AI-200 Security And Observability Practice Test 5 — 15 Questions

Question 1

Your enterprise AI solution runs across multiple subscriptions. You want to implement centralized cost allocation tags for all Azure AI resources to ensure every resource is tagged with 'CostCenter' and 'Environment'. Which Azure feature should you use to automatically audit and enforce these tags?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Policy with tag governance rules (e.g., 'Inherit a tag from the resource group' or 'Require specified tag'). Azure Policy is the governance service that audits and enforces resource properties, including tags, across subscriptions. Built-in tag policies such as 'Require a tag and its value on resources' and 'Inherit a tag from the resource group' let you deny non-compliant deployments or auto-remediate missing tags, and policy assignments can target management groups so they cover every subscription in the enterprise. This is the only option that provides automatic audit plus enforcement.

Answer

Application Insights telemetry initializers

Answer

Azure Advisor security rules

Answer

Azure Cost Management budgets

Question 2

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

Accepted Answer

Use DefaultAzureCredential from the azure-identity library to automatically authenticate via the VM's IMDS endpoint. The correct method is to use DefaultAzureCredential from the azure-identity library to automatically authenticate via the VM's IMDS endpoint. When a system-assigned managed identity is enabled on an Azure VM, the VM can request tokens from the Instance Metadata Service (IMDS) at a well-known endpoint (169.254.169.254). DefaultAzureCredential automatically detects the managed identity and uses it to obtain an access token for Azure OpenAI, eliminating the need to store credentials on the VM.

Answer

Use static storage account connection strings hardcoded in environment variables

Answer

Make an unauthenticated HTTP GET request to the public Azure OpenAI endpoint with no headers

Answer

Read the plain-text password from a file located in /etc/passwd on the virtual machine

Question 3

You want to create a centralized dashboard in the Azure portal that displays custom AI model performance metrics alongside infrastructure CPU and memory metrics. Which Azure Monitor feature should you create?

Accepted Answer

Azure Workbook. Azure Workbook is the correct choice because it provides a flexible canvas for combining and visualizing data from multiple sources, including custom metrics from AI models and infrastructure metrics like CPU and memory. Workbooks allow you to create interactive reports and dashboards that can be shared across teams, making them ideal for centralized monitoring. They support parameters, charts, grids, and text, enabling a unified view of disparate telemetry.

Answer

Azure Service Bus queue

Answer

Azure Key Vault access policy

Answer

Azure Container Registry webhook

Question 4

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

Accepted Answer

Azure Monitor Activity Log alert. Azure Monitor Activity Log alerts capture subscription-level management-plane events such as resource creation, deletion, and modification, making them the correct choice for notifying on resource changes. Activity Log records control-plane operations across all Azure resources in a subscription. This is distinct from metric or log alerts, which target resource telemetry rather than management operations.

Answer

Azure Cost Management budget alert

Answer

Azure Advisor recommendation alert

Answer

Application Insights availability test

Question 5

You are reviewing security logs in Azure Key Vault and notice unexpected access attempts from an unrecognized IP address. You need to immediately revoke all active Azure Active Directory tokens issued to a specific compromised user or service principal across your Azure AI applications. What action should you take?

Accepted Answer

Revoke user refresh tokens using Azure AD PowerShell (Revoke-AzureADUserAllRefreshToken) or Microsoft Entra admin center. Revoking refresh tokens invalidates the user's or service principal's ability to silently obtain new access tokens, effectively terminating the session across all clients. The Revoke-AzureADUserAllRefreshToken cmdlet (or the equivalent 'Revoke sessions' action in the Microsoft Entra admin center) sets the refreshTokensValidFromDateTime to now, so any token issued before that timestamp is rejected. This is the correct immediate containment step for a compromised identity.

Answer

Restart the Azure portal browser session

Answer

Change the Azure subscription display name

Answer

Delete the Azure Monitor Log Analytics workspace

Question 6

Your data science team uses Azure Machine Learning notebooks. To prevent data exfiltration, you need to ensure that users cannot download datasets or trained model artifacts directly from the workspace to their local corporate laptops. Which feature should you configure?

Accepted Answer

Workspace configured with a managed virtual network and outbound rules blocking public internet egress, plus disabled local file downloads in compute instance settings. To prevent exfiltration from AML, you combine a workspace managed virtual network with outbound rules that block public internet egress, plus disabling local file downloads on compute instances. The managed VNet isolates compute and controls egress via private endpoints and FQDNs, while the compute instance setting removes the ability to download files to a local laptop. Together these enforce the no-exfiltration requirement.

Answer

Using Azure Front Door with Web Application Firewall disabled

Answer

Disabling Azure Monitor diagnostic logging

Answer

Assigning the Contributor role to all external collaborators

Question 7

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

Accepted Answer

Cost Analysis grouped by Resource Group and filtered by Service Name 'Machine Learning'. Cost Analysis in Azure Cost Management allows you to group and filter costs by subscription, resource group, and resource type.

Answer

Azure Advisor security dashboard

Answer

Application Insights availability tests

Answer

Azure Monitor Metric alerts

Question 8

You want to receive an email notification whenever monthly spending on your Azure OpenAI Service exceeds $5,000. Which Azure feature should you configure?

Accepted Answer

Cost Management budget with an alert threshold set at the desired dollar amount. Azure Cost Management budgets allow you to define spending thresholds and attach action groups or email recipients for notifications.

Answer

Azure Service Health incident alert

Answer

Azure Advisor security recommendation

Answer

Azure Monitor Metric alert on CPU utilization

Question 9

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Accepted Answer

Allow Azure services and resources to access this server firewall setting combined with Virtual Network rules. Service endpoints or private endpoints on Azure SQL Database allow Azure services (such as AI Search) to connect securely within the Microsoft backbone network while disabling public access.

Answer

Open firewall port 1433 for all IP addresses globally

Answer

Use Azure Front Door to load balance SQL TCP connections

Answer

Configure an HTTP proxy inside an Azure VM to forward SQL queries

Question 10

Your enterprise AI application is deployed across multiple Azure regions for high availability. You need to ensure that logs from Application Insights instances in all regions are aggregated into a single central Log Analytics workspace for unified querying. How should you configure this?

Accepted Answer

Configure each Application Insights resource to use the same shared centralized Log Analytics workspace during creation. Application Insights resources can be configured to send their telemetry to a Log Analytics workspace, and pointing multiple regional Application Insights instances at the same workspace aggregates all logs for unified KQL querying. This is done at creation time (or via migration) by selecting the shared workspace as the ingestion target. The result is a single pane of glass across regions without custom ETL.

Answer

Deploy a separate Log Analytics workspace in every region and use Azure Backup to copy tables

Answer

Write a custom Python script that downloads logs from each region every hour and uploads them to Azure Blob Storage

Answer

Use Azure Traffic Manager to merge log data streams at the DNS level

Question 11

You are designing a secure enterprise AI architecture on Azure. Which TWO of the following practices should you implement to secure credentials and service access? (Choose two)

Accepted Answer

Use system-assigned or user-assigned managed identities for Azure service-to-service authentication.. Option A is correct because managed identities (system-assigned or user-assigned) let Azure services authenticate to resources such as Key Vault, Storage, and Azure OpenAI without embedding any credentials in code or configuration, eliminating secret sprawl and enabling Microsoft Entra ID token-based access. Option C is correct because Azure Key Vault is the dedicated service for storing and controlling access to runtime secrets, API keys, connection strings, and certificates, with RBAC, access policies, soft-delete, purge protection, and auditing. Option B is wrong because committing API keys and connection strings as plain text in Git exposes them to anyone with repository access and to history scraping, violating secret-management best practices. Option D is wrong because granting subscription Owner to mobile client applications violates least privilege and would let a compromised app modify or delete any resource in the subscription. Option E is wrong because disabling TLS on internal microservice traffic removes encryption in transit, enabling eavesdropping and man-in-the-middle attacks for a negligible throughput gain.

Answer

Store API keys and connection strings as plain text in Git repository configuration files.

Answer

Grant subscription Owner permissions to all mobile client applications.

Answer

Disable TLS encryption on internal microservice communication to improve network throughput.

Question 12

Your Azure AI application relies on Azure OpenAI and Azure AI Search. You need to troubleshoot a sudden surge in HTTP errors and latency. Which THREE of the following Azure Monitor / Application Insights features or tools should you use to diagnose the issue? (Choose three)

Accepted Answer

Application Map in Application Insights to identify downstream dependency latency bottlenecks.. Application Map visualizes dependencies and latency bottlenecks, Metrics explorer tracks token consumption and throttling counters, and Log Analytics enables KQL queries for specific exception traces.

Answer

Azure Cost Management recommendation advisor for server resizing.

Answer

Azure Bastion diagnostic logs for RDP login failures.

Question 13

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Accepted Answer

Azure Advisor cost recommendations. Azure Advisor cost recommendations (A) is correct because it analyzes resource usage and configuration and surfaces actionable recommendations to reduce spend, such as rightsizing or shutting down idle resources, which directly helps prevent budget overruns. Azure Cost Management budgets and alerts (E) is correct because you can define a budget threshold and configure alerts that trigger when actual or forecasted costs approach or exceed that amount, enabling proactive governance. Azure Bastion subnet configuration (B) is incorrect because it concerns secure RDP/SSH connectivity to VMs, not cost monitoring or governance. Azure Key Vault access policies (C) is incorrect because it governs secrets, keys, and certificate permissions, not spending. Azure Service Health incident dashboard (D) is incorrect because it reports platform outages and service issues, not cost or budget data.

Answer

Azure Bastion subnet configuration

Answer

Azure Key Vault access policies

Answer

Azure Service Health incident dashboard

Question 14

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

Accepted Answer

Azure Private Link with private endpoints mapped to your virtual network. Private endpoints via Azure Private Link and disabling public network access on PaaS resources ensure complete network isolation from the public internet.

Answer

Enabling anonymous access on Application Insights data ingestion endpoints

Answer

Using Azure Front Door with global public anycast IPs

Answer

Assigning public IP addresses to all backend scoring containers

Question 15

When troubleshooting a Python AI application integrated with Application Insights, you want to ensure comprehensive error tracking and telemetry collection. Which TWO of the following SDK practices should you implement? (Choose two)

Accepted Answer

Wrap unhandled exception handling with telemetry_client.track_exception() to capture stack traces.. Option B is correct because telemetry_client.track_exception() explicitly records exception details, including the exception type, message, and stack trace, into Application Insights, which is essential for diagnosing unhandled errors in a Python AI application. Option D is correct because the Application Insights SDK buffers telemetry and sends it asynchronously; calling telemetry_client.flush() before the process exits ensures buffered items are transmitted rather than lost, which is critical in short-lived or containerized workloads. Option A is wrong because disabling the telemetry client in production eliminates the error tracking and telemetry collection the scenario requires. Option C is wrong because routing logs only to local text files on ephemeral container storage means they are lost when the container is recycled and never reach Application Insights. Option E is wrong because storing plain-text passwords in custom dimensions exposes secrets in telemetry data and violates security best practices.

Answer

Disable the Application Insights telemetry client entirely in production to save bandwidth.

Answer

Route all application logs exclusively to local text files on ephemeral container storage.

Answer

Store plain-text passwords in telemetry custom dimensions.