AI-200 Containerized AI Workloads Practice Test 4 — 15 Questions

Question 1

You need to inspect the environment variables and configuration settings of a running container group in Azure Container Instances. Which Azure CLI command should you use?

Accepted Answer

az container show --resource-group myRG --name myContainer. The az container show command retrieves the full JSON representation of a container group, including its container definitions, environment variables, image, ports, resource requests, and current provisioning state. This is the correct way to inspect configuration of a running container group without executing into it.

Answer

az container exec --exec-command env

Answer

az aks inspect

Answer

az container list-secrets

Question 2

You are deploying an AI workload to AKS and want to ensure that pods belonging to your application are distributed across different fault domains (availability zones) for high availability. Which Kubernetes feature should you configure?

Accepted Answer

Topology spread constraints. Topology spread constraints let you control how pods are distributed across topology domains such as zones or nodes, using label selectors and maxSkew to enforce even spreading. By setting topologyKey to topology.kubernetes.io/zone and a maxSkew of 1, you ensure pods are spread across availability zones, providing fault tolerance if a zone fails.

Answer

Resource quotas

Answer

Node taints and tolerations

Answer

Horizontal Pod Autoscaler

Question 3

You are integrating Azure Container Registry with Azure Kubernetes Service. You want to enable authentication without storing static credentials (username/password) in Kubernetes secrets. What is the recommended integration method?

Accepted Answer

Attach the ACR to the AKS cluster using Azure CLI attachment command. Attaching ACR to AKS using the Azure CLI (az aks update --attach-acr) configures the cluster's kubelet managed identity with the AcrPull role on the registry, enabling image pulls without static credentials. This is the native, supported integration that eliminates the need for Kubernetes image pull secrets.

Answer

Store ACR admin credentials in a Kubernetes Secret object

Answer

Configure a Docker daemon config.json file on every node manually

Answer

Enable anonymous pull on the Azure Container Registry

Question 4

You are troubleshooting an AI inference container deployed in Azure Container Apps that is failing health probes. Which TWO diagnostic tools or logs can you examine in the Azure portal to investigate the failure?

Accepted Answer

Log stream in the Azure portal for the container app replica. Option A, the Log stream in the Azure portal for the container app replica, is correct because Azure Container Apps exposes real-time stdout/stderr and system logs per replica, letting you see probe failures, application startup errors, and health endpoint responses directly. Option C, the Container Apps console for interactive terminal access, is correct because it opens a shell session inside the running container (via the platform's built-in exec capability), so you can manually curl the health endpoint, inspect environment variables, check listening ports, and verify the process is running. Option B is wrong because Azure Bastion connects to Azure VMs, not to Container Apps, which run on a managed serverless platform without a directly accessible host VM. Option D is wrong because AKS control plane audit logs apply to Azure Kubernetes Service clusters, not to Container Apps. Option E is wrong because Azure Storage blob metrics report on storage account usage and performance, which are unrelated to container health probe failures.

Answer

Azure Bastion connection to the container host VM

Answer

AKS control plane audit logs

Answer

Azure Storage Account blob container metrics

Question 5

You are deploying a web application container to Azure Container Apps and want to enable external HTTPS traffic. Which ingress setting must you configure?

Accepted Answer

Enable ingress with external traffic permitted. To expose a Container App to the public internet over HTTPS, you must enable ingress and set it to accept external traffic. Container Apps then provisions a fully qualified domain name (FQDN) and a managed TLS certificate automatically, terminating HTTPS at the ingress layer. Without external ingress enabled, the app is only reachable inside the environment.

Answer

Set target port to 80 and protocol to TCP

Answer

Disable ingress entirely

Answer

Configure internal ingress only

Question 6

You need to deploy a quick, stateless AI data processing script packaged in a container image without setting up Kubernetes or Container Apps. Which Azure service offers the fastest deployment for a single container instance?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is a serverless container runtime that deploys a single container (or container group) in seconds via a single CLI command or ARM template, with no cluster or orchestrator to provision. It bills per-second for vCPU and memory consumed, making it ideal for short-lived, stateless AI data processing jobs. Because there is no node pool, ingress controller, or control plane to manage, ACI delivers the fastest path from image to running container.

Answer

Azure Virtual Machines with Docker installed

Answer

Azure App Service for Linux

Answer

Azure Kubernetes Service

Question 7

You are designing a secure MLOps pipeline using Azure Container Registry. Which THREE practices should you implement to secure your AI container images?

Accepted Answer

Use managed identities instead of admin credentials for registry authentication. Option B is correct because managed identities let Azure services (e.g., AKS, Azure ML) authenticate to ACR without storing admin username/password secrets, eliminating credential leakage and enabling least-privilege RBAC assignments. Option C is correct because signing images with Notation (Notary Project) and verifying signatures at deploy time ensures image integrity and provenance, preventing tampered or unauthorized images from running. Option D is correct because Microsoft Defender for Cloud's container registry scanning continuously detects OS and language-level CVEs in pushed images, so vulnerable images can be remediated before deployment. Option A is wrong because disabling RBAC removes fine-grained access control and weakens registry security rather than simplifying it safely. Option E is wrong because anonymous pull access exposes images to anyone, violating the principle of least privilege and risking IP theft or supply-chain abuse.

Answer

Disable role-based access control (RBAC) on the registry to simplify management

Answer

Enable anonymous pull access for all public developers

Question 8

You are configuring secure image signing and verification for your AI containers using Azure Container Registry and Notation. Which feature enables cryptographically signed container images?

Accepted Answer

ACR Signature Verification / Microsoft Defender artifact signing with Notation. ACR Signature Verification, integrated with Microsoft Defender for Containers and Notation (the CNCF Notary v2 project), enables cryptographically signed container images and policy-based verification at pull time. Notation uses the OCI 1.1 referrers API to store signatures as artifacts alongside the image, and ACR can enforce that only signed images are pulled. This is the modern, standards-based approach for supply-chain integrity in Azure.

Answer

Azure Key Vault managed HSM key rotation

Answer

ACR Georeplication sync tokens

Answer

Docker Content Trust (Notary v1)

Question 9

When configuring an Azure Container Instances container group, which TWO properties can you define?

Accepted Answer

DNS name label for public IP resolution. Option B is correct because an Azure Container Instances container group can be exposed with a public IP address that includes a DNS name label, allowing resolution via ..azurecontainer.io. Option E is correct because container groups support defining environment variables (including secure values) that are passed to the container runtime at startup, which is a core configuration property of ACI containers. Options A and C are incorrect because AKS node pool sizing and VM scale set autoscaling rules belong to AKS and Virtual Machine Scale Sets respectively, not to ACI container group configuration. Option D is incorrect because Kubernetes namespace allocation is a Kubernetes/AKS concept and is not a property you define when configuring an ACI container group.

Answer

AKS node pool sizing

Answer

Virtual machine scale set autoscaling rules

Answer

Kubernetes namespace allocation

Question 10

You are deploying an AI model container in Azure Container Apps. Which TWO authentication mechanisms can you configure for securely pulling the image from a private Azure Container Registry?

Accepted Answer

ACR administrator username and password. Option A (ACR administrator username and password) is correct because Azure Container Apps supports registry authentication using the registry's admin credentials, which are enabled on the ACR and supplied as username/password when configuring the registry in the container app. Option D (System-assigned managed identity) is correct because Container Apps can use a managed identity with the AcrPull role assignment on the registry, allowing image pulls without storing secrets. Option B is incorrect because a client certificate in public DNS is not a supported ACR authentication mechanism and public DNS is not a secure credential store. Option C is incorrect because an Azure Storage account connection string authenticates to Blob/File storage, not to Azure Container Registry. Option E is incorrect because anonymous public pull tokens do not provide authenticated access to a private registry.

Answer

Azure Active Directory client certificate stored in public DNS

Answer

Azure Storage account connection string

Answer

Anonymous public pull token

Question 11

Which TWO actions can you perform using Azure Container Registry Tasks (ACR Tasks)?

Accepted Answer

Automate image builds upon Git source code repository commits. Option B is correct because ACR Tasks supports multi-step and single-step tasks that can be triggered automatically by source code commits to a Git repository (via the source trigger feature), enabling continuous integration image builds. Option C is correct because ACR Tasks performs builds in the Azure cloud using the ACR build infrastructure, so no local Docker daemon or Docker CLI is required on the developer's machine. Option A is incorrect because Azure Virtual Machine backups are handled by Azure Backup and Recovery Services vaults, not ACR Tasks. Option D is incorrect because Azure Front Door routing rules are configured through Azure Front Door, a content delivery and global load-balancing service, unrelated to container image builds. Option E is incorrect because AKS cluster deployment is performed via the Azure portal, CLI, ARM/Bicep templates, or Terraform, not through ACR Tasks, which only builds and manages container images.

Answer

Manage Azure Virtual Machine backups

Answer

Configure Azure Front Door routing rules

Answer

Deploy AKS clusters automatically

Question 12

You are configuring enterprise networking for an AKS cluster running sensitive AI models. Which THREE networking features should you implement for cluster security?

Accepted Answer

Azure Firewall or user-defined routes for outbound egress filtering. Option B is correct because Azure Firewall or user-defined routes (UDRs) let you control and filter outbound egress traffic from the AKS cluster, preventing exfiltration of sensitive AI models and enforcing FQDN/network rules. Option D is correct because Azure CNI Network Policies enforce Kubernetes NetworkPolicy objects at the pod level, restricting east-west traffic between pods so compromised workloads cannot freely reach other services. Option E is correct because a private AKS API server endpoint exposes the control plane only via a private IP inside your VNet or peered network, removing public internet exposure of the Kubernetes API. Option A is not appropriate because assigning public IPs to every worker node increases the attack surface and is unnecessary for secure egress. Option C is not appropriate because disabling all internal kube-dns resolution would break service discovery and core cluster functionality rather than improve security.

Answer

Public IP assignment to every worker node

Answer

Disabling all internal kube-dns resolution

Question 13

You are troubleshooting an AI application container in an AKS cluster that cannot resolve external domain names (e.g., huggingface.co). Which TWO Kubernetes components should you investigate?

Accepted Answer

kube-dns service endpoint mapping. Option A (kube-dns service endpoint mapping) is correct because in AKS the kube-dns Service in kube-system is the ClusterIP endpoint that pods use for DNS queries; if its selector does not match the CoreDNS pods, the endpoint list is empty and name resolution fails. Option E (CoreDNS deployment and pod health in the kube-system namespace) is correct because CoreDNS pods actually serve DNS; if they are crashlooping, unready, or scaled to zero, external names like huggingface.co cannot be resolved. Option B is irrelevant because the Horizontal Pod Autoscaler only adjusts replica counts based on metrics and has no role in DNS resolution. Option C is irrelevant because PVC binding affects storage mounting, not name resolution. Option D is irrelevant because an expired Ingress TLS certificate only breaks HTTPS trust for inbound traffic, not outbound DNS lookups from the container.

Answer

Horizontal Pod Autoscaler configuration

Answer

Persistent Volume Claim binding state

Answer

Ingress controller SSL certificate expiration

Question 14

You are configuring rolling updates for an AI model inference service on AKS with zero downtime requirements. Which THREE deployment or pod configuration settings should you configure?

Accepted Answer

Deployment strategy set to RollingUpdate with configured maxSurge and maxUnavailable. Option A is correct because a Deployment with strategy RollingUpdate and tuned maxSurge/maxUnavailable parameters replaces pods incrementally, ensuring new replicas become available before old ones are terminated, which is essential for zero-downtime rollouts. Option B is correct because readiness probes gate Service endpoint membership so traffic only reaches containers that are actually ready, while liveness probes restart hung containers, both preventing failed pods from serving inference requests. Option D is correct because a Pod Disruption Budget enforces a minimum number of available replicas during voluntary disruptions such as node drains or upgrades, protecting capacity while nodes are cordoned. Option C is incorrect because restartPolicy Never is only valid for standalone Pods, not for Deployment-managed pods (which require Always), and it would prevent automatic recovery. Option E is incorrect because disabling health checks removes the readiness gating that zero-downtime routing depends on and can send traffic to unready or broken containers.

Answer

Setting restart policy to Never on the Deployment template

Answer

Disabling all container health checks to speed up pod termination

Question 15

Your development team wants to push custom Docker images containing fine-tuned open-source LLMs to a secure, private registry hosted on Azure. Which Azure service should you use to store and manage these container images?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is Azure's managed, private Docker registry service, purpose-built to store, version, and distribute OCI-compliant container images and Helm charts. It supports geo-replication, private endpoints, content trust, and integration with AKS, Container Apps, and ACI, making it the correct choice for hosting fine-tuned LLM container images securely. Blob Storage and Azure Files can hold bytes but lack the Docker Registry HTTP API v2 needed for image push/pull.

Answer

Azure Files

Answer

Azure Artifacts

Answer

Azure Blob Storage