AI-200 Practice Test 30 — 15 Questions

Question 1

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

azure-identity package with DefaultAzureCredential and azure-keyvault-secrets. The azure-identity library provides DefaultAzureCredential, which automatically tries multiple authentication methods (managed identity, environment variables, Azure CLI) in order without hardcoding secrets.

Answer

pyodbc with direct ODBC connection strings containing embedded passwords

Answer

azure-storage-blob with StorageSharedKeyCredential initialized with plain-text keys

Answer

requests library making direct REST calls with master subscription keys

Question 2

You are configuring an Azure AI Search vector index for a retrieval-augmented generation (RAG) application. You need to select an algorithm for vector similarity search that balances recall speed with accuracy while allowing approximate nearest neighbor (ANN) search. Which vector search algorithm configuration should you select?

Accepted Answer

Hierarchical Navigable Small World (hnsw). HNSW (Hierarchical Navigable Small World) is the industry-standard algorithm used by Azure AI Search for approximate nearest neighbor (ANN) vector search, providing an optimal balance between fast retrieval speed and high recall.

Answer

Exhaustive K-Nearest Neighbor (exhaustiveKnn)

Answer

Locality-Sensitive Hashing (lsh)

Answer

Inverted File with Product Quantization (ivf-pq)

Question 3

You are configuring geo-disaster recovery for an Azure Service Bus Premium namespace containing critical financial transactions. A regional outage occurs. After initiating a failover to the secondary region, what happens to the alias pointing to the namespace?

Accepted Answer

The alias automatically points to the secondary namespace, and pairing is broken.. Service Bus Geo-DR uses an alias. When failover is triggered, the alias is remapped to point to the secondary namespace, allowing clients to reconnect automatically without changing connection strings if they use the alias.

Answer

The secondary namespace remains in Read-Only mode until manually unlocked.

Answer

The alias becomes invalid, and you must deploy a new Service Bus namespace from scratch.

Answer

Unreplicated messages in the primary queue are automatically migrated in real-time.

Question 4

You are writing a Python worker application that consumes messages from an Azure Service Bus queue. To prevent message loss during unexpected application crashes, you need to ensure that messages are locked while being processed and only deleted from the queue after successful processing. Which receive mode should you use?

Accepted Answer

PeekLock mode. PeekLock mode receives the message and locks it in the broker for a specified lock duration, preventing other consumers from processing it. The application must explicitly call complete() to delete it or abandon/dead-letter it on failure.

Answer

Deferred mode

Answer

SessionLock mode

Answer

ReceiveAndDelete mode

Question 5

Your enterprise application uses Azure Service Bus Topics to distribute orders to inventory and billing services. A transient database outage occurs in the billing service. You must ensure that billing messages are not lost and can be retried without interfering with the inventory service. What feature should you configure?

Accepted Answer

Configure separate subscriptions for each service under the Service Bus Topic.. Service Bus Subscriptions support sessions, dead-lettering, and independent subscriber configuration. Each subscription acts as a virtual queue, ensuring the billing service can process messages independently of inventory.

Answer

Enable partitioned queues on the sender application.

Answer

Use Event Grid filters to duplicate the messages into two separate storage accounts.

Answer

Implement Azure Relay to tunnel the database connection.

Question 6

You are designing an asynchronous AI image classification workflow. Client applications upload images to Azure Blob Storage and need to be notified immediately when processing completes. The notification must include custom metadata generated by the AI worker. Which architecture should you implement?

Accepted Answer

The AI worker publishes a custom event to an Azure Event Grid Topic upon completion.. Publishing custom events to an Event Grid custom topic or system topic allows worker functions to emit structured events with custom payload metadata upon completion.

Answer

Use Azure Service Bus topics with session IDs set to the image hash.

Answer

Configure an Azure Storage queue that triggers whenever a blob is modified.

Answer

Poll the Azure Blob Storage container metadata every 5 seconds from the client app.

Question 7

You are troubleshooting a high-throughput stream processing pipeline using Azure Event Hubs. Consumers are experiencing lag because messages are accumulating faster than they can be processed. You want to temporarily replay historical events from 2 hours ago without altering the current consumer group offsets permanently. What should you do?

Accepted Answer

Create a new temporary consumer group and initialize the event receiver with a custom starting offset based on enqueued timestamp.. Event Hubs consumer groups maintain offsets. To replay data, you can create a new consumer group or use the receiver API to specify a starting offset or custom datetime (e.g., via EventPosition.from_enqueued_time).

Answer

Enable Geo-Disaster Recovery to force the secondary region to sync historical logs.

Answer

Delete the existing consumer group and recreate it with a 2-hour retention limit.

Answer

Purge all messages from the Event Hub using the Azure CLI az eventhubs purge command.

Question 8

You are optimizing the cost and performance of an Azure Event Hubs namespace processing millions of financial telemetry records daily. Traffic fluctuates heavily between business hours and night time. You want to ensure the namespace scales automatically without manual intervention while bounding maximum costs. What should you configure?

Accepted Answer

Enable Auto-Inflate and set the maximum Throughput Units limit.. Event Hubs Standard and Premium tiers support Auto-Inflate. You enable Auto-Inflate and specify the maximum number of Throughput Units (TUs) or Processing Units (PUs) to cap expenses.

Answer

Set the retention period to 1 hour to reduce storage overhead.

Answer

Configure an Azure Autoscale rule on the Event Hubs Resource Group via Azure Monitor.

Answer

Upgrade the namespace to Azure Service Bus Premium with partitioned entities.

Question 9

An application publishes custom events to an Azure Event Grid topic. You want to inspect the dead-lettered events that failed delivery after the maximum retry period. Where must you configure the dead-letter destination?

Accepted Answer

Azure Blob Storage container. Event Grid dead-lettering requires an Azure Storage account container as the destination where failed event blobs are written.

Answer

Azure SQL Database table

Answer

Local App Service temporary file system

Answer

Azure Service Bus Dead-Letter Queue

Question 10

You are developing a serverless application using Azure Functions that reacts to Azure Blob Storage creation events. Which event schema format should your function code expect by default when triggered by an Event Grid subscription?

Accepted Answer

Azure Event Grid schema. Event Grid sends events using either the CloudEvents 1.0 schema or the Event Grid schema. The default Azure Event Grid schema includes fields like id, topic, subject, data, eventType, and eventTime.

Answer

Apache Kafka record batch schema

Answer

AMQP 1.0 message envelope

Answer

SOAP XML envelope

Question 11

An application publishes custom events to an Azure Event Grid custom topic. You need to route events dynamically based on the event's 'department' property in the event payload. Which filtering mechanism should you configure on the Event Grid subscription?

Accepted Answer

Advanced Filters. Event Grid supports Advanced Filters, which allow you cube or filter events based on specific JSON path properties in the data payload or event schema.

Answer

Event Hubs Capture filters

Answer

Subject Begins With/Ends With filters

Answer

Service Bus Correlation Filters

Question 12

You are designing a multi-tenant enterprise RAG system using Azure AI Search. Each tenant requires isolated document retrieval. Which feature should you implement to enforce data security while leveraging vector search?

Accepted Answer

Security trimming using OData filter expressions with vector queries. Security trimming in Azure AI Search allows filtering search results based on user permissions by applying document-level access control lists (ACLs) using OData filters during the search query execution.

Answer

Role-Based Access Control (RBAC) at the index level

Answer

Dedicated search services per tenant without filters

Answer

Semantic ranker query throttling

Question 13

Your team needs to monitor when virtual machines are created or deleted across an entire Azure subscription so that an automated audit logger is triggered. Which Azure service should you use to capture these management plane operations?

Accepted Answer

Azure Event Grid. Azure Event Grid provides built-in integration with Azure Resource Manager (ARM), allowing you to subscribe to subscription-level and resource-group-level management events.

Answer

Azure Logic Apps

Answer

Azure Service Bus

Answer

Azure Event Hubs

Question 14

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Accepted Answer

Azure ExpressRoute or Site-to-Site VPN with Azure Private Link to workspace private endpoints. Azure ExpressRoute or a site-to-site VPN combined with Azure Private Link allows secure, private connectivity from an on-premises network to Azure private endpoints.

Answer

Public IP addresses assigned to all developer workstations with NSG allow rules

Answer

Turning off all network security groups and opening all ports on the Azure firewall

Answer

Azure Bastion deployed on the on-premises physical router

Question 15

You are designing a secure data layer architecture for financial documents using Azure Cosmos DB for NoSQL and Azure AI Search. Which THREE compliance and security controls should you implement? (Choose three)

Accepted Answer

Enable diagnostic logging and audit log streaming to Azure Monitor / Log Analytics. Enterprise compliance and security controls include configuring customer-managed keys, enabling diagnostic logging for auditing, and enforcing private endpoint networking.

Answer

Store all database backup files in unencrypted public blob storage containers

Answer

Disable authentication keys and allow anonymous public access for easy integration