AI-200 Containerized AI Workloads Practice Test 3 — 15 Questions

Question 1

You are managing an AKS cluster running resource-intensive AI training jobs. You want to ensure that nodes automatically scale up and down based on pending pod resource requests. Which component should you enable and configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Kubernetes Cluster Autoscaler. The Kubernetes Cluster Autoscaler is the component that adds or removes nodes in an AKS node pool based on pending pods that cannot be scheduled due to insufficient resources. It watches for unschedulable pods and scales the node pool up, then scales down underutilized nodes. This directly matches the requirement of scaling nodes based on pending pod resource requests.

Answer

KEDA (Kubernetes Event-driven Autoscaling)

Answer

Azure Load Balancer

Answer

Horizontal Pod Autoscaler

Question 2

You are running an AI inference workload in an Azure Kubernetes Service (AKS) cluster. The pods require access to an Azure Machine Learning workspace data store via managed identity without storing credentials in code. Which Kubernetes feature should you configure?

Accepted Answer

Azure AD Workload Identity. Microsoft Entra ID Workload Identity federates a Kubernetes service account with an Microsoft Entra ID application (or user-assigned managed identity) using OIDC, allowing pods to obtain Microsoft Entra ID tokens without storing secrets. This is the supported, recommended way for AKS pods to access Azure resources like an AML workspace data store using managed identity.

Answer

Azure CNI Overlay

Answer

Kubernetes Secrets CSI driver

Answer

Node-level Managed Identity

Question 3

You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?

Accepted Answer

http. Azure Container Apps supports built-in KEDA-based scale rules, and the 'http' scale rule type scales based on concurrent HTTP requests. This is the correct choice for scaling a container that receives HTTP traffic and needs to handle concurrent requests.

Answer

azure-service-bus

Answer

cpu

Answer

tcp

Question 4

You are configuring GPU time-slicing on an AKS cluster to maximize GPU utilization for multiple lightweight AI inference containers sharing a single NVIDIA A100 GPU. Where must you define the time-slicing configuration profile?

Accepted Answer

A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset. A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset is correct because GPU time-slicing on AKS is configured by creating a ConfigMap that contains the time-slicing profile (e.g., replicas: 4) and referencing it in the NVIDIA device plugin daemonset spec via a volume mount. The device plugin then advertises multiple virtual GPU resources per physical GPU, allowing multiple pods to share the A100.

Answer

Inside the Dockerfile of each individual AI container

Answer

Via Azure Container Apps workload profiles configuration

Answer

In the Azure portal under AKS cluster node pool properties

Question 5

You need to deploy a containerized AI model to Azure Container Apps and configure it to scale based on Azure Service Bus queue messages. Which scaler should you specify?

Accepted Answer

azure-service-bus. Azure Container Apps uses KEDA-based scaling, and the azure-service-bus scaler is the built-in KEDA scaler designed to read Service Bus queue or topic subscription message counts and scale replicas accordingly. Specifying azure-service-bus as the scale rule type with the queue name and connection metadata lets Container Apps scale in/out based on message backlog. This directly matches the requirement to scale on Service Bus queue messages.

Answer

azure-blob

Answer

memory

Answer

cron

Question 6

You are troubleshooting an AI inference container in Azure Container Apps that fails to start because it cannot pull the base image from Azure Container Registry. Authentication fails with an unauthorized error. What is the recommended way to grant the Container App access to ACR?

Accepted Answer

Configure a system-assigned managed identity on the Container App and assign the AcrPull role on ACR. The recommended approach is to enable a system-assigned (or user-assigned) managed identity on the Container App and grant it the AcrPull role on the Azure Container Registry. This lets the Container App authenticate to ACR without storing any credentials, using Entra ID token exchange under the hood. It is the Azure-native, secretless pattern for image pulls.

Answer

Hardcode the admin username and password into environment variables

Answer

Expose the ACR endpoint publicly without authentication

Answer

Attach an Azure Storage Account SAS token to the container environment

Question 7

You need to deploy a set of batch AI processing containers in Azure Container Instances that run to completion and then terminate. Which container group restart policy should you select?

Accepted Answer

Never. For Azure Container Instances running batch workloads that execute to completion and then terminate, the restart policy must be Never. This tells ACI not to restart the container after it exits, allowing the container group to reach a terminal Succeeded state. It is the correct choice for run-once batch AI processing jobs.

Answer

Always

Answer

UnlessStopped

Answer

OnFailure

Question 8

You are setting up image builds for a multi-architecture (AMD64 and ARM64) AI model container using Azure Container Registry Tasks. Which command or feature should you use to build images for both architectures simultaneously?

Accepted Answer

az acr build with a multi-step task or docker buildx configuration. Azure Container Registry Tasks supports multi-architecture image builds through `az acr build` with either a multi-step YAML task or a Dockerfile leveraging `docker buildx` for cross-platform builds (linux/amd64 and linux/arm64). ACR Tasks runs the build in Azure, so you don't need local buildx/QEMU setup, and it can push a single manifest list referencing both architecture variants. This is the native, supported path for producing multi-arch images in ACR.

Answer

Azure DevOps pipeline running docker push directly

Answer

az aks create with --node-os-sku

Answer

az acr import

Question 9

You are configuring network policies in an AKS cluster to isolate your AI inference pods from other namespaces. You notice that traffic is still flowing between namespaces despite applying a NetworkPolicy. What is the most likely cause?

Accepted Answer

The AKS cluster was deployed with a network plugin that does not enforce Kubernetes network policies. Kubernetes NetworkPolicy enforcement in AKS depends on the CNI/network plugin. The default 'kubenet' plugin and Azure CNI without a policy engine do not enforce NetworkPolicy objects — they are accepted by the API server but silently ignored. To enforce them you must use Azure CNI with Calico, Azure NPM (Network Policy Manager), or Cilium. This is why traffic continues to flow between namespaces despite the policy being applied.

Answer

Network policies require IPv6 enablement on the cluster subnet

Answer

Network policies apply only to ingress controllers, not pod-to-pod traffic

Answer

Azure Firewall is blocking the network policy controller

Question 10

You want to view real-time standard output logs from a container running in Azure Container Instances named 'ai-inferencing-aci'. Which Azure CLI command should you run?

Accepted Answer

az container logs --resource-group myRG --name ai-inferencing-aci. The 'az container logs' command retrieves the stdout/stderr logs from a container running in Azure Container Instances, which is exactly what is needed to view real-time standard output. It accepts --resource-group and --name to identify the container group and supports --follow to stream logs continuously. This is the canonical CLI command for ACI log inspection.

Answer

az container show --resource-group myRG --name ai-inferencing-aci

Answer

az aks browse --name ai-inferencing-aci

Answer

az acr repository show-tags

Question 11

You are troubleshooting slow inference latency in an AI application deployed on AKS. You suspect that network packets between inference pods are traversing unnecessary hops due to overlay routing. Which CNI mode should you have chosen for optimal direct routing?

Accepted Answer

Azure CNI with direct pod IP routing (no overlay). Azure CNI with direct pod IP routing assigns each pod a routable IP from the VNet subnet, so pod-to-pod traffic is routed natively by the Azure SDN fabric without encapsulation. This eliminates the overlay tunnel (VXLAN) hops that add latency and MTU overhead. For latency-sensitive inference traffic, direct routing is the optimal CNI choice.

Answer

Kubenet with host-port mapping

Answer

Kubenet with basic Linux bridge

Answer

Azure CNI Overlay

Question 12

You are deploying an AI model container to Azure Container Apps. The container requires persistent storage to cache downloaded Hugging Face model weights across container restarts. Which storage type should you attach to the Container App?

Accepted Answer

Azure Files mount via Container Apps storage configuration. Azure Container Apps supports mounting Azure Files shares as persistent volumes through the storage configuration at the environment or app level. Azure Files is the only fully managed, SMB/NFS-based shared file system that Container Apps can mount natively, and it persists independently of the container replica lifecycle, making it ideal for caching model weights across restarts.

Answer

Azure Managed Disks (Premium SSD) direct attach

Answer

Azure Blob Storage FUSE driver

Answer

Ephemeral emptyDir volume

Question 13

You are building an AI container image and need to minimize its final size to speed up deployment times. Which multi-stage build practice should you follow?

Accepted Answer

Use a builder stage for compilation and copy only runtime artifacts into a slim base image. Multi-stage builds use a builder stage containing compilers, SDKs, and build dependencies, then copy only the compiled artifacts (binaries, wheels, model files needed at runtime) into a minimal runtime base image such as python:3.11-slim or alpine. This keeps the final image free of build toolchains, caches, and intermediate layers, dramatically reducing image size and pull time. The other options either bloat the image or are unrelated to build strategy.

Answer

Store model weights directly inside the container image layers

Answer

Install all development tools and pip packages in a single RUN instruction

Answer

Disable container image compression when pushing to ACR

Question 14

You have an AI scoring script that runs periodically. You want to execute this containerized workload on a schedule without managing virtual machines. Which Azure service is best suited for running containerized batch jobs on a schedule?

Accepted Answer

Azure Container Apps Jobs. Azure Container Apps Jobs is correct because it is a serverless container execution service that supports scheduled (cron) and event-driven jobs without managing VMs or Kubernetes infrastructure. You define a container image, a cron schedule, and resource limits, and Azure handles the orchestration, scaling, and execution — ideal for periodic AI scoring scripts packaged as containers.

Answer

Azure Kubernetes Service CronJobs

Answer

Azure Container Instances with restart policy Always

Answer

Azure Functions with HTTP triggers

Question 15

You are configuring TLS termination for an AI model API hosted in Azure Container Apps using a custom domain name. Where must you upload or configure the custom SSL certificate?

Accepted Answer

In the Container App custom domains settings using a Key Vault reference or uploaded certificate. In Azure Container Apps, TLS termination for a custom domain is configured at the Container App (or its managed environment) level: you add the custom domain and bind a certificate, which can be a managed certificate or a certificate you upload or reference from Azure Key Vault. The certificate is associated with the app's ingress configuration, not with the container image or registry. This is where the platform terminates TLS before forwarding traffic to your container.

Answer

In the Azure Container Registry webhook configuration

Answer

Inside the container image filesystem under /etc/ssl/certs

Answer

On the underlying Azure Container Instances node pool