearch configuration. The profile in turn references an algorithm configuration (for example, an HNSW parameters object) and optionally a compression method, so setting vectorSearchProfile is what actually activates HNSW indexing for the field.

Answer

vectorIndexKind

Answer

compressionMethod

Answer

similarityFunction

Question 17

You are optimizing a large language model container inference deployment on AKS using GPU-enabled nodes (NC-series). The inference server experiences frequent out-of-memory errors on the GPU device itself during high context lengths. Which Kubernetes configuration metric should you monitor and alert on?

Accepted Answer

container_gpu_memory_used_bytes via NVIDIA DCGM Exporter. GPU out-of-memory errors on the device itself must be detected by monitoring GPU memory utilization, which is exposed by the NVIDIA DCGM Exporter as container_gpu_memory_used_bytes (and related DCGM metrics like DCGM_FI_DEV_FB_USED). This metric reflects actual framebuffer memory consumption on the GPU, which is what causes CUDA OOM errors during long-context inference.

Answer

container_memory_working_set_bytes via kubelet

Answer

container_cpu_cfs_throttled_periods_total

Answer

node_net_bytes_total

Question 18

You are deploying an AI workload to Azure Container Apps. You need to ensure the container scales down to zero when there is no traffic. What should you configure?

Accepted Answer

Set minimum replicas to 0.. Azure Container Apps scales to zero when the minimum replica count is set to 0. This allows the platform to deprovision all replicas during periods of no traffic, eliminating compute cost, and scale back up when a request arrives (subject to the configured scale rules and HTTP ingress).

Answer

Set maximum replicas to 0.

Answer

Enable the 'Always On' flag.

Answer

Configure an external HTTP trigger.

Question 19

You are evaluating data layer architectures for an enterprise AI application that requires both vector search and structured transactional data management. Which THREE criteria favor choosing Azure Cosmos DB over Azure AI Search as the primary database? (Choose three)

Accepted Answer

Need for sub-10 millisecond point reads and writes on operational business records. Option A is correct because Azure Cosmos DB is designed as a low-latency operational database, offering single-digit millisecond point reads and writes (by key and partition key) for business records, whereas Azure AI Search is a search index optimized for query throughput rather than transactional point operations. Option B is correct because Cosmos DB natively stores schema-flexible JSON documents and, with vector indexing/vector search support, can hold operational documents and their embeddings together in the same container. Option D is correct because Cosmos DB supports multi-document ACID transactions within a single logical partition (transactional batch), which Azure AI Search cannot provide since it is not a transactional database. Option C is not correct because advanced BM25 keyword ranking and neural semantic re-ranking are core capabilities of Azure AI Search, not differentiators of Cosmos DB. Option E is not correct because automatic PDF text extraction, OCR, and document chunking via indexers are Azure AI Search (AI enrichment/indexer) features, not Cosmos DB features.

Answer

Requirement for advanced BM25 keyword search and neural semantic re-ranking

Answer

Requirement to generate automatic PDF text extraction and document chunking via indexers

Question 20

You are evaluating Cosmos DB for NoSQL vs. Azure AI Search for a vector search application. Your application requires strict ACID compliance for metadata updates along with vector search. Which should you choose and why?

Accepted Answer

Cosmos DB because it supports document-level ACID transactions.. Cosmos DB for NoSQL supports document-level ACID transactions via the transactional batch API, ensuring metadata updates are atomic and consistent. When the requirement combines strict ACID compliance for metadata with vector search, Cosmos DB is the correct choice because Azure AI Search does not provide ACID transactional guarantees for document updates. This aligns the service's transactional model with the application's consistency requirement.

Answer

Cosmos DB because it is the only service that supports vectors.

Answer

Azure AI Search because it supports better hybrid search.

Answer

Azure AI Search because it uses HNSW for faster searches.