AI-200 Full-Length Exam Simulation

Question 1

When designing an event-driven architecture using Azure Event Grid, which THREE security or delivery mechanisms can be configured on an event subscription? Each correct answer represents a valid configuration option.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Advanced filtering based on event data property values. Option B is correct because Event Grid event subscriptions support advanced filtering, which evaluates event data fields (such as string, number, boolean, and arrays) against operators like StringContains, NumberGreaterThan, and BoolEquals to route only matching events. Option C is correct because an event subscription can define a dead-letter destination, which must be an Azure Blob Storage container, where undeliverable events are stored along with a reason for delivery failure. Option E is correct because Event Grid supports using a managed identity (system-assigned or user-assigned) on the event subscription to authenticate delivery to supported destinations such as webhooks and Service Bus, avoiding embedded secrets. Option A is not applicable because AMQP 1.0 broker transaction coordination is a Service Bus/AMQP messaging concept, not an Event Grid subscription setting. Option D is not applicable because Service Bus session lock duration is a Service Bus queue/subscription feature and cannot be configured on an Event Grid event subscription.

Answer

AMQP 1.0 broker transaction coordination

Answer

Service Bus session lock duration extension

Question 2

You are auditing your Azure subscription for security best practices related to Azure AI resources. Which TWO of the following actions help enforce governance and security? (Choose two)

Accepted Answer

Use Azure Policy to enforce allowed deployment regions and mandatory tagging.. Applying resource locks prevents accidental deletion, and enforcing Azure Policy ensures regional and configuration compliance.

Answer

Grant every user Contributor rights to the entire Azure subscription.

Answer

Share the master subscription co-administrator password with all external contractors.

Answer

Disable all firewall rules on Azure Key Vault.

Question 3

You are designing an enterprise cloud solution that integrates Azure Event Grid, Azure Service Bus, and Azure Event Hubs. You need to select the appropriate service for three specific event-driven scenarios. Which THREE pairings of Azure messaging service to scenario are correct? (Choose three)

Accepted Answer

Azure Service Bus for managing financial transactions requiring strict ordering, sessions, and dead-lettering.. Option A is correct because Azure Service Bus is the enterprise brokered-messaging service that natively supports FIFO ordering via sessions, message sessions for correlated/ordered processing, and built-in dead-letter queues for poison messages, which are exactly the requirements for financial transactions. Option B is correct because Azure Event Hubs is designed for massive-scale event ingestion (millions of events per second, with throughput units or processing units) and is the right fit for 500,000 telemetry events per second from smart grid sensors. Option C is correct because Azure Event Grid is a reactive, push-based event routing service that natively emits blob-created events from Azure Storage and can deliver them to serverless endpoints such as Azure Functions for AI processing. Option D is not correct because Event Hubs is a high-throughput streaming ingestion service, not a low-latency pub/sub webhook trigger for discrete user profile updates; Event Grid is the appropriate service for that scenario. Option E is not correct because Event Grid is not built for continuous high-volume telemetry streaming into analytics engines like Databricks; Event Hubs (often with Capture or Stream Analytics) is the correct ingestion path for that workload.

Answer

Azure Event Hubs for triggering real-time serverless webhooks upon user profile updates.

Answer

Azure Event Grid for streaming continuous IoT sensor telemetry into Azure Databricks.

Question 4

You are designing an enterprise event-driven architecture for AI workloads. Which TWO Azure services provide native support for publishing discrete, reactive event notifications when resources are created or modified? Each correct answer represents a complete solution.

Accepted Answer

Azure Blob Storage (native event notifications). Azure Blob Storage natively supports event notifications that fire discrete, reactive events such as Microsoft.Storage.BlobCreated and Microsoft.Storage.BlobDeleted when blobs are created or modified, which fits the requirement for resource-change notifications. Azure Event Grid is a fully managed publish-subscribe eventing service that natively delivers discrete, reactive event notifications from Azure resources (including Blob Storage) to subscribers via event subscriptions, making it the canonical service for this scenario. Azure Notification Hubs is a push-notification service for mobile/consumer devices (APNs, FCM, WNS), not a resource-event publisher. Azure Event Hubs is a big-data streaming/telemetry ingestion service (high-throughput event streaming), not a discrete resource-change notification publisher. Azure Service Bus Queues are a brokered messaging construct for commands/messages with queuing semantics, not native resource event notifications.

Answer

Azure Notification Hubs

Answer

Azure Event Hubs

Answer

Azure Service Bus Queues

Question 5

You are implementing a RAG solution where user queries are matched against an Azure AI Search vector index. You want to ensure that search results only return documents where a specific metadata field 'securityLevel' matches the user's clearance. How should you apply this filter?

Accepted Answer

Pass an OData filter expression in the 'filter' parameter of the search query request. Passing an OData filter expression in the 'filter' parameter of the search query request is the correct way to restrict results by metadata such as securityLevel. Azure AI Search supports OData filter syntax on filterable fields, and the filter is applied alongside vector search to return only documents matching the predicate. This enforces security trimming at query time without duplicating services or embedding metadata into vectors.

Answer

Create a separate Azure AI Search service for each security level

Answer

Encode the security level into the vector embedding values directly

Answer

Filter the results in application memory after receiving all 1000 documents

Question 6

You are optimizing search performance in Azure AI Search. You notice that vector queries are consuming excessive memory and slowing down. You decide to enable exhaustive k-NN fallback for specific queries. What does exhaustive k-NN do?

Accepted Answer

It searches all vectors exactly without relying on an approximate nearest neighbor graph. Exhaustive k-NN (also called brute-force or exact k-NN) computes the distance between the query vector and every vector in the index, returning the exact nearest neighbors without relying on an approximate graph like HNSW. It is used when recall must be perfect, at the cost of higher latency and memory.

Answer

It compresses the vector index by 50%

Answer

It shards the index across multiple search units

Answer

It caches query results in Redis

Question 7

You are configuring a vector index in Azure AI Search and want to apply scalar quantization to reduce the memory footprint. What is the primary effect of scalar quantization on float32 vector data?

Accepted Answer

It compresses float32 vectors to int8 integers, reducing memory usage by approximately 75%. Scalar quantization in Azure AI Search compresses each float32 component of a vector into an 8-bit integer (int8), reducing storage from 4 bytes to 1 byte per dimension — roughly a 75% memory reduction. This allows larger vector indexes to fit in memory and lowers cost, with only a small recall degradation that is typically acceptable for most RAG workloads.

Answer

It increases vector dimensions from 1536 to 3072 to improve accuracy

Answer

It eliminates the need for an HNSW graph structure

Answer

It converts vectors into plain text strings for keyword indexing

Question 8

You are architecting an asynchronous machine learning inference pipeline. Which TWO Azure services allow you to decouple event publishers from event consumers using a publish-subscribe (pub/sub) pattern? Each correct answer represents a valid pub/sub architecture service.

Accepted Answer

Azure Event Grid. Azure Event Grid (A) is correct because it is a fully managed event-routing service that implements the pub/sub pattern: publishers emit events to topics and multiple subscribers receive them via event subscriptions with filters, enabling full decoupling of producers and consumers. Azure Service Bus Topics (E) is correct because a topic supports the publish-subscribe model where each subscriber creates its own subscription and receives a copy of every message, providing decoupled, asynchronous delivery with features like filters and sessions. Azure Notification Hubs (B) is a push-notification broadcast service for mobile devices, not a general event pub/sub backbone for decoupling publishers and consumers. Azure Storage Queues (C) implements point-to-point queue messaging where each message is consumed by a single receiver, not a fan-out pub/sub pattern. Azure Event Hubs Capture (D) is a feature that automatically persists streaming data to Blob Storage or Data Lake, not a pub/sub decoupling service.

Answer

Azure Notification Hubs

Answer

Azure Storage Queues

Answer

Azure Event Hubs Capture

Question 9

You are designing an enterprise event-driven architecture where microservices across different Azure subscriptions need to subscribe to domain events published by a central Order Service. Which Azure Event Grid architecture should you implement?

Accepted Answer

Deploy an Azure Event Grid Event Domain and create event subscriptions under the domain for each consuming team.. Azure Event Grid Event Domains are purpose-built for multi-tenant, multi-subscription event distribution scenarios. An Event Domain acts as a namespace that can host thousands of topics, allowing each consuming team or subscription to create its own event subscriptions under the domain without the publisher needing to manage individual topics per consumer. This decouples the central Order Service from consumer onboarding and scales cleanly across subscriptions.

Answer

Deploy an Azure Service Bus relay across all subscriptions.

Answer

Create individual Event Hubs namespaces in every consumer subscription and peer them via ExpressRoute.

Answer

Use Azure Storage Queues shared via SAS URLs across subscriptions.

Question 10

You want to ensure that no AI services can be created in unauthorized Azure regions across your entire subscription. Which Azure governance tool should you use to enforce this restriction?

Accepted Answer

Azure Policy with the 'Allowed locations' definition. Azure Policy with the built-in 'Allowed locations' definition restricts resource creation to approved Azure regions at the subscription or management group scope, enforcing the restriction across all AI services. Assigning this policy denies deployments in unauthorized regions.

Answer

Azure Monitor action groups

Answer

Azure Cost Management budgets

Answer

Azure Security Center JIT access

Question 11

You have an AI model container hosted in Azure Container Registry. You want to ensure that every container image pushed to the registry is automatically scanned for known vulnerabilities before deployment. Which ACR feature should you enable?

Accepted Answer

Microsoft Defender for Cloud vulnerability scanning. Microsoft Defender for Cloud vulnerability scanning is correct because it provides integrated image vulnerability assessment for Azure Container Registry, automatically scanning images on push and continuously re-scanning for newly disclosed CVEs. Enabling the Defender for Containers plan surfaces scan results in Defender for Cloud and can gate deployments via Azure Policy. This directly satisfies the requirement to scan every pushed image before deployment.

Answer

ACR Tasks auto-purge

Answer

Content Trust

Answer

ACR geo-replication

Question 12

You are deploying a web application container to Azure Container Apps and want to enable external HTTPS traffic. Which ingress setting must you configure?

Accepted Answer

Enable ingress with external traffic permitted. To expose a Container App to the public internet over HTTPS, you must enable ingress and set it to accept external traffic. Container Apps then provisions a fully qualified domain name (FQDN) and a managed TLS certificate automatically, terminating HTTPS at the ingress layer. Without external ingress enabled, the app is only reachable inside the environment.

Answer

Set target port to 80 and protocol to TCP

Answer

Disable ingress entirely

Answer

Configure internal ingress only

Question 13

Your AI processing pipeline requires high-throughput streaming ingestion and retention of telemetry data. Which THREE features or capabilities are native to Azure Event Hubs? Each correct answer represents a complete capability.

Accepted Answer

Event Hubs Capture for automatically batching and saving stream data to Azure Storage. Option A is correct because Event Hubs Capture is a native feature that automatically batches streaming data and writes it to Azure Blob Storage or Azure Data Lake Storage (in Avro format) based on a time or size window, satisfying the retention requirement without custom code. Option C is correct because Consumer Groups are a native Event Hubs construct that lets multiple independent applications each maintain their own offset and read the same event stream independently, which is essential for multiple downstream consumers. Option D is correct because Event Hubs partitions the stream and allows multiple receivers to process partitions in parallel, which is the foundation of its high-throughput streaming ingestion and parallel processing model. Option B is not correct because Event Hubs does not natively push events via webhooks for serverless triggers; that pattern belongs to Event Grid, whereas Event Hubs uses AMQP/Kafka pull-based consumption. Option E is not correct because automatic dead-lettering based on a MaxDeliveryCount threshold is a Service Bus queue/subscription feature, not a native Event Hubs capability.

Answer

Native webhook push delivery for discrete serverless event triggers

Answer

Automatic dead-lettering of messages exceeding a MaxDeliveryCount threshold

Question 14

Your AI ingestion pipeline ingests millions of clickstream events per second from IoT devices and streams them into an Azure ML training pipeline. Which Azure service is specifically designed for high-throughput, low-latency telemetry ingestion at this scale?

Accepted Answer

Azure Event Hubs. Azure Event Hubs is designed for high-throughput, low-latency ingestion of telemetry data, capable of handling millions of events per second. It is optimized for streaming scenarios like IoT telemetry and clickstream data, making it ideal for this use case.

Answer

Azure Notification Hubs

Answer

Azure Event Grid

Answer

Azure Service Bus Queues

Question 15

You are designing an application that requires low-latency vector search for a high-traffic AI chatbot. You need to ensure the vector index remains performant as the dataset grows into millions of documents. Which index configuration in Azure AI Search should you implement to optimize for speed over absolute recall accuracy?

Accepted Answer

HNSW. HNSW (Hierarchical Navigable Small World) is a graph-based approximate nearest neighbor (ANN) algorithm that builds a multi-layer navigable graph, delivering sub-linear query latency with high recall. In Azure AI Search, HNSW is the recommended index configuration for high-traffic, low-latency vector search over millions of documents when you can trade a small amount of recall for speed.

Answer

Flat Indexing

Answer

Exhaustive KNN

Answer

Partitioned Indexing

Question 16

You are designing the data architecture for an AI-powered document search application. You choose Azure AI Search because you need multi-lingual support, faceted navigation, and vector search. What is the maximum number of vector fields allowed per index in Azure AI Search?

Accepted Answer

Multiple vector fields are supported per index. Azure AI Search supports multiple vector fields per index, allowing you to store and query different embeddings (e.g., text, image, or multi-model vectors) within the same index. Each vector field is defined with its own dimensions and similarity metric, and you can target specific fields in vector queries. This flexibility is essential for hybrid and multi-modal search scenarios.

Answer

Exactly one vector field per index

Answer

A maximum of two vector fields

Answer

Vector fields are not supported in Azure AI Search

Question 17

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

Accepted Answer

Customer-managed keys (CMK) stored in Azure Key Vault. Customer-managed keys (CMK) in Azure Key Vault let you supply your own encryption key that Azure OpenAI uses for data-at-rest encryption, and you control rotation and revocation through Key Vault. This satisfies the requirement for organization-controlled, rotatable encryption keys for stored data.

Answer

Client-side encryption using PGP keys before sending HTTP payloads

Answer

Azure Information Protection sensitivity labels applied via Microsoft Purview

Answer

Transparent Data Encryption (TDE) configured via SQL Server Management Studio

Question 18

Your team is choosing between using Azure AI Search or Cosmos DB for NoSQL for a new project. Which TWO factors are key considerations that favor Azure AI Search?

Accepted Answer

Need for deep integration with full-text search (BM25) and hybrid search.. Option A is correct because Azure AI Search is purpose-built as a search engine that natively supports full-text search using the BM25 ranking algorithm as well as hybrid search that combines keyword and vector queries, which Cosmos DB for NoSQL does not provide out of the box. Option D is correct because Azure AI Search includes built-in semantic re-ranking (semantic ranker/L2 reranking) that reorders results using deep-learning models to improve relevance and accuracy, a capability Cosmos DB for NoSQL lacks natively. Option B is not a factor favoring Azure AI Search, since petabyte-scale storage is a strength of Cosmos DB for NoSQL rather than a search service. Option C is not a factor favoring Azure AI Search, because high-frequency transactional ACID updates to metadata are handled by Cosmos DB for NoSQL's transactional capabilities, not by a search index. Option E is not a factor favoring Azure AI Search, as lowest possible database-level latency is a characteristic of Cosmos DB for NoSQL's globally distributed, low-latency data plane rather than the search service.

Answer

Requirement to store petabytes of data.

Answer

Requirement for high-frequency transactional ACID updates to metadata.

Answer

Need for lowest possible latency at the database level.

Question 19

An application publishes custom events to an Azure Event Grid topic. You want to inspect the dead-lettered events that failed delivery after the maximum retry period. Where must you configure the dead-letter destination?

Accepted Answer

Azure Blob Storage container. Event Grid dead-lettering requires an Azure Blob Storage container as the destination, configured on the event subscription. When an event fails all delivery retries (default 30 attempts over 24 hours), it is written to that container as a blob so you can inspect and reprocess it. Blob Storage is the only supported dead-letter target for Event Grid.

Answer

Azure SQL Database table

Answer

Local App Service temporary file system

Answer

Azure Service Bus Dead-Letter Queue

Question 20

You need to restrict access to an Azure OpenAI resource so that only requests originating from a specific Azure Virtual Network are permitted. What should you configure?

Accepted Answer

Configure the Azure OpenAI resource networking settings to allow access from 'Selected networks' and add your Virtual Network subnet.. Virtual network rules (service endpoints or private endpoints) on the Azure OpenAI firewall can restrict access to specific VNets.

Answer

Enable Cross-Origin Resource Sharing (CORS) and specify the VNet IP range.

Answer

Assign the Cognitive Services Contributor role to the Virtual Network principal.

Answer

Enable Microsoft Defender for Cloud on the Virtual Network.