AI-200 Practice Test 27 — 15 Questions

Question 1

You are deploying a containerized AI web API to Azure Container Apps. The API must be accessible from the public internet over HTTPS. You have already created the container app and deployed the image. Which of the following should you configure to enable external ingress with automatic HTTPS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the ingress to 'external' and enable 'allowInsecure' to false in the container app configuration.. Azure Container Apps provides built-in ingress that can be configured as external to expose the app to the internet. When external ingress is enabled, Container Apps automatically provisions a fully managed TLS certificate and supports HTTPS. Setting 'allowInsecure' to false enforces HTTPS-only traffic. Other options either add unnecessary components or do not provide public access.

Answer

Deploy the container app to an internal environment and configure a private DNS zone for public resolution.

Answer

Enable HTTP/2 and set the transport to 'auto' in the ingress settings.

Answer

Create an Azure Application Gateway with a public IP and configure it to forward traffic to the container app's internal endpoint.

Question 2

Which TWO of the following are valid autoscaling options for AKS?

Accepted Answer

Cluster Autoscaler (CA).. Option A, Cluster Autoscaler (CA), is correct because it is a built-in AKS feature that automatically adjusts the number of nodes in a node pool based on pending pod resource requests and node utilization, scaling the cluster infrastructure up or down within configured min/max bounds. Option C, Horizontal Pod Autoscaler (HPA), is correct because it is a native Kubernetes autoscaling mechanism supported in AKS that scales the number of pod replicas in a Deployment, ReplicaSet, or StatefulSet based on observed metrics such as CPU, memory, or custom metrics. The other options are not valid AKS autoscaling options: manual registry scaling (B) is not an autoscaling feature at all, storage capacity scaling (D) refers to resizing persistent volumes rather than automatically scaling compute workloads, and Azure Service Bus scaling (E) is a messaging service concern, not an AKS autoscaling mechanism.

Answer

Manual registry scaling.

Answer

Storage capacity scaling.

Answer

Azure Service Bus scaling.

Question 3

In Azure Cosmos DB for NoSQL, which property in the container definition specifies the path to the property containing the vector array within each document?

Accepted Answer

path. In Azure Cosmos DB for NoSQL, the vector embedding policy is defined inside the container's vectorEmbeddingPolicy, and each vector path is declared using the 'path' property, which points to the JSON property in each document that holds the vector array (for example, /embedding). This 'path' value is what the query engine uses to locate the vector for VectorDistance() operations. The other names are not part of the Cosmos DB vector schema.

Answer

propertyLocation

Answer

field

Answer

jsonPath

Question 4

You are implementing distributed tracing across an event-driven AI workflow that passes messages from Azure Service Bus to Azure Functions, and finally to an Azure Cosmos DB database. Which mechanism should you use to propagate correlation context between these services?

Accepted Answer

W3C Trace Context standard HTTP headers (such as traceparent) propagated through Service Bus message user properties.. Distributed tracing across Azure services relies on the W3C Trace Context standard, which defines headers like traceparent and tracestate to propagate correlation IDs. In Service Bus, these can be carried in message user properties (application properties) so that downstream services like Azure Functions and Cosmos DB can continue the trace. This enables end-to-end visibility in Application Insights.

Answer

Enabling Azure Monitor diagnostic logs on the storage account.

Answer

Using AMQP 1.0 session locks to lock the trace state across network boundaries.

Answer

Custom GUID generation stored exclusively in the Event Grid event subject field.

Question 5

You need to deploy a real-time object detection model inside an Azure Container App. The application requires immediate scale-out when the queue length of incoming image processing requests exceeds a threshold. Which scaling rule type should you configure?

Accepted Answer

Azure Queue Storage / Service Bus KEDA scaling rule. Azure Container Apps uses KEDA (Kubernetes Event-Driven Autoscaling) scalers to scale based on external event sources. A queue-length trigger from Azure Queue Storage or Service Bus is the correct KEDA scaler when the workload must scale out in response to the number of pending messages, which matches the requirement of scaling when image processing requests exceed a threshold.

Answer

Memory utilization scaling rule

Answer

CPU utilization scaling rule

Answer

HTTP concurrency scaling rule

Question 6

You are building an event-driven workflow where an external partner application needs to send custom events to your Azure backend. You decide to use Azure Event Grid Custom Topics. When the partner publishes an event, which event schema format must the JSON payload adhere to?

Accepted Answer

CloudEvents v1.0 schema or Event Grid schema. Azure Event Grid custom topics accept events in either the proprietary Event Grid schema or the CloudEvents v1.0 schema; both are valid JSON formats for publishing custom events. The partner must serialize the event payload according to one of these schemas, and the topic's input schema setting determines which one is expected. This ensures interoperability with CloudEvents-compliant systems while retaining the native Event Grid format for Azure-centric integrations.

Answer

OData v4 batch request format

Answer

SOAP 1.2 XML envelope format

Answer

AMQP 1.0 message format exclusively

Question 7

You need to view real-time log streams from an Azure Container App running a custom LangChain agent. Which Azure CLI command should you execute?

Accepted Answer

az containerapp logs show --name --resource-group --follow. The Azure CLI command 'az containerapp logs show' retrieves logs from a Container App, and the '--follow' flag streams them in real time (similar to tail -f). This is the correct command to view live log output from a running Container App hosting a LangChain agent.

Answer

az cognitiveservices account log-stream --name <account-name>

Answer

az aks browsed --name <cluster-name>

Answer

az monitor metrics tail --resource <resource-id>

Question 8

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

Accepted Answer

Implement fallback routing or secondary region endpoints for high availability.. Implementing retry logic with exponential backoff in SDK clients and configuring circuit breaker patterns or fallback endpoints helps handle transient failures.

Answer

Disable all exception handling so unhandled errors crash the server.

Answer

Terminate the application process immediately on the first transient timeout.

Answer

Remove all timeout configurations from HTTP client connections.

Question 9

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

Accepted Answer

Use DefaultAzureCredential from the azure-identity library to automatically authenticate via the VM's IMDS endpoint. The correct method is to use DefaultAzureCredential from the azure-identity library to automatically authenticate via the VM's IMDS endpoint. When a system-assigned managed identity is enabled on an Azure VM, the VM can request tokens from the Instance Metadata Service (IMDS) at a well-known endpoint (169.254.169.254). DefaultAzureCredential automatically detects the managed identity and uses it to obtain an access token for Azure OpenAI, eliminating the need to store credentials on the VM.

Answer

Use static storage account connection strings hardcoded in environment variables

Answer

Make an unauthenticated HTTP GET request to the public Azure OpenAI endpoint with no headers

Answer

Read the plain-text password from a file located in /etc/passwd on the virtual machine

Question 10

Your company policy requires all outbound traffic from an Azure Machine Learning workspace to pass through a centralized firewall. Which feature must be implemented?

Accepted Answer

Configure workspace outbound rules with fully qualified domain name (FQDN) tags and route traffic through Azure Firewall.. To force all outbound traffic from an Azure Machine Learning workspace through a centralized firewall, you must configure workspace outbound rules using FQDN tags and route traffic through Azure Firewall. This is done by placing the workspace in a virtual network with a user-defined route (UDR) that points to Azure Firewall as the next hop, and then using Azure Firewall FQDN tags (such as AzureML) to allow required outbound traffic. This ensures that all egress is inspected and controlled by the firewall.

Answer

Enable public network access with selected IP addresses set to the firewall IP.

Answer

Use Azure Bastion to inspect all outbound connections from the workspace nodes.

Answer

Deploy the workspace without virtual network isolation and rely on Network Security Groups.

Question 11

Your application uses Azure Event Grid to deliver events to an Azure Function webhook. Due to a downstream database outage, the Azure Function returns HTTP 500 errors. How does Event Grid handle event delivery when the endpoint fails?

Accepted Answer

Event Grid retries delivery using an exponential backoff retry policy for up to 24 hours.. Azure Event Grid guarantees at-least-once delivery by retrying failed event deliveries using an exponential backoff policy. When a webhook returns HTTP 500, Event Grid treats it as a retryable failure and continues retrying for up to 24 hours, after which the event is either dropped or sent to a dead-letter destination if configured. This built-in retry mechanism ensures transient downstream failures do not immediately lose events.

Answer

Event Grid stops the event subscription until manually restarted by an administrator.

Answer

Event Grid immediately discards the event upon receiving the first HTTP 500 error.

Answer

Event Grid automatically migrates the event to an Azure Service Bus queue.

Question 12

Your team is using managed identities to connect an Azure App Service web app to an Azure OpenAI resource. The connection fails with a 403 Forbidden error. What is the most likely root cause?

Accepted Answer

The managed identity has not been granted the 'Cognitive Services OpenAI User' role on the Azure OpenAI resource.. A 403 Forbidden from Azure OpenAI when using a managed identity almost always means the identity authenticated successfully (otherwise you'd see 401) but lacks the required data-plane RBAC role. The 'Cognitive Services OpenAI User' role grants the necessary permissions to call the Azure OpenAI inference endpoints. Assigning this role to the App Service's managed identity on the Azure OpenAI resource resolves the 403.

Answer

The App Service must be bound to a custom domain before managed identities can issue bearer tokens.

Answer

The app service requires a client secret stored in Azure Key Vault for managed identity authentication.

Answer

System-assigned managed identities cannot authenticate against Azure AI PaaS endpoints.

Question 13

Which THREE of the following are common reasons for a container image pull failure in AKS?

Accepted Answer

Network connectivity issues to ACR.. Option B is correct because AKS nodes must reach the registry endpoint (for example, myregistry.azurecr.io over HTTPS/443), and blocked egress, NSG/UDR misconfiguration, private endpoint or DNS resolution problems will cause the kubelet to fail the image pull. Option C is correct because pulling from a private registry such as ACR requires valid credentials — either an imagePullSecret, the AKS-managed AcrPull role assignment, or kubelet identity — and missing or expired permissions produce an authentication failure. Option E is correct because an invalid image tag or registry path (for example, a nonexistent tag or a misspelled registry/repository) makes the image unresolvable, yielding a manifest unknown or not found error. Option A is not a pull failure cause: excessive node memory does not prevent image retrieval, and insufficient memory would instead cause scheduling or OOM issues. Option D is not relevant: how fast a container runs has no bearing on whether its image can be pulled from a registry.

Answer

The node has too much memory.

Answer

The container is running too fast.

Question 14

You are designing a secure enterprise generative AI platform using Azure AI Search and Azure OpenAI. Which THREE security practices should you implement to protect sensitive data and access? (Choose three)

Accepted Answer

Implement Azure RBAC to restrict index management and data query permissions. Option A is correct because Azure RBAC provides fine-grained authorization over Azure AI Search, allowing you to separate roles such as Search Service Contributor (index management) from Search Index Data Reader/Contributor (query and data access), enforcing least privilege on sensitive indexes. Option B is correct because Microsoft Entra ID managed identities let Azure services authenticate to Azure OpenAI and Azure AI Search without embedding credentials, eliminating secret sprawl and enabling token-based access that can be scoped and audited. Option E is correct because Azure Private Endpoints assign private IP addresses from your VNet to Azure AI Search and Azure OpenAI, keeping traffic on the Microsoft backbone and blocking public internet exposure of these services. Option C is wrong because disabling TLS would expose embedding payloads and queries to interception; TLS 1.2+ must remain enforced. Option D is wrong because storing API keys in plain text on public web servers directly exposes credentials, violating secret-management best practices such as Azure Key Vault or managed identities.

Answer

Disable transport layer security (TLS) to speed up embedding transmission

Answer

Store all API keys in plain text configuration files on public web servers

Question 15

Your development team wants to push custom Docker images containing fine-tuned open-source LLMs to a secure, private registry hosted on Azure. Which Azure service should you use to store and manage these container images?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is Azure's managed, private Docker registry service, purpose-built to store, version, and distribute OCI-compliant container images and Helm charts. It supports geo-replication, private endpoints, content trust, and integration with AKS, Container Apps, and ACI, making it the correct choice for hosting fine-tuned LLM container images securely. Blob Storage and Azure Files can hold bytes but lack the Docker Registry HTTP API v2 needed for image push/pull.

Answer

Azure Files

Answer

Azure Artifacts

Answer

Azure Blob Storage