AI-200 Security And Observability Practice Test 4 — 15 Questions

Question 1

You want to view an end-to-end distributed trace of a user request flowing from an Azure Front Door through an API Management gateway, into an Azure Function, and finally to an Azure OpenAI model call. Which Application Insights feature visualizes this entire call chain and highlights latency bottlenecks?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Application Map and Transaction Diagnostics. Application Map in Application Insights visualizes the topology of distributed components and their call relationships, while Transaction Diagnostics drills into a single end-to-end transaction to show each dependency call and its latency. Together they trace a request from Front Door through APIM, Functions, and Azure OpenAI, highlighting the slowest hop.

Answer

Azure Cost Analysis

Answer

Azure Advisor security recommendations

Answer

Azure Policy compliance dashboard

Question 2

You want to ensure that no AI services can be created in unauthorized Azure regions across your entire subscription. Which Azure governance tool should you use to enforce this restriction?

Accepted Answer

Azure Policy with the 'Allowed locations' definition. Azure Policy with the built-in 'Allowed locations' definition restricts resource creation to approved Azure regions at the subscription or management group scope, enforcing the restriction across all AI services. Assigning this policy denies deployments in unauthorized regions.

Answer

Azure Monitor action groups

Answer

Azure Cost Management budgets

Answer

Azure Security Center JIT access

Question 3

Your enterprise AI system processes sensitive Personal Identifiable Information (PII). Compliance regulations require that audit logs capturing who accessed the AI endpoints must be retained immutably for 5 years without possibility of deletion. Where should you configure this immutability policy?

Accepted Answer

Azure Storage account container immutability policies with time-based retention. Azure Storage account container immutability policies with time-based retention (WORM — Write Once, Read Many) enforce that blobs cannot be modified or deleted for a specified retention period, and when locked, the policy cannot be removed even by account owners. This directly satisfies the requirement for immutable 5-year audit log retention. Audit logs written to an immutable container remain tamper-proof for the full retention window.

Answer

Azure Active Directory audit log retention configuration

Answer

Application Insights retention settings configured via the portal

Answer

Azure Key Vault soft-delete and purge protection

Question 4

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

Accepted Answer

Dependency telemetry duration compared against custom client-side timers wrapping the API call. Application Insights dependency telemetry records the duration of outbound calls (including Azure OpenAI) as measured server-side by the SDK, so comparing that duration against a custom client-side timer that wraps the same API call isolates network/transport overhead from server processing time. If the client timer is much larger than the dependency duration, the delta is transport or client-side latency.

Answer

Azure Storage replication lag metrics

Answer

Azure Advisor performance score

Answer

Azure Policy compliance evaluation duration

Question 5

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

Accepted Answer

Action group. An action group in Azure Monitor defines the set of notifications and actions that fire when an alert rule is triggered. When you create a metric alert for search query latency, you attach an action group that contains the SMS receiver (phone number) for the on-call engineer. The action group is the binding layer between the alert rule's condition and the notification channel, so it is the correct component here.

Answer

Azure Service Health

Answer

Log Analytics workspace

Answer

Diagnostic setting

Question 6

Your team is developing an AI solution that uses Azure Cognitive Services. You need to ensure that the API keys cannot be extracted from the client-side mobile application. What is the recommended architectural pattern to achieve this?

Accepted Answer

Implement a backend API proxy (e.g., Azure Functions or API Management) that authenticates mobile clients and calls Cognitive Services using secure server-side keys. A backend API proxy (Azure Functions or API Management) is the recommended pattern because the Cognitive Services subscription key stays server-side and is never shipped in the mobile binary, where it could be decompiled or intercepted. The mobile client authenticates to the proxy (e.g., via OAuth 2.0/Entra ID token), and the proxy validates that identity before calling Cognitive Services with the secret key. This also enables rate limiting, key rotation, and per-user quota enforcement without redeploying the app.

Answer

Use Azure Front Door to strip API keys from incoming mobile requests

Answer

Store the Cognitive Services API key in an encrypted local SQLite database on the mobile device

Answer

Configure Cognitive Services for anonymous public access and rely on mobile app version checks

Question 7

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud continuously assesses Azure resources — including Azure AI services — against security benchmarks and produces prioritized recommendations plus a secure score. Recommendations such as enabling HTTPS-only traffic, configuring managed identities, and restricting network access appear directly in Defender for Cloud's regulatory compliance and recommendations blades. This is the tool Microsoft positions for cloud security posture management (CSPM).

Answer

Azure Cost Management

Answer

Azure Monitor Metrics

Answer

Azure Service Health

Question 8

Your application makes frequent calls to Azure AI Document Intelligence. You need to ensure that if a transient network failure or HTTP 503 service unavailable error occurs, the Python SDK automatically retries the failed requests with exponential backoff. How should you initialize the client to support robust retry behavior?

Accepted Answer

Instantiate the client with custom retry policy parameters (e.g., retry_total, retry_backoff_factor). The Azure SDK for Python (azure-ai-documentintelligence / azure-ai-formrecognizer) exposes a retry policy through the client constructor, where you can pass retry_total, retry_backoff_factor, retry_on_status_codes, and related kwargs. Setting retry_backoff_factor enables exponential backoff automatically, and retry_total caps the number of attempts. This is the SDK-native, supported way to handle transient 503s and socket errors without hand-rolling logic.

Answer

Write a custom infinite while loop wrapping every API call without sleep intervals

Answer

Disable all exception handling so the application crashes immediately on error

Answer

Configure Azure Traffic Manager with failover routing priorities

Question 9

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

Accepted Answer

Use the Application Insights TelemetryClient track_metric() method. The Application Insights SDK for Python provides the TelemetryClient class with a track_metric() method specifically designed to record custom metrics. Calling track_metric() sends the value to Application Insights, where it becomes queryable in the customMetrics table and can be charted over time. This is the native, supported way to instrument custom metrics from any Python process, including one running in an Azure Container Instance.

Answer

Save the metrics as text files in an Azure Blob Storage account and run hourly KQL queries

Answer

Print JSON strings to standard output and rely on Log Analytics automatic table parsing

Answer

Update Azure Key Vault secrets with the metric values

Question 10

You need to export Azure Monitor metric and log data to an external SIEM solution for security auditing. Which Azure feature should you use to stream this telemetry in real-time to an external Event Hub?

Accepted Answer

Diagnostic settings configured to stream to an Azure Event Hub. Diagnostic settings in Azure Monitor are the mechanism that routes platform metrics and resource logs to supported sinks, including Azure Event Hubs, Log Analytics workspaces, and Storage accounts. Configuring a diagnostic setting with Event Hub as the destination streams telemetry in near real-time, which an external SIEM can consume via its Event Hub connector. This is the native, supported path for exporting Azure telemetry to third-party security platforms.

Answer

Azure Backup vault scheduled jobs

Answer

Azure Advisor recommendations export

Answer

Azure Resource Graph queries

Question 11

You are troubleshooting a performance issue in an AI application where dependency calls to Azure OpenAI take significantly longer during periods of high traffic. You want to query Log Analytics to find the 95th percentile (p95) duration of all dependency calls to Azure OpenAI over the past 24 hours. Which KQL query should you execute?

Accepted Answer

dependencies | where timestamp > ago(24h) | where target has 'openai' | summarize p95_duration = percentile(duration, 95) by target. Dependency calls (including outbound calls to Azure OpenAI) are recorded in the Application Insights 'dependencies' table, which includes a 'target' field identifying the dependency endpoint and a 'duration' field in milliseconds. The percentile() aggregation function computes the 95th percentile, and filtering with 'target has openai' scopes the query to Azure OpenAI calls. This query directly answers the requirement.

Answer

exceptions | where timestamp > ago(24h) | summarize count() by outerType

Answer

requests | where timestamp > ago(24h) | summarize count() by resultCode

Answer

traces | where timestamp > ago(24h) | summarize avg(severityLevel) by message

Question 12

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Accepted Answer

Azure ExpressRoute or Site-to-Site VPN with Azure Private Link to workspace private endpoints. To reach a private-endpoint-secured Azure Machine Learning workspace from on-premises without exposing management ports, you combine private connectivity with Azure Private Link. ExpressRoute or a Site-to-Site VPN provides the encrypted hybrid path from the corporate network into Azure, and Private Link resolves the workspace's private endpoint to a private IP inside the VNet, so notebook and compute traffic never traverses the public internet.

Answer

Public IP addresses assigned to all developer workstations with NSG allow rules

Answer

Turning off all network security groups and opening all ports on the Azure firewall

Answer

Azure Bastion deployed on the on-premises physical router

Question 13

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

Accepted Answer

CanNotDelete resource lock. The correct resource lock is CanNotDelete. This lock prevents accidental deletion of the Azure OpenAI resource while still allowing read and modify operations. It ensures that the resource cannot be deleted until the lock is removed, providing a safety net against unintended deletion.

Answer

ReadOnly resource lock

Answer

Azure Policy deny assignment

Answer

Network Security Group deny rule

Question 14

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

Accepted Answer

Azure Active Directory sign-in logs or AzureDiagnostics table capturing managed identity token requests. Token acquisition failures against Microsoft Entra ID (Entra ID) are logged in the Microsoft Entra ID sign-in logs and, for managed identity token requests, in the AzureDiagnostics table within Log Analytics. These logs capture the exact HTTP status codes (e.g., 400, 401, 403) and error descriptions such as AADSTS error codes returned during the OAuth 2.0 client credentials flow. Analyzing these tables lets you pinpoint whether the failure is due to misconfigured credentials, missing role assignments, or conditional access policies.

Answer

Azure Cost Management amortization tables

Answer

Azure Storage blob access audit logs

Answer

Azure Key Vault secret version history

Question 15

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

Accepted Answer

Azure Service Health. Azure Service Health provides personalized and global views of Azure service issues, planned maintenance, health advisories, and security advisories that may affect your deployed resources. It is the correct tool to check for regional outages impacting Azure AI services and your models.

Answer

Azure Cost Management

Answer

Azure Policy

Answer

Azure Advisor