AI-200 Timed Hard Questions — 25 Difficult Questions

Question 1

You are deploying a custom AI model container to Azure Container Apps. The container listens on port 8080 and requires health probes to verify readiness before routing traffic. How should you configure the probes?

15 minute time limit — choose an answer to begin.

Accepted Answer

Configure an HTTP readiness probe targeting port 8080 on your health check endpoint. Azure Container Apps supports liveness, readiness, and startup probes configured via HTTP, TCP, or gRPC.

Answer

Configure an Azure Front Door health probe pointing to the internal container IP

Answer

Configure a TCP liveness probe pointing to port 22 for SSH management

Answer

Configure a startup probe that restarts the container if CPU usage drops below 5 percent

Question 2

You are debugging a network connectivity issue between two pods in AKS. Which command helps you check if the service endpoint is reachable?

Accepted Answer

kubectl exec -it <pod> -- /bin/sh.. Using 'kubectl debug' or a temporary container with network tools (like 'curl' or 'nslookup') is the standard way to test internal network paths.

Answer

kubectl cluster-info.

Answer

kubectl get services.

Answer

kubectl top pods.

Question 3

You are designing a high-performance AI inference architecture on Azure Kubernetes Service (AKS). Which THREE AKS features or configurations should you incorporate to optimize performance and resource utilization? (Choose three.)

Accepted Answer

Cluster Autoscaler to automatically scale node pool size based on pending pod demands. Optimizing AKS for AI workloads includes utilizing GPU-optimized node pools, node taint/tolerations to dedicate nodes to AI tasks, and cluster autoscaler for dynamic scaling.

Answer

Running all pods exclusively on single-core, low-memory burstable VMs (B-series)

Answer

Disabling the Kubernetes scheduler to manually place every container instance

Question 4

You are configuring GPU time-slicing on an AKS cluster to maximize GPU utilization for multiple lightweight AI inference containers sharing a single NVIDIA A100 GPU. Where must you define the time-slicing configuration profile?

Accepted Answer

A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset. GPU time-slicing in AKS is configured using a ConfigMap that defines replica counts per GPU device, which is then applied to the cluster.

Answer

Inside the Dockerfile of each individual AI container

Answer

Via Azure Container Apps workload profiles configuration

Answer

In the Azure portal under AKS cluster node pool properties

Question 5

You are configuring TLS termination for an AI model API hosted in Azure Container Apps using a custom domain name. Where must you upload or configure the custom SSL certificate?

Accepted Answer

In the Container App custom domains settings using a Key Vault reference or uploaded certificate. Custom domain certificates in Azure Container Apps are managed via the custom domains and certificates blade of the Container App resource.

Answer

In the Azure Container Registry webhook configuration

Answer

Inside the container image filesystem under /etc/ssl/certs

Answer

On the underlying Azure Container Instances node pool

Question 6

You are setting up image builds for a multi-architecture (AMD64 and ARM64) AI model container using Azure Container Registry Tasks. Which command or feature should you use to build images for both architectures simultaneously?

Accepted Answer

az acr build with a multi-step task or docker buildx configuration. ACR Tasks support multi-architecture builds using Docker buildx commands within a task definition file or quick task execution.

Answer

Azure DevOps pipeline running docker push directly

Answer

az aks create with --node-os-sku

Answer

az acr import

Question 7

You are configuring enterprise networking for an AKS cluster running sensitive AI models. Which THREE networking features should you implement for cluster security?

Accepted Answer

Azure Firewall or user-defined routes for outbound egress filtering. Securing AKS network traffic involves Azure CNI network policies, private cluster API server endpoints, and outbound traffic filtering via Azure Firewall.

Answer

Public IP assignment to every worker node

Answer

Disabling all internal kube-dns resolution

Question 8

You are troubleshooting high latency in an AI inference workload on AKS. You suspect the issue is caused by container startup time (cold starts). Which feature helps mitigate this?

Accepted Answer

Azure Container Registry Artifact Streaming.. Image Pull Secrets and ACR 'Artifact Streaming' (or pre-pulling images) are designed to reduce startup latency.

Answer

Configuring Vertical Pod Autoscaler.

Answer

Increasing the memory limit for the pod.

Answer

Using a smaller base OS distribution.

Question 9

You are running a distributed AI training job on AKS using MPI. Which network configuration is critical for performance?

Accepted Answer

Enable Azure Accelerated Networking on the node pool.. For distributed training, high-bandwidth/low-latency networking like InfiniBand or Azure Accelerated Networking is required.

Answer

Use an internal VNET peering.

Answer

Enable standard load balancing.

Answer

Disable the pod network policy.

Question 10

You are designing a secure MLOps pipeline using Azure Container Registry. Which THREE practices should you implement to secure your AI container images?

Accepted Answer

Use managed identities instead of admin credentials for registry authentication. Securing container images in ACR involves vulnerability scanning, access control with managed identities, and content signing.

Answer

Disable role-based access control (RBAC) on the registry to simplify management

Answer

Enable anonymous pull access for all public developers

Question 11

You are configuring authentication between an Azure Container App running an AI model and an Azure OpenAI resource. To adhere to security best practices, you must avoid storing API keys in environment variables or code. How should you configure this?

Accepted Answer

Configure a system-assigned managed identity on the Container App and grant it Cognitive Services OpenAI User role on the Azure OpenAI resource. Managed identities allow Azure resources to authenticate to services supporting Microsoft Entra authentication without embedding credentials.

Answer

Hardcode the secondary endpoint key into the Docker image build arguments

Answer

Enable anonymous public access on the Azure OpenAI resource for internal virtual network traffic

Answer

Store the Azure OpenAI primary key in an Azure Key Vault and reference it via Container App secrets with plain text retrieval

Question 12

You are optimizing resource allocation for a GPU-backed AI model deployment on AKS. Which THREE Kubernetes concepts or objects are essential for managing GPU resources effectively?

Accepted Answer

Resource requests and limits specifying nvidia.com/gpu. Managing GPUs in AKS requires node selectors, resource limits for nvidia.com/gpu, and tolerations for GPU taints.

Answer

Node taints and tolerations for GPU node pools

Answer

Horizontal Pod Autoscaler based on Azure Load Balancer SNAT ports

Answer

Kubernetes persistent volume claims for GPU driver binaries

Question 13

You are configuring an Azure Kubernetes Service (AKS) cluster for enterprise AI workloads. Which THREE practices should you implement to enhance cluster security and isolation? (Choose three.)

Accepted Answer

Configure Microsoft Entra Workload Identity for pod-to-Azure service authentication. Enterprise AKS security best practices include enabling Azure Policy for Kubernetes, using Azure RBAC for Kubernetes authorization, and utilizing Workload Identity for secure credential-less access to Azure services.

Answer

Disable TLS on the API server to improve inter-node communication speed

Answer

Share a single service principal across all namespaces for simplified administration

Question 14

Your containerized AI application requires a specific version of a kernel driver that is not installed on the AKS nodes. What is the most efficient way to manage this?

Accepted Answer

Use a privileged InitContainer to load the driver.. Using an InitContainer with appropriate privileges to install the driver on the host is a common pattern for specific hardware needs.

Answer

Mount the /proc filesystem as read-write.

Answer

Run the application as root.

Answer

Rebuild the AKS cluster.

Question 15

An AKS cluster is configured with KEDA for autoscaling an AI inferencing service based on Azure Queue Storage length. The pods fail to scale. Which component should you inspect first?

Accepted Answer

The ScaledObject resource status.. The ScaledObject is the KEDA custom resource that defines the trigger. If it is misconfigured, the autoscaler will not function.

Answer

The Azure Container Registry webhook settings.

Answer

The Horizontal Pod Autoscaler (HPA) resource directly.

Answer

The Cluster Autoscaler logs.

Question 16

Which THREE of the following items should be configured to ensure your AI workload in AKS is observable?

Accepted Answer

Prometheus and Grafana.. Logging, metrics, and tracing are the three pillars of observability in AKS.

Answer

Azure Backup.

Answer

Azure Bastion.

Question 17

You are containerizing a large language model (LLM) inference API to run in Azure Container Apps. The model weights exceed 15 GB and cause container startup timeouts because the image takes too long to pull from Azure Container Registry (ACR). You need to optimize the container startup performance without reducing the model size. What is the best approach?

Accepted Answer

Enable ACR artifact streaming for the container registry.. ACR artifact streaming allows containers to start immediately by streaming layers on-demand without waiting for the entire image to download locally, significantly reducing cold-start times for large AI container images.

Answer

Upgrade the Azure Container Apps environment to use HTTP/2 protocol.

Answer

Store the model weights in an Azure Blob Storage account and mount them via an ephemeral volume.

Answer

Configure ACR content trust and geo-replication.

Question 18

You are designing a data layer architecture for an enterprise AI assistant that requires high-performance vector search, structured filtering, and multi-tenant isolation. Which THREE design patterns should you consider? (Choose three)

Accepted Answer

Combining vector similarity with metadata filters to narrow search scope. Effective AI data layer design patterns include logical partitioning for multi-tenancy, pre-filtering metadata, and hybrid retrieval combining keyword and vector search.

Answer

Storing all tenant data in a single unindexed JSON blob without partition keys

Answer

Hardcoding all user prompts directly into the search index schema

Question 19

You need to configure network security for an Azure Container Apps environment that hosts an internal AI scoring API. The API must only be reachable from a specific Azure Virtual Network (VNet) and blocked from public internet access. How should you configure the environment?

Accepted Answer

Deploy the Container Apps environment with an internal Virtual Network integration and internal load balancer. Deploying Azure Container Apps with an internal Load Balancer (ILB) restricts ingress to a private IP within an integrated Virtual Network.

Answer

Attach a Private Endpoint to the Azure Container Registry hosting the app

Answer

Enable IP security restrictions on the default public ingress

Answer

Configure an Azure Front Door instance with WAF rules in front of the public endpoint

Question 20

You are troubleshooting intermittent network timeout errors between microservices in an AKS cluster running an AI pipeline. You suspect that network policies are blocking required inter-pod communication. Which CNI plugin must be configured in AKS to enforce these network policies?

Accepted Answer

Azure CNI with Azure Network Policies or Calico enabled. Azure CNI with Azure Network Policies or Calico network policies must be enabled in AKS to enforce namespace and pod-level traffic rules.

Answer

Kubernetes standard kube-proxy in IPVS mode only

Answer

Azure Virtual Network NAT Gateway

Answer

Kubenet basic networking without network policies