AI-200 Containerized AI Workloads Practice Test 5 — 15 Questions

Question 1

You need to deploy a microservice application that consists of an API gateway and an AI model inference container. The solution must scale automatically based on HTTP traffic and support zero scaling when idle to reduce costs, without requiring complex Kubernetes cluster management. Which service is best suited for this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Container Apps. Azure Container Apps is a serverless container platform built on Kubernetes and KEDA that supports HTTP-based autoscaling, including scale-to-zero when idle. It abstracts away cluster management, making it ideal for microservices with an API gateway and an AI inference container that must scale on demand without operational overhead.

Answer

Azure App Service for Containers

Answer

Azure Batch

Answer

Azure Kubernetes Service (AKS)

Question 2

You are deploying a containerized machine learning inference service to Azure Container Apps. The model artifact is large (15 GB) and must be securely loaded during container startup. What is the most efficient way to mount this model data into the container app?

Accepted Answer

Mount an Azure Files volume to the container app. Mounting an Azure Files volume to the Container App is the most efficient approach because the 15 GB model is stored once in a durable share and mounted at container startup without bloating the image or re-downloading over the internet. Azure Files is the native persistent volume type for Container Apps and supports secure access via storage account keys or managed identity, satisfying the 'securely loaded' requirement.

Answer

Download the model over the public internet at container boot

Answer

Bake the model directly into the Docker image layer

Answer

Store the model in environment variables

Question 3

Your data science team pushes container images to Azure Container Registry (ACR). You need to ensure that every image pushed is automatically scanned for known vulnerabilities before being deployed to production. Which ACR feature should you enable?

Accepted Answer

Microsoft Defender for Cloud vulnerability scanning. Microsoft Defender for Cloud (specifically the Defender for Containers plan) integrates with ACR to automatically scan images on push and continuously rescan for newly disclosed CVEs. Findings surface as security recommendations and can gate deployment via Azure Policy. This is the native ACR vulnerability-scanning capability the question asks for.

Answer

ACR Tasks

Answer

Azure Policy geo-replication rules

Answer

Content Trust signing

Question 4

You need to configure network security for an Azure Container Apps environment that hosts an internal AI scoring API. The API must only be reachable from a specific Azure Virtual Network (VNet) and blocked from public internet access. How should you configure the environment?

Accepted Answer

Deploy the Container Apps environment with an internal Virtual Network integration and internal load balancer. To make a Container Apps environment reachable only from a specific VNet and block public internet access, you deploy the environment with VNet integration and configure it to use an internal load balancer. This gives the environment a private IP in your subnet and removes the public ingress endpoint entirely.

Answer

Attach a Private Endpoint to the Azure Container Registry hosting the app

Answer

Enable IP security restrictions on the default public ingress

Answer

Configure an Azure Front Door instance with WAF rules in front of the public endpoint

Question 5

You are deploying a distributed PyTorch training job across multiple nodes in an Azure Kubernetes Service (AKS) cluster. Which mechanism should you use to facilitate high-speed, low-latency inter-node communication required for gradient synchronization?

Accepted Answer

Node placement with GPU-optimized VM series (such as NDm A100 v4) and InfiniBand support. Distributed PyTorch training requires high-bandwidth, low-latency inter-node communication for AllReduce gradient synchronization, and InfiniBand (via RDMA) on GPU-optimized VM series like NDm A100 v4 provides exactly that. These SKUs include dedicated InfiniBand fabric that bypasses the TCP/IP stack, delivering the microsecond latency and hundreds of Gbps throughput needed to keep GPUs from starving during gradient exchange.

Answer

Kubenet basic networking with dynamic NAT

Answer

Azure Application Gateway Ingress Controller (AGIC)

Answer

Standard Azure CNI with Network Policies enabled

Question 6

You are configuring authentication between an Azure Container App running an AI model and an Azure OpenAI resource. To adhere to security best practices, you must avoid storing API keys in environment variables or code. How should you configure this?

Accepted Answer

Configure a system-assigned managed identity on the Container App and grant it Cognitive Services OpenAI User role on the Azure OpenAI resource. A system-assigned managed identity on the Container App gives it an identity in Microsoft Entra ID, and granting that identity the Cognitive Services OpenAI User role on the Azure OpenAI resource authorizes token-based access without any stored secret. The Container App SDK/Managed Identity endpoint issues short-lived tokens automatically, eliminating keys in code or environment variables. This is the recommended keyless authentication pattern for Azure-to-Azure service calls.

Answer

Hardcode the secondary endpoint key into the Docker image build arguments

Answer

Enable anonymous public access on the Azure OpenAI resource for internal virtual network traffic

Answer

Store the Azure OpenAI primary key in an Azure Key Vault and reference it via Container App secrets with plain text retrieval

Question 7

You need to deploy a real-time object detection model inside an Azure Container App. The application requires immediate scale-out when the queue length of incoming image processing requests exceeds a threshold. Which scaling rule type should you configure?

Accepted Answer

Azure Queue Storage / Service Bus KEDA scaling rule. Azure Container Apps uses KEDA (Kubernetes Event-Driven Autoscaling) scalers to scale based on external event sources. A queue-length trigger from Azure Queue Storage or Service Bus is the correct KEDA scaler when the workload must scale out in response to the number of pending messages, which matches the requirement of scaling when image processing requests exceed a threshold.

Answer

Memory utilization scaling rule

Answer

CPU utilization scaling rule

Answer

HTTP concurrency scaling rule

Question 8

Your enterprise requires that all container images deployed to Azure Kubernetes Service (AKS) must originate from approved corporate Azure Container Registries (ACRs). How can you enforce this restriction cluster-wide?

Accepted Answer

Configure Azure Policy for Kubernetes with the built-in initiative to restrict container registries. Azure Policy for Kubernetes extends Gatekeeper/OPA into AKS, allowing cluster-wide admission control that blocks pods whose images do not match approved ACR patterns. The built-in initiative 'Kubernetes cluster containers should only use allowed images' enforces this at admission time, before workloads are scheduled. This is the native, declarative, auditable mechanism Microsoft provides for exactly this governance requirement.

Answer

Configure standard Kubernetes Network Policies in the kube-system namespace

Answer

Set up ACR webhook notifications to trigger Azure Functions that delete unauthorized pods

Answer

Modify the kubelet configuration file on every cluster node manually

Question 9

You are troubleshooting a containerized AI model running in an Azure Container App that crashes immediately upon startup with an exit code indicating an Out Of Memory (OOM) error. You need to inspect the container resource allocations. Where can you adjust the memory allocation for the container?

Accepted Answer

In the Azure Container App revision template settings under container resource allocation. Azure Container Apps defines resource allocations (CPU cores and memory) per container inside the revision template. To fix an OOM crash, you edit the container's resources.requests (or the equivalent cpu/memory fields) in the revision template, which creates a new revision with the increased memory limit.

Answer

In the Azure Container Registry webhook configuration

Answer

In the Azure Virtual Network route table settings

Answer

In the Azure Monitor diagnostic settings export destination

Question 10

You are configuring continuous deployment for an AI model container. Whenever a data scientist pushes code to a GitHub repository, you want Azure Container Registry to automatically build and tag the new container image without managing an external CI/CD build agent. What should you use?

Accepted Answer

ACR Tasks with automated source code triggers. ACR Tasks supports automated builds triggered by source code commits to GitHub or Azure DevOps, executing the docker build inside Azure without requiring you to manage a build agent. You configure a task with a source trigger (e.g., on commit to a branch) and ACR builds, tags, and optionally pushes the image automatically. This matches the requirement for CI/CD without external build infrastructure.

Answer

Azure DevOps self-hosted build agent running on a VM

Answer

Azure Logic Apps polling GitHub webhooks

Answer

An AKS deployment controller pod

Question 11

You need to store sensitive database connection strings and AI API keys used by containerized applications running in Azure Container Apps. Which feature should you use to securely store and reference these values?

Accepted Answer

Container App Secrets. Container App Secrets provide an encrypted, managed store for sensitive values such as connection strings and API keys, and they can be referenced from environment variables or volume mounts without exposing the plaintext in the app definition. They are scoped to the Container App and integrated with the platform's secret management, making them the correct secure storage mechanism.

Answer

A standard DNS TXT record

Answer

Azure Storage account public blob container

Answer

Plain text Dockerfile ENV directives

Question 12

You are deploying a custom AI model container to Azure Container Apps. The container listens on port 8080 and requires health probes to verify readiness before routing traffic. How should you configure the probes?

Accepted Answer

Configure an HTTP readiness probe targeting port 8080 on your health check endpoint. Azure Container Apps supports HTTP and TCP probes defined at the container level, and an HTTP readiness probe is the correct mechanism to signal that the app is ready to receive traffic on its listening port. Since the container listens on port 8080 and exposes a health check endpoint, an HTTP readiness probe targeting that port lets the platform delay traffic routing until the endpoint returns a success status code. This matches the Kubernetes-style probe model that Container Apps implements, where readiness probes control traffic admission rather than process restart.

Answer

Configure an Azure Front Door health probe pointing to the internal container IP

Answer

Configure a TCP liveness probe pointing to port 22 for SSH management

Answer

Configure a startup probe that restarts the container if CPU usage drops below 5 percent

Question 13

You are troubleshooting intermittent network timeout errors between microservices in an AKS cluster running an AI pipeline. You suspect that network policies are blocking required inter-pod communication. Which CNI plugin must be configured in AKS to enforce these network policies?

Accepted Answer

Azure CNI with Azure Network Policies or Calico enabled. AKS network policies are only enforced when the cluster uses Azure CNI (or Azure CNI Overlay) with a policy engine — either Azure Network Policy Manager or Calico — enabled at cluster creation. Kubenet does not support NetworkPolicy enforcement, and kube-proxy/NAT Gateway are unrelated to pod-level policy enforcement. Therefore Azure CNI plus Azure Network Policies or Calico is the required configuration.

Answer

Kubernetes standard kube-proxy in IPVS mode only

Answer

Azure Virtual Network NAT Gateway

Answer

Kubenet basic networking without network policies

Question 14

You have an Azure Container Registry and an Azure Kubernetes Service cluster in different Azure regions. You want to ensure that AKS nodes pull container images from a local regional endpoint to minimize latency and cross-region data transfer fees. What feature should you configure on ACR?

Accepted Answer

ACR Geo-Replication. ACR Geo-Replication lets you replicate a registry to multiple Azure regions so that each AKS cluster pulls from a regional replica endpoint, reducing latency and eliminating cross-region egress charges. When geo-replication is enabled, ACR automatically routes pull requests to the closest replica based on the client's region. This is the native, supported way to achieve regional image locality.

Answer

Azure ExpressRoute global reach

Answer

ACR Import command scheduled daily

Answer

Azure Traffic Manager DNS routing

Question 15

Your development team is planning to deploy a containerized natural language processing model to Azure Container Apps. Which TWO features are natively supported by Azure Container Apps for managing application lifecycle and traffic? (Choose two.)

Accepted Answer

Built-in KEDA-based autoscaling including scaling to zero. Azure Container Apps natively supports KEDA-based autoscaling, including scale-to-zero, which is option B — this is a core platform capability that lets containerized workloads (such as an NLP model) scale based on event sources like HTTP traffic or queues without managing Kubernetes infrastructure. Option C is also correct because Azure Container Apps provides native revision management, allowing immutable revisions of an app to be created and traffic splitting (for example, weighted percentages) between revisions for blue-green or canary deployments. Option A is incorrect because Azure Container Apps is a serverless container platform and does not deploy or expose bare-metal hypervisors to users. Option D is incorrect because Azure Container Apps does not provide direct root SSH access to individual container instances; debugging is done via logs, console, or exec into containers without root host access. Option E is incorrect because the Kubernetes control plane is fully managed by Azure and users cannot manually configure master nodes.

Answer

Automatic deployment of bare-metal hypervisors

Answer

Direct root SSH access to individual container instances for interactive debugging

Answer

Direct manual configuration of control plane Kubernetes master nodes