AI-200 Security And Observability Practice Test 3 — 15 Questions

Question 1

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a system-assigned managed identity on App Service and assign the Search Index Data Reader role on Azure AI Search. The most secure approach is to enable a system-assigned managed identity on the App Service and grant it the Search Index Data Reader role on the Azure AI Search service. Managed identities eliminate secrets entirely — Microsoft Entra ID issues and rotates the credentials automatically, and the app authenticates to Search using its identity. This follows the zero-trust, secretless best practice for service-to-service authentication.

Answer

Configure an IP firewall on Azure AI Search to allow only the static outbound IP of App Service

Answer

Store the primary admin API key in Azure App Service configuration environment variables

Answer

Use shared access signatures (SAS) tokens generated by a client script

Question 2

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

Accepted Answer

Azure Cost Management Budgets with alert conditions. Azure Cost Management Budgets let you define a monetary threshold scoped to a subscription, resource group, or specific resource, and attach alert conditions (e.g., 80% of budget) that fire via email or Action Groups. This is the only native Azure feature that directly ties spend tracking to a departmental budget with automated threshold alerts. Budgets can be filtered by tag, resource group, or service, so each business unit's AI spend can be isolated.

Answer

Azure Advisor cost recommendations

Answer

Azure Monitor autoscale settings

Answer

Azure Service Health alerts

Question 3

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

Accepted Answer

Application Insights. Application Insights is Azure's application performance monitoring (APM) service, providing custom telemetry via the SDK, distributed tracing across dependencies, and failure tracking for outbound calls. It is the correct choice for monitoring an AI app's calls to an external ML endpoint, including latency, failure rates, and dependency maps.

Answer

Azure Advisor

Answer

Microsoft Defender for Cloud

Answer

Azure Policy

Question 4

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Accepted Answer

Azure Private Link with a private endpoint for the Azure OpenAI resource. Azure Private Link with a private endpoint assigns a private IP address from your virtual network to the Azure OpenAI resource, allowing clients in peered VNets to reach the service entirely over the Microsoft backbone network. This satisfies the requirement to avoid the public internet while enabling you to set public network access to 'Disabled' on the Azure OpenAI resource. Service endpoints do not provide a private IP for the service and still route traffic through the public Azure network, so they cannot fully block public access.

Answer

Service endpoints with default deny rules on the public firewall

Answer

Azure Application Gateway with Web Application Firewall (WAF)

Answer

Azure Bastion deployed in the management subnet

Question 5

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

Accepted Answer

Configure diagnostic settings on each AI service resource pointing to the centralized Log Analytics workspace. Diagnostic settings are the native Azure mechanism for routing resource-level platform logs and metrics from individual PaaS resources (such as Azure OpenAI and Azure AI Language) to a Log Analytics workspace, Storage account, or Event Hub. Because diagnostic settings are configured per resource and can target a workspace in any resource group or subscription (as long as the caller has appropriate RBAC), this is the correct way to centralize telemetry across resource groups.

Answer

Enable Application Insights dependency tracking on the subscription level via Azure Policy

Answer

Configure Azure Event Grid subscriptions for every log event emitted by the AI endpoints

Answer

Deploy a Log Analytics agent (MMA) directly onto the Azure OpenAI PaaS resource instances

Question 6

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

Accepted Answer

Customer-managed keys (CMK) stored in Azure Key Vault. Customer-managed keys (CMK) in Azure Key Vault let you supply your own encryption key that Azure OpenAI uses for data-at-rest encryption, and you control rotation and revocation through Key Vault. This satisfies the requirement for organization-controlled, rotatable encryption keys for stored data.

Answer

Client-side encryption using PGP keys before sending HTTP payloads

Answer

Azure Information Protection sensitivity labels applied via Microsoft Purview

Answer

Transparent Data Encryption (TDE) configured via SQL Server Management Studio

Question 7

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

Accepted Answer

Azure Monitor metric alerts with an action group. Azure Monitor metric alerts are designed to evaluate numeric time-series data such as CPU utilization from Azure Machine Learning compute instances. By creating a metric alert with a threshold of 90% and a 15-minute aggregation window, you can detect sustained high CPU usage. An action group attached to the alert defines the notification channel, such as email to the operations team. This is the standard, native way to implement resource-level performance alerting in Azure.

Answer

Azure Cost Management anomaly alerts

Answer

Azure Policy remediation tasks

Answer

Azure Service Health planned maintenance alerts

Question 8

Your team is running an AI copilot application that uses Azure OpenAI. To comply with data residency regulations, you need to verify that prompts and completions are processed entirely within a specific Azure region and that no data is persisted outside that region. Where can you verify regional data processing and residency commitments?

Accepted Answer

Azure OpenAI service compliance terms and data residency documentation in the Azure Trust Center. The Azure Trust Center hosts Azure OpenAI Service compliance terms and data residency documentation, which is where you verify regional processing and residency commitments. It documents where data is processed, whether prompts/completions are stored, and the contractual commitments Microsoft makes. This is the authoritative source for compliance and data residency verification.

Answer

Azure Resource Graph queries filtering by region

Answer

Azure Monitor geographic latency metrics dashboard

Answer

Application Insights dependency maps

Question 9

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

Accepted Answer

IP firewall rules and virtual network service rules on the backend services restricting access to App Service. To prevent leaked credentials from being used from unauthorized networks, you should implement IP firewall rules and virtual network service rules on the backend services (Azure Cosmos DB and Azure OpenAI) to restrict access to only the App Service's outbound IP addresses or its virtual network. This ensures that even if credentials leak, they cannot be used from outside the allowed network.

Answer

Disabling managed identities across all application components

Answer

Configuring Azure Front Door with SSL offloading only

Answer

Enabling public anonymous access with client-side rate limiting

Question 10

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

Accepted Answer

azure-identity package with DefaultAzureCredential and azure-keyvault-secrets. The azure-identity package with DefaultAzureCredential combined with azure-keyvault-secrets is the correct approach: DefaultAzureCredential automatically chains managed identity, environment credentials, and developer credentials, so the app authenticates to Key Vault without hardcoded secrets, then retrieves the storage connection string at runtime. This eliminates secrets from source code and supports passwordless authentication. It is the Microsoft-recommended pattern for secure secret retrieval in Python.

Answer

pyodbc with direct ODBC connection strings containing embedded passwords

Answer

azure-storage-blob with StorageSharedKeyCredential initialized with plain-text keys

Answer

requests library making direct REST calls with master subscription keys

Question 11

You need to analyze log queries across multiple AI applications and infrastructure components to identify custom performance bottlenecks. Which query language is used in Azure Monitor Log Analytics to write queries against collected log data?

Accepted Answer

Kusto Query Language (KQL). Kusto Query Language (KQL) is the native query language used by Azure Monitor Log Analytics to query data stored in Log Analytics workspaces. It is designed for read-only, high-performance analysis of large volumes of structured, semi-structured, and unstructured log data, making it ideal for identifying custom performance bottlenecks across AI applications and infrastructure. KQL supports advanced operators like `summarize`, `join`, `render`, and `make-series` that enable deep diagnostics and visualization.

Answer

GraphQL

Answer

SQL Server Transact-SQL (T-SQL)

Answer

Azure Resource Graph Query (ARGQL)

Question 12

Your machine learning engineering team needs to run training jobs on Azure Machine Learning compute clusters. To minimize costs during off-peak hours, you need to configure the compute cluster to automatically scale down to zero nodes when no jobs are queued, and scale up when jobs are submitted. What setting should you configure on the compute cluster?

Accepted Answer

Set the minimum number of nodes to 0 and the maximum nodes according to workload requirements. To automatically scale down to zero nodes when no jobs are queued and scale up when jobs are submitted, you should set the minimum number of nodes to 0 and the maximum nodes according to workload requirements. Azure Machine Learning compute clusters support autoscaling with a minimum of 0, which allows the cluster to deallocate all nodes when idle, minimizing costs. When a job is submitted, the cluster automatically scales up to the maximum node count to handle the workload.

Answer

Configure Azure Automation runbooks to stop the physical datacenter servers

Answer

Set the minimum number of nodes equal to the maximum number of nodes

Answer

Use Azure Functions timer triggers to delete the compute target every evening

Question 13

You are troubleshooting a live AI web application where users report intermittent 504 Gateway Timeout errors when submitting large text prompts to a custom model endpoint. You want to check if the backend inference container is timing out or crashing. Where should you examine container-level stdout/stderr logs in Azure Container Apps?

Accepted Answer

Log Analytics workspace querying the ContainerAppConsoleLogs_CL table. Azure Container Apps writes container stdout/stderr to the Log Analytics workspace associated with the Container Apps environment, where it is queryable in the ContainerAppConsoleLogs_CL table. This is the canonical location for container-level logs, including crash traces, stack dumps, and application output that would reveal inference timeouts or OOM kills. Querying this table lets you correlate timestamps with the 504 errors reported by users.

Answer

Azure Cosmos DB request unit (RU) consumption logs

Answer

Azure Key Vault audit logs

Answer

Azure Advisor performance recommendations

Question 14

Your enterprise security team mandates that all outbound traffic from your Azure Machine Learning workspace must pass through a centralized Azure Firewall, and no public IP addresses can be associated with workspace compute instances. Which workspace network isolation configuration should you select?

Accepted Answer

Workspace with a managed virtual network and outbound rules configured for user-defined routing through Azure Firewall. To route all outbound traffic through a centralized Azure Firewall and prevent public IPs on compute instances, you must use a workspace with a managed virtual network and configure outbound rules for user-defined routing (UDR) through the firewall. This setup isolates compute in a private network and forces egress via the firewall.

Answer

Public workspace with basic password authentication enabled on compute instances

Answer

Workspace using dynamic public IP allocation with Network Security Group (NSG) allow rules

Answer

Serverless compute instances with public endpoint access enabled

Question 15

You are debugging a Python application integrated with Application Insights. You notice that custom telemetry events generated in a background worker thread are not appearing in Application Insights. What is the most likely cause of this issue?

Accepted Answer

The application terminated or the worker thread exited before the telemetry client buffer was flushed. The Application Insights Python SDK buffers telemetry in memory and sends it asynchronously in batches. If the background worker thread exits or the application terminates before the buffer is flushed, the queued telemetry events are lost and never reach Application Insights. This is the most common cause of missing custom events from short-lived threads.

Answer

Log Analytics ingestion rate limiting always drops multi-threaded telemetry

Answer

Application Insights automatically blocks all telemetry generated outside of HTTP request threads

Answer

The instrumentation key was incorrectly formatted as a GUID