AI-200 Security And Observability Practice Test 2 — 15 Questions

Question 1

Your development team wants to trace downstream calls made by a Semantic Kernel agent to Azure OpenAI and an external plugin. Which SDK package and feature should you integrate into your .NET application?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure Application Insights telemetry via the Microsoft.ApplicationInsights.AspNetCore NuGet package and enable dependency tracking.. Application Insights, integrated via the Microsoft.ApplicationInsights.AspNetCore NuGet package, provides automatic dependency tracking that captures outbound HTTP calls, including those made by Semantic Kernel to Azure OpenAI and external plugins. This telemetry is sent to Azure Monitor and visualized in the Application Insights resource, enabling distributed tracing across the agent's downstream calls. The SDK's dependency tracking module instruments HttpClient and other libraries, so no custom code is needed to trace these calls.

Answer

Use Azure Event Grid to capture telemetry events published by Semantic Kernel.

Answer

Configure Azure Monitor Workspace and collect Prometheus metrics from the application.

Answer

Write custom middleware to log every prompt and response to Azure Blob Storage.

Question 2

You are configuring network security for an Azure Machine Learning workspace. Compute instances must be accessible via Jupyter Lab, but no public IP addresses can be associated with the compute instances. Which configuration is required?

Accepted Answer

Create the compute instance with no public IP and configure a private endpoint for the workspace, accessing via Azure Bastion or workspace workspace-managed network isolation.. To allow Jupyter Lab access to a compute instance with no public IP, you create the compute instance without a public IP, configure a private endpoint for the workspace (or use workspace-managed network isolation), and access it through Azure Bastion or a VPN/ExpressRoute connection. This preserves private-only connectivity while enabling browser-based Jupyter access.

Answer

Use ExpressRoute with public peering to route traffic directly to the compute instance public IP.

Answer

Deploy the compute instance in a public subnet with Network Security Group (NSG) rules blocking port 22.

Answer

Enable Azure Firewall with DNAT rules routing traffic to the compute instance public IP.

Question 3

You are investigating performance degradation in an Azure AI Search vector search index. You need to run a Kusto Query Language (KQL) query in Application Insights to analyze dependency durations for search queries. Which table should you query?

Accepted Answer

Query the 'traces' table where message contains 'SearchLatency'.. Dependencies in Application Insights are stored in the 'dependencies' table, which records outgoing HTTP calls to Azure AI Search.

Question 4

Which TWO Azure services or features can be used to securely store and reference secrets such as connection strings for an Azure AI Search service without hardcoding them?

Accepted Answer

Managed Identities. Azure Key Vault (option B) is the dedicated Azure service for securely storing and centrally managing secrets such as connection strings, API keys, and certificates, and applications can reference these secrets at runtime via the Key Vault SDK or REST API instead of hardcoding them. Managed Identities (option A) complement Key Vault by providing an automatically managed identity in Microsoft Entra ID for the Azure resource, allowing it to authenticate to Key Vault (via RBAC or access policies) without embedding credentials in code, thus enabling secure secret retrieval. Together they form the recommended pattern for eliminating hardcoded connection strings. Option C is wrong because Azure Blob Storage public containers expose data anonymously and are not a secrets store. Option D is wrong because unencrypted plain-text variable groups provide no protection for sensitive values. Option E is wrong because local application configuration JSON files typically store secrets in cleartext and are not a secure, centralized secret-management mechanism.

Answer

Azure Blob Storage public containers

Answer

Azure DevOps variable groups with unencrypted plain text

Answer

Local application configuration JSON files

Question 5

When troubleshooting performance issues in an enterprise Azure OpenAI deployment using Application Insights, which TWO Kusto Query Language (KQL) queries or techniques help identify slow model responses?

Accepted Answer

Querying the 'availabilityResults' table for ping test response codes.. Querying the 'dependencies' table for slow durations and inspecting custom dimensions or request items are effective techniques.

Answer

Querying the 'performanceCounters' table for CPU usage.

Question 6

Which TWO roles are commonly assigned when granting a managed identity access to consume Azure OpenAI services via Azure RBAC?

Accepted Answer

Cognitive Services OpenAI User. Option C, Cognitive Services OpenAI User, is correct because it is the least-privilege Azure RBAC role specifically scoped to Azure OpenAI data-plane operations such as invoking chat completions, embeddings, and completions endpoints, and it is the role Microsoft recommends for managed identities consuming Azure OpenAI. Option E, Cognitive Services User, is also correct because it grants data-plane access to Cognitive Services accounts including Azure OpenAI, allowing the managed identity to call the service's inference APIs when a broader Cognitive Services role is acceptable. The unmarked options do not belong: Key Vault Secrets Officer (A) only manages secrets in Key Vault, Virtual Machine Contributor (B) only manages VM resources and grants no data-plane access to Azure OpenAI, and Storage Blob Data Reader (D) only reads blob data and is irrelevant to Azure OpenAI consumption.

Answer

Key Vault Secrets Officer

Answer

Virtual Machine Contributor

Answer

Storage Blob Data Reader

Question 7

Your production Azure Machine Learning inference endpoint is failing due to unauthorized access attempts. You decide to use Managed Identities to secure the connection to an Azure Key Vault. What is the correct sequence of operations to ensure the scoring script can retrieve secrets?

Accepted Answer

Enable a System-assigned Managed Identity on the endpoint and grant the identity the Key Vault Secrets User role.. You must enable the system-assigned managed identity on the Managed Online Endpoint and then grant that identity 'Get' permissions on the Key Vault access policy.

Answer

Grant the Azure Machine Learning workspace identity contributor access to the entire Key Vault resource.

Answer

Assign the endpoint a Service Principal secret and store it in the environment variables of the scoring script.

Answer

Create a User-assigned Managed Identity and manually inject the OAuth token into the request header.

Question 8

You are monitoring a custom AI application using Application Insights. You need to track the duration of specific LLM prompt processing calls. Which telemetry type should you use to record this performance data?

Accepted Answer

Dependency telemetry. Dependencies are used to track calls to external services like APIs, databases, or LLM endpoints, making them ideal for tracking processing duration.

Answer

Trace telemetry

Answer

Request telemetry

Answer

Custom Metrics

Question 9

You need to ensure that PII (Personally Identifiable Information) detected in your AI application logs is automatically masked before it is persisted in Log Analytics. What is the recommended approach?

Accepted Answer

Implement an ITelemetryProcessor in the application SDK.. The correct approach is to implement an ITelemetryProcessor in the application SDK. This allows you to intercept telemetry items before they are sent to Application Insights (which persists to Log Analytics) and apply custom masking logic to PII. Since the masking occurs in-process, it ensures that sensitive data never leaves the application in an unmasked form, satisfying the requirement to mask before persistence.

Answer

Enable PII masking in the Azure OpenAI resource settings.

Answer

Use Azure Policy to deny logs containing specific patterns.

Answer

Configure a Log Analytics Data Collection Rule (DCR) to filter logs.

Question 10

You want to monitor the health of your AI services. Which TWO of the following can be configured to alert you automatically when model latency exceeds a predefined threshold? (Choose TWO)

Accepted Answer

Azure Monitor Metric Alerts.. Azure Monitor Alerts and Log Analytics alerts can both be configured to trigger based on threshold conditions for AI service metrics.

Answer

Azure Resource Graph alerts.

Answer

Azure Advisor alerts.

Answer

Microsoft Defender for Cloud alerts.

Question 11

You are deploying an AI application on Azure Kubernetes Service (AKS) that pulls a container image from Azure Container Registry (ACR). You want to avoid using ACR admin credentials or storing a service principal secret in a Kubernetes secret. Which authentication method should you use?

Accepted Answer

Use the AKS kubelet managed identity and assign it the AcrPull role on the ACR.. The kubelet managed identity is automatically created when you create an AKS cluster with a managed identity. Assigning it the AcrPull role on the ACR allows the nodes to pull images without credentials. This is the standard, secure integration between AKS and ACR, eliminating the need for secrets.

Answer

Attach an ACR managed identity to the AKS cluster and grant it the AcrPull role.

Answer

Enable anonymous pull on the ACR and configure the AKS cluster to pull images without authentication.

Answer

Create a Kubernetes secret containing the ACR admin username and password and reference it in the pod spec.

Question 12

You are developing a Python application that uses the Azure AI Document Intelligence SDK. The application is deployed to an Azure Container Instance. You need to ensure that the application can authenticate to the Document Intelligence resource using a managed identity, and that the identity has the minimum necessary permissions. Which of the following should you do?

Accepted Answer

Assign the 'Cognitive Services User' role to the managed identity at the Document Intelligence resource scope.. To authenticate with managed identity, the client (Container Instance) must have a managed identity, and that identity must be granted the appropriate data-plane role on the target resource. The 'Cognitive Services User' role provides the necessary permissions to call Document Intelligence APIs without granting broader management rights. Assigning at the resource scope follows least privilege.

Answer

Enable a system-assigned managed identity on the Document Intelligence resource and grant it access to the Container Instance.

Answer

Assign the 'Contributor' role to the managed identity at the subscription scope.

Answer

Use the Document Intelligence account key in the application configuration and store it in Azure Key Vault.

Question 13

You have an Azure AI Search service that indexes sensitive data. You need to ensure that only authenticated users from your corporate Microsoft Entra ID tenant can query the search index. You also want to enforce that queries are encrypted in transit and that the service rejects any HTTP requests. Which combination of configurations should you implement?

Accepted Answer

Enable role-based access control (RBAC) for the search service, require HTTPS, and disable API key authentication.. To restrict access to authenticated Microsoft Entra ID users, enable RBAC and disable API key authentication. Requiring HTTPS ensures encryption in transit. This combination enforces user-level authentication and encryption, meeting all requirements.

Answer

Configure IP firewall rules to allow only your corporate network, require HTTPS, and use API keys for authentication.

Answer

Enable private endpoints, require HTTPS, and use API keys for authentication.

Answer

Enable Microsoft Entra ID authentication, disable HTTPS, and use API keys for authentication.

Question 14

You are monitoring an Azure AI solution that uses Azure OpenAI and Azure Machine Learning. You need to set up alerts for security-related events. Which TWO actions should you include in your alerting strategy? (Choose two.)

Accepted Answer

Set up an alert for failed authentication attempts to Azure Machine Learning using Azure Monitor logs.. Alerting on API key regeneration and failed authentication attempts helps detect potential security breaches. These events indicate unauthorized access or credential compromise. Other options are either not security-focused or generate noise without clear security value.

Answer

Create an alert that triggers when the Azure OpenAI resource is deleted.

Answer

Configure an alert for high CPU usage on the Azure Machine Learning compute cluster.

Answer

Create an alert rule in Azure Monitor that triggers when a managed identity is assigned to a resource.

Question 15

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?

Accepted Answer

Azure Key Vault Provider for Secrets Store CSI Driver with Azure AD Workload Identity. The Azure Key Vault Provider for Secrets Store CSI Driver mounts Key Vault secrets directly into pods as volumes, and when combined with Microsoft Entra ID Workload Identity, the pod authenticates to Key Vault using a federated Kubernetes service account token — no stored credentials, connection strings, or environment variables. This is the recommended credential-less pattern for AKS.

Answer

Kubernetes Service Account tokens mapped to Key Vault access policies via static connection strings

Answer

A Kubernetes CronJob that pulls keys from Key Vault and creates sealed secrets

Answer

Azure Container Instances virtual nodes with managed system-assigned identities