AI-200 Security And Observability Practice Test 3 — 15 Questions

Question 1

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud provides continuous security assessments, recommendations, and a secure score across Azure resources.

Answer

Azure Cost Management

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 2

Your application makes frequent calls to Azure AI Document Intelligence. You need to ensure that if a transient network failure or HTTP 503 service unavailable error occurs, the Python SDK automatically retries the failed requests with exponential backoff. How should you initialize the client to support robust retry behavior?

Accepted Answer

Instantiate the client with custom retry policy parameters (e.g., retry_total, retry_backoff_factor). Azure SDK clients include built-in retry policies that can be configured with custom retry intervals, backoff factors, and maximum retry counts during client instantiation.

Answer

Write a custom infinite while loop wrapping every API call without sleep intervals

Answer

Disable all exception handling so the application crashes immediately on error

Answer

Configure Azure Traffic Manager with failover routing priorities

Question 3

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

Accepted Answer

Use the Application Insights TelemetryClient track_metric() method. Using the `track_metric` method of the Application Insights `TelemetryClient` in Python allows you to record custom numerical metrics and send them to Azure Monitor.

Answer

Save the metrics as text files in an Azure Blob Storage account and run hourly KQL queries

Answer

Print JSON strings to standard output and rely on Log Analytics automatic table parsing

Answer

Update Azure Key Vault secrets with the metric values

Question 4

You need to export Azure Monitor metric and log data to an external SIEM solution for security auditing. Which Azure feature should you use to stream this telemetry in real-time to an external Event Hub?

Accepted Answer

Diagnostic settings configured to stream to an Azure Event Hub. Diagnostic settings in Azure Monitor support streaming platform logs and metrics directly to Azure Event Hubs, which can then forward data to external SIEM tools like Splunk or QRadar.

Answer

Azure Backup vault scheduled jobs

Answer

Azure Advisor recommendations export

Answer

Azure Resource Graph queries

Question 5

You are troubleshooting a performance issue in an AI application where dependency calls to Azure OpenAI take significantly longer during periods of high traffic. You want to query Log Analytics to find the 95th percentile (p95) duration of all dependency calls to Azure OpenAI over the past 24 hours. Which KQL query should you execute?

Accepted Answer

dependencies | where timestamp > ago(24h) | where target has 'openai' | summarize p95_duration = percentile(duration, 95) by target. The KQL query uses the dependencies table, filters by target or type, and calculates the percentile using the percentile() aggregation function.

Answer

exceptions | where timestamp > ago(24h) | summarize count() by outerType

Answer

requests | where timestamp > ago(24h) | summarize count() by resultCode

Answer

traces | where timestamp > ago(24h) | summarize avg(severityLevel) by message

Question 6

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Accepted Answer

Azure ExpressRoute or Site-to-Site VPN with Azure Private Link to workspace private endpoints. Azure ExpressRoute or a site-to-site VPN combined with Azure Private Link allows secure, private connectivity from an on-premises network to Azure private endpoints.

Answer

Public IP addresses assigned to all developer workstations with NSG allow rules

Answer

Turning off all network security groups and opening all ports on the Azure firewall

Answer

Azure Bastion deployed on the on-premises physical router

Question 7

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

Accepted Answer

CanNotDelete resource lock. Applying a 'CanNotDelete' resource lock prevents any user from deleting the resource while still allowing read and modify operations.

Answer

ReadOnly resource lock

Answer

Azure Policy deny assignment

Answer

Network Security Group deny rule

Question 8

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

Accepted Answer

Azure Active Directory sign-in logs or AzureDiagnostics table capturing managed identity token requests. Azure Active Directory sign-in logs and MSI (Managed Service Identity) token acquisition telemetry captured via Azure Monitor diagnostic settings (SignInLogs or AzureDiagnostics) record token acquisition attempts and failures.

Answer

Azure Cost Management amortization tables

Answer

Azure Storage blob access audit logs

Answer

Azure Key Vault secret version history

Question 9

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

Accepted Answer

Azure Service Health. Azure Service Health provides a personalized view of Azure service health, planned maintenance, and regional outages affecting your resources.

Answer

Azure Cost Management

Answer

Azure Policy

Answer

Azure Advisor

Question 10

Your enterprise AI solution runs across multiple subscriptions. You want to implement centralized cost allocation tags for all Azure AI resources to ensure every resource is tagged with 'CostCenter' and 'Environment'. Which Azure feature should you use to automatically audit and enforce these tags?

Accepted Answer

Azure Policy with tag governance rules (e.g., 'Inherit a tag from the resource group' or 'Require specified tag'). Azure Policy with 'Modify' or 'Append' effects can enforce tag presence or automatically add required tags during resource creation.

Answer

Application Insights telemetry initializers

Answer

Azure Advisor security rules

Answer

Azure Cost Management budgets

Question 11

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

Accepted Answer

Use DefaultAzureCredential from the azure-identity library to automatically authenticate via the VM's IMDS endpoint. Using the `DefaultAzureCredential` or `ManagedIdentityCredential` from the `azure-identity` package allows the Python code to query the local Azure Instance Metadata Service (IMDS) endpoint to obtain access tokens securely.

Answer

Use static storage account connection strings hardcoded in environment variables

Answer

Make an unauthenticated HTTP GET request to the public Azure OpenAI endpoint with no headers

Answer

Read the plain-text password from a file located in /etc/passwd on the virtual machine

Question 12

You are optimizing costs for an AI workload running on Azure Kubernetes Service (AKS). You notice that GPU node pools are underutilized during weekends. You want to scale down the GPU node pool to 0 nodes on weekends and scale back up on Monday mornings. What Kubernetes native feature or Azure integration should you use?

Accepted Answer

AKS cluster autoscaler configured with node pool scaling profiles down to zero, or Azure Automation runbooks invoking az aks nodepool scale. Azure Kubernetes Service supports cluster autoscaler and user node pools that can be scaled, or Azure DevOps / GitHub Actions pipelines with Azure CLI commands, but AKS cluster autoscaler natively supports scaling pools down to 0 when configured with node pool stop/start or autoscaler profiles.

Answer

Delete the entire AKS cluster every Friday night and recreate it every Monday using ARM templates

Answer

Use Azure Policy to deny GPU pod scheduling on weekends

Answer

Configure Azure Cost Management to automatically pause billing for GPU SKUs on weekends

Question 13

You want to create a centralized dashboard in the Azure portal that displays custom AI model performance metrics alongside infrastructure CPU and memory metrics. Which Azure Monitor feature should you create?

Accepted Answer

Azure Workbook. Azure Workbooks provide a flexible canvas for data analysis and building rich visual reports within the Azure portal, combining metrics and Log Analytics queries.

Answer

Azure Service Bus queue

Answer

Azure Key Vault access policy

Answer

Azure Container Registry webhook

Question 14

Your organization mandates that all data transferred between your Azure web application and Azure OpenAI Service must not traverse public internet routers, even within Azure's backbone. Which Azure networking configuration provides this guarantee?

Accepted Answer

Azure Private Link with private endpoints. Azure Private Link with private endpoints ensures traffic remains entirely within Microsoft's private network backbone using private IP addresses.

Answer

Public IP addresses with strict Network Security Group rules

Answer

Azure Traffic Manager with weighted routing

Answer

Azure CDN with geo-filtering

Question 15

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

Accepted Answer

Azure Monitor Activity Log alert. Azure Activity Log alerts monitor management-plane operations (such as resource creation, deletion, or modification) and trigger action groups when matched.

Answer

Azure Cost Management budget alert

Answer

Azure Advisor recommendation alert

Answer

Application Insights availability test