AI-200 Containerized AI Workloads Practice Test 8 — 15 Questions

Question 1

You are running a GPU-intensive AI workload in AKS. You want to ensure the pods are scheduled only on nodes that have GPUs. How do you enforce this?

Accepted Answer

Use a nodeSelector for 'sku=gpu'.. A nodeSelector in the pod spec constrains scheduling to nodes whose labels match the specified key-value pair, so 'sku=gpu' ensures the pod only lands on GPU-labeled nodes. This is the simplest and most direct scheduling constraint for hardware targeting in AKS. It works because the Kubernetes scheduler filters nodes by label before scoring them.

Answer

Use a DaemonSet.

Answer

Define a Resource Request for RAM.

Answer

Add a Kubernetes Taint to the GPU nodes.

Question 2

You want to track the latency of your model inference API in production. Which Azure tool should you integrate into your containerized application?

Accepted Answer

Azure Application Insights.. Azure Application Insights is the Application Performance Management (APM) service within Azure Monitor, designed to capture request latency, dependency calls, exceptions, and custom telemetry from applications. Integrating the Application Insights SDK (or OpenTelemetry) into the containerized inference API automatically records request duration and end-to-end transaction traces. This directly answers the requirement to track inference API latency in production.

Answer

Azure Storage Queue.

Answer

Azure Event Hubs.

Answer

Azure Data Factory.

Question 3

Your containerized AI application requires a specific version of a kernel driver that is not installed on the AKS nodes. What is the most efficient way to manage this?

Accepted Answer

Use a privileged InitContainer to load the driver.. A privileged InitContainer runs before the main application container and, with privileged security context, can load kernel modules (e.g., via modprobe or insmod) onto the node. This is the standard Kubernetes pattern for node-level setup that must complete before the workload starts. It is more efficient than rebuilding the cluster and avoids granting the application container itself elevated privileges.

Answer

Mount the /proc filesystem as read-write.

Answer

Run the application as root.

Answer

Rebuild the AKS cluster.

Question 4

You want to limit the CPU resources that a specific AI inference pod can consume. Which Kubernetes field do you configure?

Accepted Answer

resources.limits.. The `resources.limits` field in a Kubernetes pod spec sets the maximum CPU and memory a container can consume. When a container exceeds its CPU limit, it is throttled; when it exceeds its memory limit, it is OOM-killed. This is the correct field to cap CPU for an inference pod.

Answer

resources.requests.

Answer

securityContext.

Answer

livenessProbe.

Question 5

You have a large image that takes a long time to pull. You want to speed up deployment in AKS. Which feature should you enable?

Accepted Answer

Enable Artifact Streaming in ACR.. Artifact Streaming in ACR (also called streaming artifacts) allows AKS nodes to start containers before the entire image is downloaded, by streaming only the layers needed at startup. This dramatically reduces cold-start time for large images because the kubelet doesn't wait for a full pull. It's the purpose-built ACR feature for accelerating large-image deployments in AKS.

Answer

Use a public mirror for the image.

Answer

Increase the AKS node count.

Answer

Use smaller base images.

Question 6

Which type of registry is most suitable for storing images that are shared across an entire organization?

Accepted Answer

Azure Container Registry.. Azure Container Registry (ACR) is the Azure-native private registry designed for organization-wide image sharing. It supports Azure RBAC, Microsoft Entra ID authentication, geo-replication, private endpoints, and integration with AKS, Container Apps, and ACI, making it the correct choice for enterprise-scale image distribution.

Answer

Docker Hub (Free).

Answer

GitHub Container Registry.

Answer

Local hard drive.

Question 7

Which TWO of the following steps are required to enable GPU support for a pod in AKS?

Accepted Answer

Use a node pool with GPU-enabled VMs.. Option A is correct because GPU workloads in AKS can only be scheduled onto nodes backed by GPU-enabled VM sizes (for example NC, ND, or NV series), so the cluster must contain a GPU node pool. Option C is correct because the pod spec must request the GPU resource using the extended resource name 'nvidia.com/gpu' (for example, resources.limits: nvidia.com/gpu: 1), which is how the Kubernetes device plugin advertises and allocates GPUs to the container. Option B is incorrect because the Privileged flag in a Dockerfile is unrelated to GPU enablement and is not required for GPU scheduling. Option D is incorrect because running the pod as root is not a prerequisite for GPU access in AKS. Option E is incorrect because the NVIDIA drivers are installed and managed by AKS on the GPU nodes, not on the local client machine used to submit the pod.

Answer

Enable the 'Privileged' flag in the Dockerfile.

Answer

Set the pod to run as root.

Answer

Install the NVIDIA driver on the local machine.

Question 8

Which THREE of the following are benefits of using ACR Tasks for containerized AI workloads?

Accepted Answer

Triggering builds on base image updates.. Option B is correct because ACR Tasks can automatically trigger a rebuild of an image whenever its base image is updated in the registry, which keeps containerized AI workloads current with patched or upgraded dependencies. Option C is correct because ACR Tasks provides automated image building from source code, using a Dockerfile or buildpacks, so commits to a Git repository or source archive can produce new container images without a local Docker daemon. Option D is correct because ACR Tasks supports multi-step tasks, defined in a YAML file, that chain build, run, and push steps for complex container workflows. Option A is not a benefit of ACR Tasks, since automatic scaling of the registry is a feature of the Azure Container Registry service tier (for example, Premium with geo-replication and throughput scaling), not of ACR Tasks. Option E is not applicable because ACR Tasks builds and manages container images; it does not directly deploy to Azure SQL, which is a relational database service rather than a container deployment target.

Answer

Automatic scaling of the registry.

Answer

Direct deployment to Azure SQL.

Question 9

Which TWO of the following are valid ways to authenticate an AKS cluster to an Azure Container Registry?

Accepted Answer

Azure Managed Identity.. Option A (Azure Managed Identity) is correct because AKS can use a system-assigned or user-assigned managed identity to authenticate to ACR via the AcrPull role assignment, eliminating stored credentials; the kubelet identity is granted the AcrPull role on the registry. Option B (Microsoft Entra ID Service Principal) is correct because you can create an AAD service principal, assign it the AcrPull role on the ACR, and store its appId/password as a Kubernetes imagePullSecret referenced by the pod spec. Option C (Azure Monitor) is incorrect because it is a monitoring/observability service, not an authentication mechanism for pulling images. Option D (Hardcoded Docker config file) is incorrect because embedding credentials in a plaintext docker config.json is insecure and not a supported AKS-to-ACR authentication method. Option E (Azure Policy) is incorrect because it enforces governance/compliance rules, not registry authentication.

Answer

Azure Monitor.

Answer

Hardcoded Docker config file.

Answer

Azure Policy.

Question 10

Which THREE of the following items should be configured to ensure your AI workload in AKS is observable?

Accepted Answer

Prometheus and Grafana.. Prometheus and Grafana (A) are correct because they provide the standard open-source metrics collection and dashboarding stack for Kubernetes, scraping AKS node, pod, and container metrics via exporters and kube-state-metrics to visualize workload health and performance. Integration with Application Insights (B) is correct because it enables distributed tracing, request/dependency telemetry, and live metrics for the AI application code running in AKS, which is essential for observing model inference latency and failures. Azure Monitor for Containers (D) is correct because it is the native AKS monitoring solution that collects container logs, node and pod metrics, and events into Log Analytics, providing out-of-the-box insights and alerts for the cluster. Azure Backup (C) is incorrect because it is a data protection and disaster recovery service, not an observability tool, and Azure Bastion (E) is incorrect because it provides secure RDP/SSH access to VMs without exposing public IPs, which is unrelated to monitoring or telemetry.

Answer

Azure Backup.

Answer

Azure Bastion.

Question 11

Which TWO of the following are true about Azure Container Apps?

Accepted Answer

It is a serverless container platform.. Azure Container Apps is a fully managed, serverless container platform, so option B is correct: it abstracts away the Kubernetes control plane and nodes, letting you run containers without provisioning or managing infrastructure. Option D is also correct because Azure Container Apps uses KEDA (Kubernetes Event-driven Autoscaling) under the hood to scale containers based on events such as queues, HTTP traffic, or custom metrics. Option A is wrong because node management is handled by the platform, not the user. Option C is wrong because Azure Container Apps has built-in Dapr integration for microservice building blocks. Option E is wrong because Azure Container Apps supports virtual network (VNET) integration for inbound and outbound connectivity.

Answer

You must manage the underlying Kubernetes nodes.

Answer

It is not compatible with Dapr.

Answer

It does not support VNETs.

Question 12

Which THREE of the following are security best practices for container registries?

Accepted Answer

Use Private Link for network access.. Option A is correct because using Azure Private Link (or an equivalent private endpoint) for registry access keeps traffic on the Microsoft backbone network and eliminates exposure of the registry to the public internet, preventing unauthorized access and data exfiltration. Option C is correct because applying Role-Based Access Control (RBAC) enforces least-privilege access, ensuring only authorized identities can push, pull, or manage registry resources such as repositories and images. Option E is correct because enabling vulnerability scanning (for example, Microsoft Defender for Containers or registry-integrated scanning) automatically detects known CVEs in image layers and base images, allowing remediation before deployment. Option B is not a best practice because disabling HTTPS exposes registry credentials and image layers to man-in-the-middle attacks and tampering; registries must enforce TLS. Option D is not a best practice because the 'latest' tag is mutable and non-deterministic, so production deployments should use immutable, version-specific tags or digests to guarantee reproducibility and traceability.

Answer

Disable HTTPS for faster access.

Answer

Use the 'latest' tag for production images.

Question 13

Which THREE of the following are common reasons for a container image pull failure in AKS?

Accepted Answer

Network connectivity issues to ACR.. Option B is correct because AKS nodes must reach the registry endpoint (for example, myregistry.azurecr.io over HTTPS/443), and blocked egress, NSG/UDR misconfiguration, private endpoint or DNS resolution problems will cause the kubelet to fail the image pull. Option C is correct because pulling from a private registry such as ACR requires valid credentials — either an imagePullSecret, the AKS-managed AcrPull role assignment, or kubelet identity — and missing or expired permissions produce an authentication failure. Option E is correct because an invalid image tag or registry path (for example, a nonexistent tag or a misspelled registry/repository) makes the image unresolvable, yielding a manifest unknown or not found error. Option A is not a pull failure cause: excessive node memory does not prevent image retrieval, and insufficient memory would instead cause scheduling or OOM issues. Option D is not relevant: how fast a container runs has no bearing on whether its image can be pulled from a registry.

Answer

The node has too much memory.

Answer

The container is running too fast.

Question 14

Which THREE of the following options are important when configuring an AKS cluster for AI workloads?

Accepted Answer

Network policies for pod communication isolation.. Option A is correct because network policies (implemented via Azure Network Policy or Calico on AKS) let you isolate pod-to-pod traffic, which is essential for securing AI workloads that often handle sensitive data and expose inference endpoints. Option C is correct because managed identity lets AKS cluster components (such as the kubelet, control plane, and CSI drivers) authenticate to Azure resources like Key Vault, ACR, and Storage without embedding credentials, which is a security best practice for AI pipelines pulling models and data. Option E is correct because AI workloads such as model training and inference require GPU acceleration, and AKS supports GPU-enabled node pools (e.g., NC/ND-series VMs with NVIDIA device plugin) to schedule those workloads. Option B is not appropriate because running every pod as privileged grants full host access and violates least-privilege, dramatically increasing the attack surface. Option D is wrong because disabling internal firewalls removes necessary network segmentation and security controls rather than properly configuring NSGs, Azure Firewall, or private endpoints.

Answer

Always run every pod as privileged.

Answer

Disable all internal firewalls.

Question 15

Which TWO of the following techniques help optimize the performance of containerized AI models in AKS?

Accepted Answer

Tune pod resource limits and requests.. Option A is correct because setting accurate CPU and memory requests lets the AKS scheduler place pods on nodes with sufficient capacity, while proper limits prevent noisy-neighbor contention and OOMKills, directly improving the stability and throughput of containerized AI inference or training workloads. Option E is correct because dedicating node pools with GPU-enabled VM SKUs (e.g., NC/ND series) to GPU tasks ensures AI pods get exclusive access to GPU resources, avoids scheduling conflicts with CPU-only workloads, and allows independent scaling and taints/tolerations for GPU nodes. Option B is wrong because disabling all logging removes observability needed to diagnose performance bottlenecks and does not improve runtime performance. Option C is wrong because switching from Azure CNI to standard (kubenet) CNI does not optimize AI model performance and can reduce networking capabilities. Option D is wrong because blindly increasing replicas to 100 for all services wastes resources, can cause scheduling pressure and cost blowups, and does not address per-pod performance.

Answer

Disable all logging.

Answer

Use the standard CNI instead of Azure CNI.

Answer

Increase the replica count to 100 for all services.