AI-200 Practice Test 34 — 15 Questions

Question 1

Your application publishes messages to an Azure Service Bus queue. The messages contain sensitive personal data. Enterprise compliance mandates that message payloads are encrypted end-to-end at the application layer before being sent to Service Bus. How should you implement this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encrypt the message payload in your application code using a key from Azure Key Vault before sending, and decrypt upon receipt.. For end-to-end client-side encryption, the application must encrypt the message payload using an encryption key from Azure Key Vault before serializing and sending it to Service Bus, then decrypt it upon receipt.

Answer

Configure Event Grid advanced filters to redact sensitive keys.

Answer

Enable Service Bus Premium Geo-Disaster Recovery with encryption enabled.

Answer

Use Shared Access Signature tokens with 5-minute expirations.

Question 2

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

Accepted Answer

Azure Monitor metrics explorer on the Azure OpenAI resource.. Azure Monitor provides built-in metrics for Azure OpenAI, including 'Processed Prompt Tokens' and 'Generated Tokens'.

Answer

Microsoft Purview data lineage maps.

Answer

Azure Advisor cost optimization recommendations.

Answer

Azure Log Analytics workspace without Application Insights configured.

Question 3

You are designing an asynchronous AI transaction pipeline using Azure Service Bus. You need to implement the Competing Consumers pattern where multiple worker instances process messages from a single queue without duplicating work. How does Azure Service Bus natively support this pattern?

Accepted Answer

Service Bus automatically locks and distributes messages across competing workers using PeekLock mode.. Azure Service Bus queues inherently implement the Competing Consumers pattern. When multiple workers pull from the same queue, Service Bus locks each message to a single worker so no other worker receives it.

Answer

Configure Event Hubs consumer groups with exclusive read locks.

Answer

You must write custom distributed locking logic using Azure Blob Leases in front of the queue.

Answer

You must deploy an Event Grid topic with a round-robin webhook load balancer.

Question 4

You are configuring network security for an enterprise Azure Service Bus Premium namespace. Which THREE networking features can you configure to secure the namespace? (Choose three)

Accepted Answer

Private endpoints using Azure Private Link. Service Bus Premium supports Virtual Network service endpoints, private endpoints via Azure Private Link, and IP firewall rules. Event Grid MQTT and Express storage are not Service Bus features.

Answer

Event Grid MQTT broker certificate authentication

Answer

Blob storage container access policies

Question 5

You are configuring an Azure Event Grid system to route custom application events to an Azure Function webhook. To ensure secure communication, you decide to use Event Grid custom topics with Azure AD authentication. Which configuration step is required on the Azure Function endpoint to authenticate incoming events from Event Grid?

Accepted Answer

Implement validation handshake logic in the Azure Function code to respond to the Event Grid subscription validation event.. Azure Event Grid supports Webhook validation handshake by sending a Subscription Validation Event containing a validation code, which the webhook endpoint must echo back.

Answer

Configure the Azure Function app with an Event Grid system-assigned managed identity and grant it the Event Grid Data Sender role.

Answer

Install the Microsoft.Azure.EventGrid NuGet package and configure a SAS token generated from the Function App settings.

Answer

Enable mutual TLS (mTLS) authentication on the Azure Function App and upload the Event Grid root CA certificate.

Question 6

You need to ensure that your vector data in Azure AI Search is protected at rest. Which setting should you verify?

Accepted Answer

Configure Customer-Managed Keys (CMK) for the search service.. Azure AI Search uses Azure Storage for data, and encryption at rest is managed via Customer-Managed Keys (CMK) configured at the search service level.

Answer

Enable TLS 1.3 on the search service.

Answer

Disable public network access.

Answer

Enable Always Encrypted on the Cosmos DB container.

Question 7

Your application publishes custom events to an Azure Event Grid topic. You want to ensure that event publishers transmit data over secure HTTPS endpoints only. How should you enforce this?

Accepted Answer

Event Grid enforces HTTPS by default for all custom topic publishing endpoints.. Event Grid topics support an 'Minimum TLS Version' setting and enforce HTTPS by default for all publishing endpoints.

Answer

You must install a self-signed SSL certificate on the publisher client machine.

Answer

Configure an Azure Firewall rule allowing port 80 outbound.

Answer

You must configure an Azure Application Gateway in front of the Event Grid topic.

Question 8

Your application publishes events to an Azure Event Grid system topic. You want to filter events so that your webhook subscriber receives only events where the 'eventType' is 'Microsoft.Storage.BlobCreated'. Where should you configure this filter?

Accepted Answer

In the Event Grid subscription filter configuration blade under 'Included Event Types'.. Event Grid subscriptions support basic filters, including filtering by event type (`includedEventTypes`).

Answer

Within the Azure Function host.json configuration file.

Answer

In the Service Bus Topic subscription SQL filter.

Answer

Inside the Azure Storage account connection string settings.

Question 9

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Accepted Answer

Deploy the private endpoint into a subnet within your Virtual Network.. Setting up a private endpoint requires creating the endpoint itself, configuring a target sub-resource (e.g., 'account'), and updating DNS records so the FQDN resolves to the private IP.

Answer

Enable public network access on the Azure OpenAI resource with unrestricted IP ranges.

Answer

Assign a public IP address directly to the private endpoint network interface.

Question 10

Which TWO roles are commonly assigned when granting a managed identity access to consume Azure OpenAI services via Azure RBAC?

Accepted Answer

Cognitive Services OpenAI User. Cognitive Services User and Cognitive Services OpenAI User are standard built-in roles for authenticating data plane operations on Azure OpenAI.

Answer

Key Vault Secrets Officer

Answer

Virtual Machine Contributor

Answer

Storage Blob Data Reader

Question 11

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

Accepted Answer

Azure Monitor metrics with splitting on the 'DeploymentName' dimension.. Azure Monitor metrics provide the 'Processed Tokens' metric, which can be split by 'DeploymentName' to see usage per model deployment.

Answer

Azure Advisor cost recommendations.

Answer

Application Insights logs via KQL query on the 'requests' table.

Answer

Azure Cost Management analysis on the resource group.

Question 12

Your team is building an automated image moderation pipeline. When an image is uploaded to Azure Blob Storage, you need to trigger an Azure Function to process it using Azure AI Vision. You want to ensure the lowest latency and native cloud event integration. Which integration approach should you configure?

Accepted Answer

Configure an Azure Event Grid system topic and subscription for blob storage events targeting the Azure Function.. Configuring an Azure Event Grid system topic and subscription on the storage account allows blob-created events to push directly to the Azure Function with minimal latency.

Answer

Attach an Azure Event Hubs capture policy to the storage container.

Answer

Use an Azure Logic Apps polling trigger to check the storage container every minute for new files.

Answer

Write a background worker service that reads the Azure Service Bus queue populated by storage transactions.

Question 13

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

Accepted Answer

Use IHttpClientFactory to manage client lifecycles instead of instantiating new HttpClient objects per request.. Using IHttpClientFactory prevents socket exhaustion by managing the lifetime of underlying HttpMessageHandler instances properly.

Answer

Configure a private endpoint between the App Service and Azure OpenAI.

Answer

Enable Always On in the App Service configuration settings.

Answer

Increase the TCP keep-alive timeout on the Azure App Service instance configuration.

Question 14

Your development team needs to store API keys and connection strings for an Azure Cognitive Search service securely without embedding them in the source code. Where should you store these secrets?

Accepted Answer

Azure Key Vault. Azure Key Vault is designed specifically for securely storing and controlling access to secrets, keys, and certificates.

Answer

An Azure Storage Table with public read permissions

Answer

An environment variable in the application's appsettings.json file

Answer

The Azure AI Studio model deployment configuration metadata

Question 15

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Accepted Answer

Purchase Azure reservations or provisioned throughput commitments for steady-state workloads.. Autoscaling compute clusters down to zero when idle, leveraging reserved instances/provisioned throughput commitments for predictable workloads, and sizing compute appropriately reduce costs.

Answer

Delete all Application Insights workspaces and stop collecting any monitoring telemetry.

Answer

Run all development and production workloads on the highest tier enterprise GPUs 24/7 regardless of usage.