AI-200 Practice Test 29 — 15 Questions

Question 1

Your enterprise AI system uses Azure Service Bus. A background job processes messages from a subscription. If an exception occurs, the message must be abandoned, but you want to ensure that after 5 failed delivery attempts, the message is automatically moved to a dead-letter queue without custom retry logic in code. How should you configure this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the MaxDeliveryCount property on the Service Bus subscription to 5.. The MaxDeliveryCount property on a Service Bus subscription (or queue) specifies how many times a message can be delivered before it is automatically dead-lettered. Setting it to 5 ensures that after 5 failed delivery attempts (where the message is abandoned or the lock expires), Service Bus moves it to the dead-letter queue without any custom retry logic.

Answer

Implement a Session-based retry policy with an exponential backoff timer.

Answer

Enable DeadLetteringOnMessageExpiration on the subscription settings.

Answer

Configure the LockDuration property to 5 seconds.

Question 2

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Accepted Answer

Azure Private Link with a private endpoint for the Azure OpenAI resource. Azure Private Link with a private endpoint assigns a private IP address from your virtual network to the Azure OpenAI resource, allowing clients in peered VNets to reach the service entirely over the Microsoft backbone network. This satisfies the requirement to avoid the public internet while enabling you to set public network access to 'Disabled' on the Azure OpenAI resource. Service endpoints do not provide a private IP for the service and still route traffic through the public Azure network, so they cannot fully block public access.

Answer

Service endpoints with default deny rules on the public firewall

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Bastion deployed in the management subnet

Question 3

When designing an Azure Event Hubs streaming pipeline for AI telemetry, which THREE components or configurations are required to consume events reliably using the EventProcessorClient? Each correct answer represents a necessary element.

Accepted Answer

A Checkpoint Store (such as an Azure Blob Storage container client). Option A is correct because EventProcessorClient requires a CheckpointStore (typically backed by an Azure Blob Storage container client) to persist checkpoints and ownership information so partitions can be processed reliably and resumed after failures. Option C is correct because a Consumer Group name is mandatory when constructing the EventProcessorClient, as it defines the logical view of the event stream that the processor reads from and isolates offsets/checkpoints per group. Option E is correct because the client must be given the Event Hubs namespace connection string and the specific Event Hub name to connect and receive events. Option B is incorrect because Event Hubs is not Service Bus, so no Service Bus subscription connection is involved. Option D is incorrect because Event Grid custom topics are for event routing/notification, not for consuming Event Hubs streams with EventProcessorClient.

Answer

An active Azure Service Bus subscription connection

Answer

An Event Grid custom topic endpoint URL

Question 4

You are configuring data ingestion into an Azure AI Search index using an Azure AI Search indexer. The source data resides in Azure Blob Storage and consists of PDF documents. You want to chunk the documents and generate embeddings during ingestion without writing custom orchestration code. Which feature should you configure?

Accepted Answer

Integrated vectorization with built-in document splitting and vectorizer skillset configuration. Integrated vectorization is a native Azure AI Search indexer capability that combines a document-cracking skill (e.g., Document Extraction), a Text Split skill for chunking, and an AzureOpenAIEmbeddingSkill for embedding generation — all wired together through a skillset attached to the indexer. It also supports the index projection to map chunked content and vectors into the target index without any external orchestration code. This directly satisfies the requirement of chunking PDFs and generating embeddings during ingestion with no custom code.

Answer

Azure Data Factory mapping data flows with vector transformations

Answer

A custom WebJob running LangChain

Answer

Cosmos DB change feed triggers

Question 5

Your team is evaluating Azure Container Apps versus Azure Kubernetes Service (AKS) for hosting containerized AI workloads. Which TWO characteristics are advantages of Azure Container Apps over standard AKS? (Choose two.)

Accepted Answer

Simplified container management without direct exposure or management of Kubernetes master nodes. Option B is correct because Azure Container Apps is a serverless, fully managed container platform built on Kubernetes and KEDA, so the underlying Kubernetes control plane (master nodes) is abstracted away and never exposed to the customer for patching or management, unlike AKS where you are responsible for node pools and cluster operations. Option D is correct because Container Apps natively supports scale-to-zero via its built-in KEDA-based scaling rules, meaning idle workloads consume no compute and incur no cost, whereas standard AKS requires configuring cluster autoscaler or KEDA manually and typically keeps at least one node running. Option A is incorrect because Container Apps does not require you to manage CNI overlay routing tables; that is a low-level networking task associated with self-managed Kubernetes or advanced AKS CNI configurations. Option C is incorrect because KEDA and ingress are built into Container Apps and configured declaratively, not mandatory manual controller installations. Option E is incorrect because Container Apps deliberately restricts low-level administrative access, including kernel modules and root certificates, which is the opposite of an advantage over AKS.

Answer

Requirement to manage custom CNI overlay networking routing tables manually

Answer

Mandatory manual configuration of KEDA controllers and Ingress controllers

Answer

Complete low-level administrative access to kernel modules and cluster root certificates

Question 6

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

Accepted Answer

Use Application Insights to examine the 'Dependencies' and 'Requests' logs for duration outliers.. Option C is correct because Application Insights is the standard Azure Monitor integration for Azure Machine Learning online endpoints and deployments, and its 'Requests' and 'Dependencies' tables capture per-call duration, response codes, and dependency latency, which lets you pinpoint duration outliers and identify whether the bottleneck is in the scoring script or a downstream dependency. Option E is correct because the endpoint's 'Logs' tab surfaces the container logs (from the scoring script and inference server, e.g., gunicorn/flask or the azureml-inference-server) where errors, timeouts, and OOM or model-loading failures appear, directly revealing container-level causes of degradation. Option A is wrong because downgrading the compute SKU reduces CPU/GPU/memory resources and would worsen performance rather than diagnose the bottleneck. Option B is wrong because there is no supported operation to 'restart' an Azure Machine Learning workspace to clear cache, and doing so would not produce diagnostic data. Option D is wrong because deleting and recreating a deployment destroys the existing logs and telemetry needed for root-cause analysis and does not constitute a diagnostic step.

Answer

Change the SKU of the underlying compute cluster to a lower tier.

Answer

Restart the Azure Machine Learning workspace to clear cache.

Answer

Delete and recreate the deployment without checking logs.

Question 7

When managing Azure Container Registry (ACR), administrators can use ACR Tasks to automate tasks. Which TWO scenarios are valid use cases for ACR Tasks? (Choose two.)

Accepted Answer

Triggering container image rebuilds automatically when a base image is updated. Option A is correct because ACR Tasks supports base image update triggers, which automatically rebuild dependent images when the base image in the same or another registry is updated, keeping images patched and current. Option E is correct because ACR Tasks provides source code triggers, including GitHub commit and pull request triggers, that automatically build and push container images when code changes are committed. Option B is incorrect because a managed Kubernetes API control plane is provided by Azure Kubernetes Service (AKS), not ACR. Option C is incorrect because ACR Tasks builds and runs container workloads; vulnerability scanning is provided by Microsoft Defender for Containers or third-party integrations, not by executing scans inside registry storage. Option D is incorrect because ACR is a container image and artifact registry, not a platform for running persistent multi-node database clusters.

Answer

Providing a managed Kubernetes API control plane

Answer

Executing automated container vulnerability scans directly inside registry storage

Answer

Running a persistent, multi-node enterprise database cluster inside ACR

Question 8

You are troubleshooting a connection issue where an on-premises worker application cannot connect to an Azure Event Hubs namespace over AMQP port 5671 due to strict corporate firewall rules. Only port 443 outbound traffic is allowed. How can you configure the client connection to bypass this restriction?

Accepted Answer

Configure the Event Hub client connection to use AMQP over WebSockets (port 443).. Azure Event Hubs supports AMQP over WebSockets, which tunnels AMQP traffic over port 443 (HTTPS). By configuring the Event Hubs client to use WebSockets (e.g., setting the transport type to AmqpWebSockets), the connection uses port 443, which is allowed by the corporate firewall. This is the standard workaround for restrictive firewall environments.

Answer

Deploy an Azure VPN Gateway on the local workstation.

Answer

Switch the connection string to use an Event Grid webhook protocol.

Answer

Open an Azure Support ticket to whitelist port 5671 on the Azure backbone router.

Question 9

Which Azure AI Search API parameter allows you to specify a vector query alongside traditional keyword search terms when executing a hybrid search?

Accepted Answer

vectorQueries. In the Azure AI Search REST API and SDKs, the 'vectorQueries' array is the parameter that carries one or more vector query definitions alongside the traditional 'search' text parameter, enabling hybrid search. Each entry in vectorQueries specifies the vector value (or a reference to a vector field), the k-nearest neighbors count, and optional filters. When both 'search' and 'vectorQueries' are present in the same request, Azure AI Search performs hybrid ranking that fuses keyword BM25 scores with vector similarity scores.

Answer

embeddingQuery

Answer

knnQuery

Answer

vectorSearchParam

Question 10

You need to inspect the environment variables and configuration settings of a running container group in Azure Container Instances. Which Azure CLI command should you use?

Accepted Answer

az container show --resource-group myRG --name myContainer. The az container show command retrieves the full JSON representation of a container group, including its container definitions, environment variables, image, ports, resource requests, and current provisioning state. This is the correct way to inspect configuration of a running container group without executing into it.

Answer

az container exec --exec-command env

Answer

az aks inspect

Answer

az container list-secrets

Question 11

You are configuring secure image signing and verification for your AI containers using Azure Container Registry and Notation. Which feature enables cryptographically signed container images?

Accepted Answer

ACR Signature Verification / Microsoft Defender artifact signing with Notation. ACR Signature Verification, integrated with Microsoft Defender for Containers and Notation (the CNCF Notary v2 project), enables cryptographically signed container images and policy-based verification at pull time. Notation uses the OCI 1.1 referrers API to store signatures as artifacts alongside the image, and ACR can enforce that only signed images are pulled. This is the modern, standards-based approach for supply-chain integrity in Azure.

Answer

Azure Key Vault managed HSM key rotation

Answer

ACR Georeplication sync tokens

Answer

Docker Content Trust (Notary v1)

Question 12

You are running an AI inference workload in an Azure Kubernetes Service (AKS) cluster. The pods require access to an Azure Machine Learning workspace data store via managed identity without storing credentials in code. Which Kubernetes feature should you configure?

Accepted Answer

Azure AD Workload Identity. Microsoft Entra ID Workload Identity federates a Kubernetes service account with an Microsoft Entra ID application (or user-assigned managed identity) using OIDC, allowing pods to obtain Microsoft Entra ID tokens without storing secrets. This is the supported, recommended way for AKS pods to access Azure resources like an AML workspace data store using managed identity.

Answer

Azure CNI Overlay

Answer

Kubernetes Secrets CSI driver

Answer

Node-level Managed Identity

Question 13

Your team is building an AI solution that processes thousands of images uploaded to Azure Blob Storage daily. Each image upload must trigger an immediate Azure Function to invoke Azure Cognitive Services for metadata extraction. Which event-driven messaging service should you choose for this near real-time pub/sub architecture?

Accepted Answer

Azure Event Grid. Azure Event Grid is purpose-built for near real-time, event-driven pub/sub with native first-class integration to Blob Storage events (BlobCreated) and Azure Functions. It pushes events within milliseconds of the blob upload, making it the correct choice for triggering a Function that calls Cognitive Services for metadata extraction.

Answer

Azure Service Bus Topics

Answer

Azure Storage Queues

Answer

Azure Event Hubs

Question 14

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

Accepted Answer

CanNotDelete resource lock. The correct resource lock is CanNotDelete. This lock prevents accidental deletion of the Azure OpenAI resource while still allowing read and modify operations. It ensures that the resource cannot be deleted until the lock is removed, providing a safety net against unintended deletion.

Answer

ReadOnly resource lock

Answer

Azure Policy deny assignment

Answer

Network Security Group deny rule

Question 15

You are designing the data storage and indexing strategy for a multi-tenant AI search solution on Azure. Which TWO architectural practices should you implement to optimize vector search performance and tenant isolation in Azure AI Search?

Accepted Answer

Implement security trimming by appending OData filter expressions (e.g., tenantId eq 'tenant-1') to every vector search query.. Option C is correct because Azure AI Search supports security trimming via OData filter expressions such as tenantId eq 'tenant-1' applied to vector queries, which enforces tenant isolation by restricting results to documents matching the caller's tenant identifier while still allowing shared indexes. Option E is correct because provisioning dedicated indexes or service tiers for enterprise tenants provides physical/logical isolation and dedicated compute, ensuring predictable vector search latency and strict data separation for high-compliance customers. Option A is wrong because disabling HNSW and relying on exhaustive brute-force (exhaustive KNN) search sacrifices scalability and latency, and brute-force across all tenant partitions does not provide tenant isolation. Option B is wrong because storing all tenants' embeddings in a single unpartitioned vector field without metadata tags prevents filtering and security trimming, breaking tenant isolation. Option D is wrong because moving embeddings to Blob Storage and computing cosine similarity client-side eliminates Azure AI Search's optimized vector indexing and integrated filtering, harming performance and isolation.

Answer

Disable the HNSW algorithm and rely exclusively on exhaustive brute-force search across all tenant partitions.

Answer

Store all tenants' embeddings in a single unpartitioned vector field without metadata tags to maximize index density.

Answer

Store raw embeddings exclusively in Azure Blob Storage and perform client-side cosine similarity calculations for all queries.