AI-200 Security And Observability — 15 Questions

Question 1

An enterprise AI application experiences intermittent HTTP 429 (Too Many Requests) errors when calling Azure OpenAI Service during peak hours. You need to analyze the exact token consumption trends and throttling patterns over the past week. Where should you look first in Azure Monitor?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor Metrics explorer, charting 'Processed Tokens' and 'Token Generation' metrics filtered by deployment name. Metrics explorer in Azure Monitor allows you to query metrics such as 'Processed Prompts' and 'Tokens' for Azure OpenAI, categorized by dimensions like model deployment name, to diagnose throttling.

Answer

Log Analytics workspace querying the AzureActivity table for throttling events

Answer

Azure Cost Management and Billing dashboard for daily spend trends

Answer

Application Insights availability tests configured with a 5-minute frequency

Question 2

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?

Accepted Answer

Azure Key Vault Provider for Secrets Store CSI Driver with Azure AD Workload Identity. Azure Key Vault Provider for Secrets Store CSI Driver allows AKS to get secrets stored in Key Vault using Azure AD Workload Identity, mounting them directly as volumes or syncing them as Kubernetes secrets securely.

Answer

Kubernetes Service Account tokens mapped to Key Vault access policies via static connection strings

Answer

A Kubernetes CronJob that pulls keys from Key Vault and creates sealed secrets

Answer

Azure Container Instances virtual nodes with managed system-assigned identities

Question 3

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

Accepted Answer

Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search. Azure RBAC using managed identities allows the App Service to authenticate to Azure AI Search securely via Azure Active Directory tokens without using admin API keys.

Answer

Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service

Answer

Store the primary admin API key in Azure App Service configuration environment variables

Answer

Use shared access signatures (SAS) tokens generated by a client script

Question 4

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

Accepted Answer

Azure Cost Management Budgets with alert conditions. Azure Cost Management budgets allow you to set monetary or usage thresholds and configure automated alert notifications when thresholds are approached or exceeded.

Answer

Azure Advisor cost recommendations

Answer

Azure Monitor autoscale settings

Answer

Azure Service Health alerts

Question 5

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

Accepted Answer

Application Insights. Application Insights, a feature of Azure Monitor, provides comprehensive application performance management and telemetry tracking for live web and AI applications.

Answer

Azure Advisor

Answer

Microsoft Defender for Cloud

Answer

Azure Policy

Question 6

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Accepted Answer

Azure Private Link with a private endpoint for the Azure OpenAI resource. Configuring private endpoints via Azure Private Link allows secure access from a peered virtual network using a private IP address from the VNet's address space, while public network access can be completely disabled.

Answer

Service endpoints with default deny rules on the public firewall

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Bastion deployed in the management subnet

Question 7

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

Accepted Answer

Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace. Diagnostic settings in Azure Monitor allow you to route platform logs and metrics to a Log Analytics workspace, Event Hubs, or Azure Storage account.

Answer

Enable Application Insights dependency tracking on the subscription level via Azure Policy

Answer

Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints

Answer

Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances

Question 8

You have a custom machine learning model deployed as a managed online endpoint in Azure Machine Learning. You need to ensure that scoring requests made to the endpoint are encrypted in transit and that client authentication is enforced using JSON Web Tokens (JWT). What authentication method does the managed online endpoint support by default?

Accepted Answer

Token-based authentication using Azure AD access tokens and key-based authentication. Managed online endpoints in Azure Machine Learning support key-based authentication and Azure Active Directory (Azure AD) token-based authentication out of the box.

Answer

Shared Access Signatures (SAS) tokens generated from Azure Blob Storage accounts

Answer

Basic HTTP authentication with plain-text username and password headers

Answer

Anonymous access with rate limiting enabled via network security groups

Question 9

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

Accepted Answer

Customer-managed keys (CMK) stored in Azure Key Vault. Customer-managed keys (CMK) with Azure Key Vault allow you to use your own keys to encrypt data stored in Azure AI services.

Answer

Client-side encryption using PGP keys before sending HTTP payloads

Answer

Azure Information Protection sensitivity labels applied via Microsoft Purview

Answer

Transparent Data Encryption (TDE) configured via SQL Server Management Studio

Question 10

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

Accepted Answer

Azure Monitor metric alerts with an action group. Azure Monitor metric alerts allow you to monitor resource metrics like CPU utilization and trigger alert actions such as sending emails when conditions are met.

Answer

Azure Cost Management anomaly alerts

Answer

Azure Policy remediation tasks

Answer

Azure Service Health planned maintenance alerts

Question 11

Your team is running an AI copilot application that uses Azure OpenAI. To comply with data residency regulations, you need to verify that prompts and completions are processed entirely within a specific Azure region and that no data is persisted outside that region. Where can you verify regional data processing and residency commitments?

Accepted Answer

Azure OpenAI service compliance terms and data residency documentation in the Azure Trust Center. Microsoft's Trust Center and Azure Compliance Documentation, along with service-level data residency specifications in the Azure OpenAI documentation, outline data processing and storage locations.

Answer

Azure Resource Graph queries filtering by region

Answer

Azure Monitor geographic latency metrics dashboard

Answer

Application Insights dependency maps

Question 12

You are troubleshooting a Python application that fails to connect to Azure Key Vault using a managed identity. You want to inspect the exact exception stack trace and identify whether the managed identity token request failed. Where should you look in your local development or cloud diagnostics?

Accepted Answer

Application Insights exceptions and traces tables in the Log Analytics workspace. Application Insights logs exceptions and dependency tracking, capturing authentication failures when attempting to acquire tokens for Azure services.

Answer

Azure Security Center threat detection alerts

Answer

Azure Key Vault access policies audit logs

Answer

Azure Advisor cost optimization recommendations

Question 13

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

Accepted Answer

IP firewall rules and virtual network service rules on the backend services restricting access to App Service. Network service tags and IP firewalls on Azure Cosmos DB and Azure OpenAI restrict access to only allow incoming traffic from the specific outbound IP addresses or virtual network subnet of the App Service.

Answer

Disabling managed identities across all application components

Answer

Configuring Azure Front Door with SSL offloading only

Answer

Enabling public anonymous access with client-side rate limiting

Question 14

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

Accepted Answer

azure-identity package with DefaultAzureCredential and azure-keyvault-secrets. The azure-identity library provides DefaultAzureCredential, which automatically tries multiple authentication methods (managed identity, environment variables, Azure CLI) in order without hardcoding secrets.

Answer

pyodbc with direct ODBC connection strings containing embedded passwords

Answer

azure-storage-blob with StorageSharedKeyCredential initialized with plain-text keys

Answer

requests library making direct REST calls with master subscription keys

Question 15

You need to analyze log queries across multiple AI applications and infrastructure components to identify custom performance bottlenecks. Which query language is used in Azure Monitor Log Analytics to write queries against collected log data?

Accepted Answer

Kusto Query Language (KQL). Kusto Query Language (KQL) is the query language used to retrieve and analyze data in Azure Monitor Log Analytics.

Answer

GraphQL

Answer

SQL Server Transact-SQL (T-SQL)

Answer

Azure Resource Graph Query (ARGQL)