AI-200 Containerized AI Workloads Practice Test 2 — 15 Questions

Question 1

You need to automate the deployment of containerized AI models whenever a new image is pushed to ACR. What is the most efficient Azure-native tool for this trigger?

Accepted Answer

ACR Tasks.. ACR Tasks is the Azure-native feature that can automatically trigger a container image build or deployment when a new image is pushed to a registry. It supports triggers on base image updates, source code commits, and image pushes, and can run multi-step tasks that deploy to AKS, Container Apps, or ACI, making it the most efficient native trigger.

Answer

Azure Service Bus.

Answer

Azure Policy.

Answer

Azure Logic Apps.

Question 2

You are using Azure Container Apps to host a web API for an AI model. You want to ensure that only authorized traffic reaches the container. How should you secure the endpoint?

Accepted Answer

Enable 'Authentication' in the Ingress settings.. Enabling Authentication in the Ingress settings of an Azure Container App activates the built-in Easy Auth (App Service Authentication/Authorization) middleware, which validates incoming requests against an identity provider (Microsoft Entra ID, Google, Facebook, etc.) before traffic reaches the container. This ensures only authenticated and authorized callers can invoke the API, satisfying the requirement without deploying additional infrastructure. It is the native, first-class mechanism for securing Container Apps endpoints.

Answer

Configure an Azure Firewall in front of the Container App.

Answer

Use the --allow-all flag in the deployment command.

Answer

Place the container in a Public IP configuration.

Question 3

You are running a distributed AI training job on AKS using MPI. Which network configuration is critical for performance?

Accepted Answer

Enable Azure Accelerated Networking on the node pool.. Azure Accelerated Networking uses SR-IOV to bypass the host virtual switch and give VMs (and AKS nodes) direct hardware access to the NIC, drastically reducing latency and CPU overhead. For MPI-based distributed AI training, which is highly sensitive to inter-node latency and bandwidth (e.g., AllReduce operations), Accelerated Networking is critical for performance. It is enabled on the AKS node pool via `--enable-accelerated-networking`.

Answer

Use an internal VNET peering.

Answer

Enable standard load balancing.

Answer

Disable the pod network policy.

Question 4

You are deploying an AI model to AKS that requires a specific kernel module. What is the recommended strategy to ensure the node has this module?

Accepted Answer

Use a privileged InitContainer to load the module.. Loading a kernel module requires host-level privileges and access to the node's kernel, which a normal container cannot do. A privileged InitContainer runs before the main pod, has CAP_SYS_MODULE and host access, and can run 'modprobe <module>' to load the required module on the node before the AI workload starts.

Answer

Ask Microsoft support to update the kernel.

Answer

Modify the AKS cluster configuration file.

Answer

Include the module in the Docker image.

Question 5

You have an AI model container that is frequently crashing due to OOM (Out of Memory) errors. How do you identify the actual memory usage compared to the limits?

Accepted Answer

Analyze metrics in Azure Monitor for Containers.. Azure Monitor for Containers collects memory working set, RSS, and limit metrics from the container runtime and exposes them alongside configured limits, letting you directly compare actual usage against the memory limit that triggers OOMKilled. This is the authoritative source because it captures the container's cgroup-level memory accounting, which is what the kernel OOM killer evaluates.

Answer

Run 'free -m' inside the container.

Answer

Check the pod 'Events'.

Answer

Use 'kubectl top nodes'.

Question 6

You have a large AI model file (5GB) that needs to be loaded into your container at startup. What is the recommended way to handle this?

Accepted Answer

Mount the model from an Azure File Share.. Mounting the model from an Azure File Share keeps the container image small and lets the model be updated independently of the image, which is the recommended pattern for large artifacts. Azure Files supports SMB/NFS mounts into AKS pods, so the 5GB model is read at startup without bloating the image or requiring runtime downloads. This decouples model lifecycle from application lifecycle and avoids registry size limits.

Answer

Download the model via `curl` at runtime.

Answer

Embed the model in the container image.

Answer

Use a base64 encoded string in the environment variable.

Question 7

You are debugging a network connectivity issue between two pods in AKS. Which command helps you check if the service endpoint is reachable?

Accepted Answer

kubectl exec -it <pod> -- /bin/sh.. Using 'kubectl debug' or a temporary container with network tools (like 'curl' or 'nslookup') is the standard way to test internal network paths.

Answer

kubectl cluster-info.

Answer

kubectl get services.

Answer

kubectl top pods.

Question 8

Which TWO of the following are valid ways to reduce the size of a container image?

Accepted Answer

Use multi-stage Docker builds.. Option B (multi-stage Docker builds) is correct because it lets you compile or build artifacts in an intermediate stage and copy only the resulting binaries into a minimal final stage, leaving compilers, build tools, and intermediate layers out of the shipped image. Option C (a smaller base OS image such as Alpine or Distroless) is correct because the base layer is often the largest contributor to image size, and swapping a full distribution like Ubuntu for Alpine or Distroless dramatically reduces the number of packages and bytes pulled. Option A is wrong because the 'latest' tag does not shrink anything and actually harms reproducibility. Option D is wrong because ACR Geo-replication only replicates registry data across regions for availability and latency; it does not reduce image size. Option E is wrong because combining installs into one RUN command reduces layer count and can help caching, but it does not by itself remove the installed dependencies' bytes from the image.

Answer

Use the 'latest' tag for all dependencies.

Answer

Enable ACR Geo-replication.

Answer

Install all dependencies in one RUN command.

Question 9

Which TWO of the following can be used to manage secrets in a containerized AI workload?

Accepted Answer

Azure Key Vault Secret Store CSI driver.. Option A, the Azure Key Vault Secret Store CSI driver, is correct because it is a Kubernetes CSI volume driver that mounts secrets from Azure Key Vault directly into pods as files or environment variables, keeping them out of the container image and etcd. Option E, native Kubernetes Secrets, is correct because Kubernetes provides a built-in Secret object that stores sensitive data (base64-encoded) and can be consumed by pods via volumes or environment variables, making it a standard mechanism for managing secrets in containerized workloads. Option B, embedding secrets in the image, is wrong because image layers are stored in registries and can be inspected, exposing credentials permanently. Option C, Azure Data Lake, is wrong because it is a storage and analytics service for big data, not a secrets management service. Option D, writing secrets to a log file, is wrong because logs are typically aggregated and accessible to many systems and users, which leaks the secrets.

Answer

Embedding them in the image.

Answer

Azure Data Lake.

Answer

Writing secrets to a log file.

Question 10

You are deploying an AI inference service as a container on Azure Container Apps. The service must process requests from an Azure Storage Queue, and you need to scale the container app based on the queue length. You have already created a Container Apps environment and a container app with a queue-based scaler. Which of the following is required for the scaler to authenticate to the Azure Storage Queue?

Accepted Answer

Configure a managed identity for the container app and grant it the Storage Queue Data Reader role on the storage account.. The queue-based scaler in Azure Container Apps requires authentication to the Azure Storage Queue. The recommended and most secure method is to use a managed identity for the container app and assign it the necessary role. This eliminates the need to manage secrets and integrates with Microsoft Entra ID. Connection strings are possible but less secure, and network configurations or OAuth flows are not directly used by the scaler.

Answer

Store the storage account connection string in an environment variable in the container app configuration.

Answer

Deploy the container app to a virtual network and configure a private endpoint for the storage account.

Answer

Enable Azure AD authentication on the storage account and use OAuth 2.0 with a client secret stored in Azure Key Vault.

Question 11

You are building a container image for an AI application. The Dockerfile includes a step to download a large pre-trained model file. You want to ensure that the model file is not re-downloaded every time you rebuild the image after making code changes. What should you do?

Accepted Answer

Copy the model file into the image using a COPY instruction before copying the application code.. To prevent re-downloading the model during image rebuilds, you should structure the Dockerfile so that the model file is added in a layer that is not invalidated by code changes. Copying the model file before the application code ensures that the model layer remains cached as long as the model file itself does not change. This optimizes build times by leveraging Docker's layer caching.

Answer

Store the model file in a remote location and download it at container runtime using an init container.

Answer

Place the model download step after the code copy step in the Dockerfile.

Answer

Use a multi-stage build to separate the model download from the application code.

Question 12

You are running a containerized AI model on Azure Kubernetes Service (AKS). The model requires a GPU and you have provisioned a node pool with NVIDIA GPU nodes. You need to ensure that only the AI inference pods are scheduled on these GPU nodes and that they can access the GPU. Which of the following should you configure?

Accepted Answer

Add a node selector to the pod spec to target nodes with the label 'accelerator=nvidia' and request GPU resources using 'nvidia.com/gpu: 1'.. To schedule pods on GPU nodes and provide GPU access, you must use a node selector or node affinity to target the GPU nodes and request GPU resources in the pod spec. The NVIDIA device plugin, automatically installed by AKS, exposes GPUs as 'nvidia.com/gpu' resources. Taints and tolerations can complement this but are not sufficient alone, and Azure Policy is for governance, not scheduling.

Answer

Apply a taint to the GPU nodes and add a toleration to the AI inference pods.

Answer

Enable the Azure GPU plugin in the AKS cluster and set the '--gpu' flag in the container command.

Answer

Use Azure Policy to enforce that only pods with a specific label can be scheduled on GPU nodes.

Question 13

You have an AI model container hosted in Azure Container Registry. You want to ensure that every container image pushed to the registry is automatically scanned for known vulnerabilities before deployment. Which ACR feature should you enable?

Accepted Answer

Microsoft Defender for Cloud vulnerability scanning. Microsoft Defender for Cloud vulnerability scanning is correct because it provides integrated image vulnerability assessment for Azure Container Registry, automatically scanning images on push and continuously re-scanning for newly disclosed CVEs. Enabling the Defender for Containers plan surfaces scan results in Defender for Cloud and can gate deployments via Azure Policy. This directly satisfies the requirement to scan every pushed image before deployment.

Answer

ACR Tasks auto-purge

Answer

Content Trust

Answer

ACR geo-replication

Question 14

You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is a managed, private Docker registry service that allows you to store and manage container images and artifacts. It supports Docker and OCI images, and integrates with Azure services like AKS, App Service, and Azure Machine Learning. For AI workloads, ACR is the standard place to store custom container images used in training or inference.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Artifacts

Question 15

You are optimizing a large language model container inference deployment on AKS using GPU-enabled nodes (NC-series). The inference server experiences frequent out-of-memory errors on the GPU device itself during high context lengths. Which Kubernetes configuration metric should you monitor and alert on?

Accepted Answer

container_gpu_memory_used_bytes via NVIDIA DCGM Exporter. GPU out-of-memory errors on the device itself must be detected by monitoring GPU memory utilization, which is exposed by the NVIDIA DCGM Exporter as container_gpu_memory_used_bytes (and related DCGM metrics like DCGM_FI_DEV_FB_USED). This metric reflects actual framebuffer memory consumption on the GPU, which is what causes CUDA OOM errors during long-context inference.

Answer

container_memory_working_set_bytes via kubelet

Answer

container_cpu_cfs_throttled_periods_total

Answer

node_net_bytes_total