AI-200 Containerized AI Workloads — Timed 40 Questions

Question 1

You are configuring an Azure Container Apps environment with a custom Virtual Network. Your AI containers need to securely connect to an Azure SQL Database that is secured behind a private endpoint. Which configuration is required on the Container Apps environment?

40 minute time limit — choose an answer to begin.

Accepted Answer

Deploy the Container Apps environment into a custom VNet with workload profile subnets. To reach an Azure SQL Database behind a private endpoint, the Container Apps environment must be deployed into a custom VNet (VNet-injected) so its workloads get private IPs in your address space and can resolve the privatelink.database.windows.net DNS record. Workload profile subnets provide the dedicated compute infrastructure required for this VNet-integrated deployment. This is the only option that establishes the required network path.

Answer

Use an external Azure Application Gateway in front of the container apps

Answer

Enable Azure Bastion on the subnet

Answer

Configure IP restriction rules on the ingress controller

Question 2

You are deploying a Python Flask API that wraps an ONNX runtime model to Azure Container Instances (ACI). The container needs to expose port 5000 externally. Which parameter must you specify when creating the container group?

Accepted Answer

--dns-name-label and port 5000 mapping. To expose port 5000 externally on an Azure Container Instance, you must specify a DNS name label (which gives the container group a public FQDN) and map the port in the container group's IP address configuration. The --dns-name-label and --ports parameters together create the public endpoint that routes to the container's listening port.

Answer

--assign-identity

Answer

--restart-policy Never

Answer

--os-type Windows

Question 3

You have an AI model container that takes 10 seconds to load weights into memory upon startup. Users report HTTP 503 errors immediately after deployment because traffic is routed to the container before it is ready. Which probe should you configure?

Accepted Answer

Startup probe. A startup probe is specifically designed to handle slow-starting containers by delaying the application of liveness and readiness checks until the container has fully initialized. In this scenario, the model takes 10 seconds to load weights, so a startup probe will prevent premature traffic routing and avoid HTTP 503 errors. Once the startup probe succeeds, the container is considered started, and normal liveness/readiness probes take over.

Answer

Liveness probe

Answer

Resource quota probe

Answer

TCP socket probe

Question 4

You are managing an AKS cluster and need to ensure that GPU driver updates do not disrupt running AI inference workloads. Which AKS feature helps manage GPU operator lifecycle and driver installation?

Accepted Answer

NVIDIA GPU Operator installed via Helm. The NVIDIA GPU Operator, deployed via Helm, is the standard mechanism for managing the full lifecycle of GPU software components on Kubernetes — including driver installation, container runtime hooks, device plugin, and DCGM monitoring. On AKS GPU node pools, installing the operator via Helm allows driver updates to be orchestrated as Kubernetes-managed DaemonSets, so updates can be rolled out in a controlled fashion without disrupting running inference workloads. This is the AKS-recommended approach for managing GPU driver lifecycle beyond the default pre-installed drivers.

Answer

Azure Bastion host extension

Answer

Azure Policy for Kubernetes

Answer

Container Insights agent upgrade

Question 5

You are scaling an AI workload in Azure Container Apps. Which TWO scale rule triggers are natively supported without custom KEDA extensions?

Accepted Answer

HTTP concurrent requests. Azure Container Apps natively supports HTTP-based scaling rules, so option A (HTTP concurrent requests) is correct because the platform exposes an HTTP scale trigger that scales replicas based on the number of concurrent HTTP requests hitting the container app's ingress endpoint. Option E (CPU and Memory utilization thresholds) is also correct because Container Apps provides built-in CPU and memory utilization scale triggers that monitor the average resource usage of replicas and scale accordingly, without requiring any custom KEDA scaler. Options B, C, and D are incorrect because Azure VM disk I/O throughput, Active Directory login failure rate, and hardware temperature sensors are not native Container Apps scale triggers; they would require external metrics or custom KEDA extensions to be used as scaling criteria.

Answer

Azure Virtual Machine disk I/O throughput

Answer

Active directory login failure rate

Answer

Custom hardware temperature sensors

Question 6

You are optimizing resource allocation for a GPU-backed AI model deployment on AKS. Which THREE Kubernetes concepts or objects are essential for managing GPU resources effectively?

Accepted Answer

Resource requests and limits specifying nvidia.com/gpu. Managing GPUs in AKS requires node selectors, resource limits for nvidia.com/gpu, and tolerations for GPU taints.

Answer

Node taints and tolerations for GPU node pools

Answer

Horizontal Pod Autoscaler based on Azure Load Balancer SNAT ports

Answer

Kubernetes persistent volume claims for GPU driver binaries

Question 7

Which TWO Azure services can store and serve private Docker container images for AI workloads?

Accepted Answer

Azure Container Instances (pulling from ACR). Azure Container Registry (D) is Microsoft's private, managed Docker registry service, purpose-built to store and serve private container images (including AI workload images) via the Docker Registry HTTP API v2, with authentication through Microsoft Entra ID, service principals, or admin credentials. Azure Container Instances (C) is correct because ACI can pull and run images directly from a private ACR using registry credentials or a managed identity, thereby serving those private container images to run AI workloads without managing a VM host. Azure Cognitive Services (A) provides prebuilt AI APIs and models, not a container image registry, so it cannot store or serve private Docker images. Azure Bastion (B) is a managed jump-host service for secure RDP/SSH access to VMs and has no image registry capability. Azure Logic Apps (E) is a workflow automation service and does not store or serve container images.

Answer

Azure Cognitive Services

Answer

Azure Bastion

Answer

Azure Logic Apps

Question 8

You are configuring an Azure Kubernetes Service (AKS) cluster to host GPU-accelerated AI model inference workloads using NVIDIA GPUs. Which component must you install in the cluster to enable containerized workloads to utilize the GPU nodes?

Accepted Answer

NVIDIA GPU Operator. The NVIDIA GPU Operator is the supported way to provision GPU drivers, the device plugin, container runtime hooks, and monitoring on AKS GPU node pools. It bundles the device plugin and driver lifecycle so containers can request nvidia.com/gpu resources.

Answer

NVIDIA Device Plugin for Kubernetes

Answer

KEDA scaler

Answer

Azure Monitor agent

Question 9

You manage an AKS cluster running high-throughput AI inference pods. During traffic spikes, pods experience latency due to slow container image pulls from Azure Container Registry (ACR). You want to optimize image pull performance across cluster nodes. Which feature should you enable?

Accepted Answer

AKS Artifact Streaming (formerly Image Streaming). AKS supports Artifact Streaming (previously called Image Streaming), which streams container image layers from ACR on demand instead of fully pulling the image before the container starts. This reduces pod startup latency for large AI inference images by fetching layers lazily over the network as the container accesses them, so pods can begin running before the entire image is downloaded. This directly addresses slow image pulls during traffic spikes.

Answer

ACR Tasks auto-purge

Answer

ACR Geo-Replication

Answer

Azure Blob Storage CDN integration

Question 10

You are designing a high-performance AI inference architecture on Azure Kubernetes Service (AKS). Which THREE AKS features or configurations should you incorporate to optimize performance and resource utilization? (Choose three.)

Accepted Answer

Cluster Autoscaler to automatically scale node pool size based on pending pod demands. Option A is correct because the Cluster Autoscaler dynamically adjusts the number of nodes in a node pool based on pending pod resource requests, ensuring that AI inference workloads get the capacity they need without manual intervention and improving overall resource utilization. Option C is correct because AI inference typically requires GPU acceleration, and AKS supports GPU-optimized node pools using NC or ND series VMs, which provide the necessary compute for model inference. Option E is correct because node taints and tolerations allow you to dedicate GPU nodes exclusively to AI inference pods, preventing non-GPU workloads from consuming these expensive resources and ensuring predictable performance. Option B is incorrect because single-core, low-memory burstable B-series VMs are not suitable for high-performance AI inference, which demands significant CPU, memory, and GPU resources. Option D is incorrect because disabling the Kubernetes scheduler and manually placing every container instance would remove the benefits of automated scheduling, reduce efficiency, and is not a recommended practice for optimizing performance in AKS.

Answer

Running all pods exclusively on single-core, low-memory burstable VMs (B-series)

Answer

Disabling the Kubernetes scheduler to manually place every container instance

Question 11

You are troubleshooting a containerized Python application in an Azure Container App that fails to respond to incoming HTTP requests. Which TWO diagnostic tools or features can you use within Azure Container Apps to investigate the issue? (Choose two.)

Accepted Answer

Console connection in the Azure portal for interactive shell access to a container replica. Azure Container Apps provides log streaming (via Azure Monitor/Log Analytics) and a built-in console for interactive troubleshooting of container instances.

Answer

Direct Remote Desktop Protocol (RDP) session to the underlying node

Answer

Direct modification of the physical host server BIOS

Question 12

You are deploying a custom PyTorch inference model container to Azure Container Apps. The application requires GPU acceleration for real-time video processing. Which Azure Container Apps environment configuration tier must you select to support this requirement?

Accepted Answer

Dedicated workload profiles (Consumption and Dedicated). GPU-enabled workloads in Azure Container Apps require a workload profile that includes GPU compute, which is only available under the Dedicated workload profiles plan (with the Consumption + Dedicated environment configuration). The Consumption-only tier does not offer GPU SKUs, so selecting Dedicated workload profiles is mandatory to attach a GPU-enabled profile (e.g., NCasT4_v3-based) to the container app. This is the only environment configuration that exposes GPU resources to the container.

Answer

Serverless container instances tier

Answer

Azure Container Apps Basic tier

Answer

Consumption standard workload profile

Question 13

Your team pushes custom AI model container images to Azure Container Registry (ACR). Company policy states that all container images must be automatically scanned for Common Vulnerabilities and Exposures (CVEs) upon push. Which ACR service tier must you use to meet this requirement using Microsoft Defender for Cloud?

Accepted Answer

Premium tier. Microsoft Defender for Cloud's vulnerability scanning for container images in Azure Container Registry (the 'Defender for Containers' / registry scanning capability) requires the Premium tier of ACR. Premium is the only tier that supports the features needed for this integration, including private link, geo-replication, and — critically — the registry-level security scanning hooks that Defender for Cloud uses to trigger image assessment on push. Lower tiers (Basic, Standard, Free) do not expose the required capabilities, so automatic CVE scanning on push cannot be enabled.

Answer

Free tier

Answer

Standard tier

Answer

Basic tier

Question 14

You are deploying a custom text-embedding model container to Azure Container Apps. You need to configure scaling rules so that the container scales out based on incoming HTTP traffic and Azure Service Bus queue length. Which TWO scalers can you configure? Each correct answer presents part of the solution.

Accepted Answer

azure-servicebus scaler. Option B (azure-servicebus scaler) is correct because Azure Container Apps natively supports the Service Bus KEDA scaler, which scales replicas based on the length of a specified queue or topic subscription using connection string and queueName metadata. Option E (http scaler) is correct because Container Apps includes a built-in HTTP scaler that scales based on concurrent HTTP requests, which matches the requirement to scale on incoming HTTP traffic. Option A (cpu memory-limit scaler) is not a valid Container Apps scaler; CPU and memory scaling are configured as rules using the cpu and memory triggers, not a combined 'cpu memory-limit' scaler. Option C (azure-blob-storage scaler) is a real KEDA scaler but is irrelevant here since the scenario requires scaling on Service Bus queue length, not blob storage events. Option D (container-registry scaler) does not exist as a scaling trigger in Azure Container Apps.

Answer

cpu memory-limit scaler

Answer

azure-blob-storage scaler

Answer

container-registry scaler

Question 15

You are deploying a custom PyTorch model to Azure Container Apps. You need to ensure that the container utilizes GPU acceleration. Which configuration step is required in the Container App environment?

Accepted Answer

Assign a workload profile that supports GPU instances.. Azure Container Apps supports GPU workloads through workload profiles, which define the compute type (Consumption, Dedicated, or GPU-enabled) for the environment. To use GPU acceleration, you must assign a workload profile that includes GPU-capable instances (such as the NC series) to the Container App environment. This is the required configuration step — there is no simple 'GPU-enabled' toggle on the app itself.

Answer

Enable the 'GPU-enabled' flag in the Container App resource settings.

Answer

Set the --gpu-count parameter in the Azure CLI deploy command.

Answer

Install the NVIDIA CUDA driver manually inside the container image.

Question 16

You need to automate the deployment of containerized AI models whenever a new image is pushed to ACR. What is the most efficient Azure-native tool for this trigger?

Accepted Answer

ACR Tasks.. ACR Tasks is the Azure-native feature that can automatically trigger a container image build or deployment when a new image is pushed to a registry. It supports triggers on base image updates, source code commits, and image pushes, and can run multi-step tasks that deploy to AKS, Container Apps, or ACI, making it the most efficient native trigger.

Answer

Azure Service Bus.

Answer

Azure Policy.

Answer

Azure Logic Apps.

Question 17

You are using Azure Container Apps to host a web API for an AI model. You want to ensure that only authorized traffic reaches the container. How should you secure the endpoint?

Accepted Answer

Enable 'Authentication' in the Ingress settings.. Enabling Authentication in the Ingress settings of an Azure Container App activates the built-in Easy Auth (App Service Authentication/Authorization) middleware, which validates incoming requests against an identity provider (Microsoft Entra ID, Google, Facebook, etc.) before traffic reaches the container. This ensures only authenticated and authorized callers can invoke the API, satisfying the requirement without deploying additional infrastructure. It is the native, first-class mechanism for securing Container Apps endpoints.

Answer

Configure an Azure Firewall in front of the Container App.

Answer

Use the --allow-all flag in the deployment command.

Answer

Place the container in a Public IP configuration.

Question 18

You are running a distributed AI training job on AKS using MPI. Which network configuration is critical for performance?

Accepted Answer

Enable Azure Accelerated Networking on the node pool.. Azure Accelerated Networking uses SR-IOV to bypass the host virtual switch and give VMs (and AKS nodes) direct hardware access to the NIC, drastically reducing latency and CPU overhead. For MPI-based distributed AI training, which is highly sensitive to inter-node latency and bandwidth (e.g., AllReduce operations), Accelerated Networking is critical for performance. It is enabled on the AKS node pool via `--enable-accelerated-networking`.

Answer

Use an internal VNET peering.

Answer

Enable standard load balancing.

Answer

Disable the pod network policy.

Question 19

You are deploying an AI model to AKS that requires a specific kernel module. What is the recommended strategy to ensure the node has this module?

Accepted Answer

Use a privileged InitContainer to load the module.. Loading a kernel module requires host-level privileges and access to the node's kernel, which a normal container cannot do. A privileged InitContainer runs before the main pod, has CAP_SYS_MODULE and host access, and can run 'modprobe <module>' to load the required module on the node before the AI workload starts.

Answer

Ask Microsoft support to update the kernel.

Answer

Modify the AKS cluster configuration file.

Answer

Include the module in the Docker image.

Question 20

You have an AI model container that is frequently crashing due to OOM (Out of Memory) errors. How do you identify the actual memory usage compared to the limits?

Accepted Answer

Analyze metrics in Azure Monitor for Containers.. Azure Monitor for Containers collects memory working set, RSS, and limit metrics from the container runtime and exposes them alongside configured limits, letting you directly compare actual usage against the memory limit that triggers OOMKilled. This is the authoritative source because it captures the container's cgroup-level memory accounting, which is what the kernel OOM killer evaluates.

Answer

Run 'free -m' inside the container.

Answer

Check the pod 'Events'.

Answer

Use 'kubectl top nodes'.