AI-200 Security And Observability — 10 Questions

Question 1

When troubleshooting performance issues in an enterprise Azure OpenAI deployment using Application Insights, which TWO Kusto Query Language (KQL) queries or techniques help identify slow model responses?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Querying the 'availabilityResults' table for ping test response codes.. Querying the 'dependencies' table for slow durations and inspecting custom dimensions or request items are effective techniques.

Answer

Querying the 'performanceCounters' table for CPU usage.

Question 2

An enterprise AI application experiences intermittent HTTP 429 (Too Many Requests) errors when calling Azure OpenAI Service during peak hours. You need to analyze the exact token consumption trends and throttling patterns over the past week. Where should you look first in Azure Monitor?

Accepted Answer

Azure Monitor Metrics explorer, charting 'Processed Tokens' and 'Token Generation' metrics filtered by deployment name. Metrics explorer in Azure Monitor allows you to query metrics such as 'Processed Prompts' and 'Tokens' for Azure OpenAI, categorized by dimensions like model deployment name, to diagnose throttling.

Answer

Log Analytics workspace querying the AzureActivity table for throttling events

Answer

Azure Cost Management and Billing dashboard for daily spend trends

Answer

Application Insights availability tests configured with a 5-minute frequency

Question 3

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?

Accepted Answer

Azure Key Vault Provider for Secrets Store CSI Driver with Azure AD Workload Identity. Azure Key Vault Provider for Secrets Store CSI Driver allows AKS to get secrets stored in Key Vault using Azure AD Workload Identity, mounting them directly as volumes or syncing them as Kubernetes secrets securely.

Answer

Kubernetes Service Account tokens mapped to Key Vault access policies via static connection strings

Answer

A Kubernetes CronJob that pulls keys from Key Vault and creates sealed secrets

Answer

Azure Container Instances virtual nodes with managed system-assigned identities

Question 4

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

Accepted Answer

Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search. Azure RBAC using managed identities allows the App Service to authenticate to Azure AI Search securely via Azure Active Directory tokens without using admin API keys.

Answer

Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service

Answer

Store the primary admin API key in Azure App Service configuration environment variables

Answer

Use shared access signatures (SAS) tokens generated by a client script

Question 5

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

Accepted Answer

Azure Cost Management Budgets with alert conditions. Azure Cost Management budgets allow you to set monetary or usage thresholds and configure automated alert notifications when thresholds are approached or exceeded.

Answer

Azure Advisor cost recommendations

Answer

Azure Monitor autoscale settings

Answer

Azure Service Health alerts

Question 6

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

Accepted Answer

Application Insights. Application Insights, a feature of Azure Monitor, provides comprehensive application performance management and telemetry tracking for live web and AI applications.

Answer

Azure Advisor

Answer

Microsoft Defender for Cloud

Answer

Azure Policy

Question 7

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Accepted Answer

Azure Private Link with a private endpoint for the Azure OpenAI resource. Configuring private endpoints via Azure Private Link allows secure access from a peered virtual network using a private IP address from the VNet's address space, while public network access can be completely disabled.

Answer

Service endpoints with default deny rules on the public firewall

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Bastion deployed in the management subnet

Question 8

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

Accepted Answer

Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace. Diagnostic settings in Azure Monitor allow you to route platform logs and metrics to a Log Analytics workspace, Event Hubs, or Azure Storage account.

Answer

Enable Application Insights dependency tracking on the subscription level via Azure Policy

Answer

Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints

Answer

Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances

Question 9

You have a custom machine learning model deployed as a managed online endpoint in Azure Machine Learning. You need to ensure that scoring requests made to the endpoint are encrypted in transit and that client authentication is enforced using JSON Web Tokens (JWT). What authentication method does the managed online endpoint support by default?

Accepted Answer

Token-based authentication using Azure AD access tokens and key-based authentication. Managed online endpoints in Azure Machine Learning support key-based authentication and Azure Active Directory (Azure AD) token-based authentication out of the box.

Answer

Shared Access Signatures (SAS) tokens generated from Azure Blob Storage accounts

Answer

Basic HTTP authentication with plain-text username and password headers

Answer

Anonymous access with rate limiting enabled via network security groups

Question 10

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

Accepted Answer

Customer-managed keys (CMK) stored in Azure Key Vault. Customer-managed keys (CMK) with Azure Key Vault allow you to use your own keys to encrypt data stored in Azure AI services.

Answer

Client-side encryption using PGP keys before sending HTTP payloads

Answer

Azure Information Protection sensitivity labels applied via Microsoft Purview

Answer

Transparent Data Encryption (TDE) configured via SQL Server Management Studio