AI-200 Practice Test 28 — 15 Questions

Question 1

Which THREE of the following items should be configured to ensure your AI workload in AKS is observable?

Accepted Answer

Prometheus and Grafana.. Prometheus and Grafana (A) are correct because they provide the standard open-source metrics collection and dashboarding stack for Kubernetes, scraping AKS node, pod, and container metrics via exporters and kube-state-metrics to visualize workload health and performance. Integration with Application Insights (B) is correct because it enables distributed tracing, request/dependency telemetry, and live metrics for the AI application code running in AKS, which is essential for observing model inference latency and failures. Azure Monitor for Containers (D) is correct because it is the native AKS monitoring solution that collects container logs, node and pod metrics, and events into Log Analytics, providing out-of-the-box insights and alerts for the cluster. Azure Backup (C) is incorrect because it is a data protection and disaster recovery service, not an observability tool, and Azure Bastion (E) is incorrect because it provides secure RDP/SSH access to VMs without exposing public IPs, which is unrelated to monitoring or telemetry.

Answer

Azure Backup.

Answer

Azure Bastion.

Question 2

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

Accepted Answer

Azure Monitor metric alerts with an action group. Azure Monitor metric alerts are designed to evaluate numeric time-series data such as CPU utilization from Azure Machine Learning compute instances. By creating a metric alert with a threshold of 90% and a 15-minute aggregation window, you can detect sustained high CPU usage. An action group attached to the alert defines the notification channel, such as email to the operations team. This is the standard, native way to implement resource-level performance alerting in Azure.

Answer

Azure Cost Management anomaly alerts

Answer

Azure Policy remediation tasks

Answer

Azure Service Health planned maintenance alerts

Question 3

You are configuring authentication between an Azure Container App running an AI model and an Azure OpenAI resource. To adhere to security best practices, you must avoid storing API keys in environment variables or code. How should you configure this?

Accepted Answer

Configure a system-assigned managed identity on the Container App and grant it Cognitive Services OpenAI User role on the Azure OpenAI resource. A system-assigned managed identity on the Container App gives it an identity in Microsoft Entra ID, and granting that identity the Cognitive Services OpenAI User role on the Azure OpenAI resource authorizes token-based access without any stored secret. The Container App SDK/Managed Identity endpoint issues short-lived tokens automatically, eliminating keys in code or environment variables. This is the recommended keyless authentication pattern for Azure-to-Azure service calls.

Answer

Hardcode the secondary endpoint key into the Docker image build arguments

Answer

Enable anonymous public access on the Azure OpenAI resource for internal virtual network traffic

Answer

Store the Azure OpenAI primary key in an Azure Key Vault and reference it via Container App secrets with plain text retrieval

Question 4

Your organization uses Azure Event Grid to route IoT device lifecycle events. You want to ensure that events published to your custom topic are encrypted at rest using Microsoft-managed keys by default. Which action is required to enable this?

Accepted Answer

No action is required; encryption at rest using Microsoft-managed keys is enabled by default.. Azure Event Grid automatically encrypts all events and data at rest using Microsoft-managed keys (MMK) with no configuration required. This encryption applies to custom topics, system topics, and domains by default, ensuring data is protected without any user action. Therefore, the correct answer is that no action is needed to enable encryption at rest with Microsoft-managed keys.

Answer

You must enable Event Hubs Capture on the topic.

Answer

You must configure a Storage Account dead-letter container.

Answer

You must link an Azure Key Vault instance during topic creation.

Question 5

Your team is building an AI document parser. When a user uploads a PDF to Azure Blob Storage, an event triggers an Azure Function. You want to view the delivery success rate and latency metrics of these events in the Azure Portal. Which Azure service dashboard provides these metrics out-of-the-box?

Accepted Answer

Azure Event Grid Metrics. Azure Event Grid emits built-in platform metrics — including Publish Success Rate, Delivery Success Rate, Dropped Events, Matched Events, and delivery latency — that are surfaced automatically in the Azure Portal under the Event Grid topic or system topic's Metrics blade. No additional instrumentation is required to view these out-of-the-box.

Answer

Azure Container Apps Health Probes

Answer

Azure Cosmos DB Insights

Answer

Azure AI Services Dashboard

Question 6

Which TWO actions can you perform using Azure Container Registry Tasks (ACR Tasks)?

Accepted Answer

Automate image builds upon Git source code repository commits. Option B is correct because ACR Tasks supports multi-step and single-step tasks that can be triggered automatically by source code commits to a Git repository (via the source trigger feature), enabling continuous integration image builds. Option C is correct because ACR Tasks performs builds in the Azure cloud using the ACR build infrastructure, so no local Docker daemon or Docker CLI is required on the developer's machine. Option A is incorrect because Azure Virtual Machine backups are handled by Azure Backup and Recovery Services vaults, not ACR Tasks. Option D is incorrect because Azure Front Door routing rules are configured through Azure Front Door, a content delivery and global load-balancing service, unrelated to container image builds. Option E is incorrect because AKS cluster deployment is performed via the Azure portal, CLI, ARM/Bicep templates, or Terraform, not through ACR Tasks, which only builds and manages container images.

Answer

Manage Azure Virtual Machine backups

Answer

Configure Azure Front Door routing rules

Answer

Deploy AKS clusters automatically

Question 7

You are architecting an AI-driven video analytics pipeline using Azure Event Hubs. You need to ensure that frames belonging to the exact same video session are processed in strict chronological order by the same backend stream analytics worker. How should you partition your Event Hub?

Accepted Answer

Include the video session ID as the Partition Key when publishing events to the Event Hub.. Event Hubs guarantees ordering only within a partition, so all events sharing the same partition key are routed to the same partition and delivered in order to a single consumer. Using the video session ID as the partition key ensures every frame from a session lands on one partition, where one stream analytics worker processes them chronologically. This is the standard pattern for session affinity and ordered processing in Event Hubs.

Answer

Increase the consumer group count to match the number of active video sessions.

Answer

Set the message TTL to zero and enable capture mode on the Event Hub namespace.

Answer

Deploy an Azure Service Bus Session-enabled queue in front of the Event Hubs ingestion layer.

Question 8

Your organization uses Azure Event Hubs to ingest telemetry from smart meters. You want to grant an external analytics vendor read-only access to the Event Hub data without sharing your master connection string or account keys. What should you create?

Accepted Answer

A SAS authorization rule with 'Listen' permissions only, or assign the Azure Event Hubs Data Receiver RBAC role.. To grant read-only access to Event Hubs without sharing master keys, you can create a SAS authorization rule with only 'Listen' permissions or assign the Azure Event Hubs Data Receiver RBAC role to the vendor's identity. Both methods follow the principle of least privilege and allow the vendor to receive events without management or send rights.

Answer

An Event Grid subscription key with administrator rights.

Answer

A SAS rule with 'Manage' permissions.

Answer

A Storage Account connection string with Contributor access.

Question 9

You are troubleshooting a live AI web application where users report intermittent 504 Gateway Timeout errors when submitting large text prompts to a custom model endpoint. You want to check if the backend inference container is timing out or crashing. Where should you examine container-level stdout/stderr logs in Azure Container Apps?

Accepted Answer

Log Analytics workspace querying the ContainerAppConsoleLogs_CL table. Azure Container Apps writes container stdout/stderr to the Log Analytics workspace associated with the Container Apps environment, where it is queryable in the ContainerAppConsoleLogs_CL table. This is the canonical location for container-level logs, including crash traces, stack dumps, and application output that would reveal inference timeouts or OOM kills. Querying this table lets you correlate timestamps with the 504 errors reported by users.

Answer

Azure Cosmos DB request unit (RU) consumption logs

Answer

Azure Key Vault audit logs

Answer

Azure Advisor performance recommendations

Question 10

You want to view real-time standard output logs from a container running in Azure Container Instances named 'ai-inferencing-aci'. Which Azure CLI command should you run?

Accepted Answer

az container logs --resource-group myRG --name ai-inferencing-aci. The 'az container logs' command retrieves the stdout/stderr logs from a container running in Azure Container Instances, which is exactly what is needed to view real-time standard output. It accepts --resource-group and --name to identify the container group and supports --follow to stream logs continuously. This is the canonical CLI command for ACI log inspection.

Answer

az container show --resource-group myRG --name ai-inferencing-aci

Answer

az aks browse --name ai-inferencing-aci

Answer

az acr repository show-tags

Question 11

You deploy an AI inferencing service to an Azure Kubernetes Service (AKS) cluster. The service uses an ONNX Runtime container. Users report intermittent 504 Gateway Timeouts during peak batch request loads. You notice that the application pods are being terminated due to Out-Of-Memory (OOM) errors during heavy inference loads. How should you resolve this issue in your Kubernetes deployment manifest?

Accepted Answer

Increase the memory limit value in the container resource specifications.. The pods are being OOM-killed because the container's memory limit is lower than the peak memory required during heavy inference. Increasing the memory limit in the container resource specifications gives the ONNX Runtime process enough headroom to complete batch inference without being terminated by the kernel OOM killer. This directly addresses the root cause of the 504 timeouts, which occur because pods die mid-request.

Answer

Decrease the readiness probe failureThreshold to remove faulty pods faster.

Answer

Enable the Kubernetes Horizontal Pod Autoscaler based on CPU utilization.

Answer

Configure a liveness probe with an increased initialDelaySeconds value.

Question 12

Your Azure Event Hubs namespace is experiencing high throughput spikes from AI inference nodes. You notice that some client producers are receiving 'QuotaExceededException' errors. What is the root cause and how should you remediate it?

Accepted Answer

Ingress or egress limits have been exceeded; enable Auto-Inflate on the Event Hubs namespace.. QuotaExceededException in Azure Event Hubs is thrown when the namespace's throughput unit (TU) or processing unit (PU) capacity is saturated — specifically when ingress or egress rates exceed the provisioned limits. Enabling Auto-Inflate automatically scales the TU count (up to a configured maximum) to absorb the spike, which is the correct remediation for bursty AI inference workloads. Auto-Inflate is the native elasticity mechanism for Event Hubs and directly addresses the quota breach.

Answer

The partition count has been exceeded; decrease the number of consumer groups.

Answer

The SAS token has expired; regenerate the connection string.

Answer

The message retention period has expired; increase retention days.

Question 13

You are designing a multi-tenant enterprise RAG system using Azure AI Search. Each tenant requires isolated document retrieval. Which feature should you implement to enforce data security while leveraging vector search?

Accepted Answer

Security trimming using OData filter expressions with vector queries. Security trimming with OData filter expressions applied alongside vector queries enforces per-tenant isolation at query time, ensuring each tenant only retrieves documents matching their tenant ID or security group. Azure AI Search supports combining vector search with OData $filter so the vector similarity search is constrained to the authorized document subset.

Answer

Role-Based Access Control (RBAC) at the index level

Answer

Dedicated search services per tenant without filters

Answer

Semantic ranker query throttling

Question 14

You are configuring GPU time-slicing on an AKS cluster to maximize GPU utilization for multiple lightweight AI inference containers sharing a single NVIDIA A100 GPU. Where must you define the time-slicing configuration profile?

Accepted Answer

A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset. A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset is correct because GPU time-slicing on AKS is configured by creating a ConfigMap that contains the time-slicing profile (e.g., replicas: 4) and referencing it in the NVIDIA device plugin daemonset spec via a volume mount. The device plugin then advertises multiple virtual GPU resources per physical GPU, allowing multiple pods to share the A100.

Answer

Inside the Dockerfile of each individual AI container

Answer

Via Azure Container Apps workload profiles configuration

Answer

In the Azure portal under AKS cluster node pool properties

Question 15

You are designing an AI application architecture where embeddings are generated on-the-fly by an Azure Function and stored in Azure Cosmos DB for NoSQL. During peak load, the Azure Function times out due to rate limits (HTTP 429) from Azure OpenAI Service. What design pattern should you implement to make the ingestion pipeline resilient?

Accepted Answer

Implement an asynchronous message queue using Azure Service Bus to buffer ingestion requests and handle rate-limit retries. An asynchronous message queue (Azure Service Bus) decouples the ingestion producer from the Azure OpenAI embedding call, buffering requests during bursts and allowing retries with exponential backoff when HTTP 429 rate limits occur. This prevents Function timeouts because the Function can enqueue work quickly and a separate consumer processes at a controlled rate, absorbing peak load without dropping data.

Answer

Increase the Azure Function execution timeout limit to 24 hours

Answer

Disable SSL verification on the Azure OpenAI client connection

Answer

Switch from Azure OpenAI to local text file storage