AI-200 Security And Observability Practice Test 6 — 15 Questions

Question 1

You are configuring diagnostic logging for an enterprise Azure OpenAI Service deployment. You need to forward logs to multiple destinations for security analysis and archiving. Which THREE of the following destinations are supported by Azure Monitor diagnostic settings? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Event Hubs. Diagnostic settings support routing logs and metrics to Log Analytics workspaces, Azure Storage accounts, and Azure Event Hubs.

Answer

Azure Container Registry local image cache

Answer

Azure Bastion host memory dump

Question 2

You are auditing your Azure subscription for security best practices related to Azure AI resources. Which TWO of the following actions help enforce governance and security? (Choose two)

Accepted Answer

Use Azure Policy to enforce allowed deployment regions and mandatory tagging.. Applying resource locks prevents accidental deletion, and enforcing Azure Policy ensures regional and configuration compliance.

Answer

Grant every user Contributor rights to the entire Azure subscription.

Answer

Share the master subscription co-administrator password with all external contractors.

Answer

Disable all firewall rules on Azure Key Vault.

Question 3

You are analyzing security and compliance logs in an Azure Log Analytics workspace. You want to write KQL queries to investigate potential security incidents or token acquisition failures. Which THREE of the following KQL tables or operators are valid and useful for this investigation? (Choose three)

Accepted Answer

The exceptions table to analyze application error stack traces and failure types.. Option A is correct because the exceptions table in Application Insights / Log Analytics stores exception telemetry including type, message, and stack traces, which is exactly what you need to diagnose application errors and token acquisition failures. Option D is correct because summarize is a core KQL operator that groups rows by one or more columns and applies aggregations such as count(), avg(), or percentile(), making it essential for spotting spikes or patterns in security and compliance telemetry. Option E is correct because the dependencies table records outbound calls (HTTP, SQL, Azure service calls) with target, duration, and success/failure result, which helps trace failed token or API calls. Option B is not valid because KQL does not use SQL's SELECT * FROM syntax; queries start with a table name followed by pipe operators. Option C is not valid because DROP TABLE is a database DDL command and is not supported inside Application Insights or Log Analytics KQL queries.

Answer

The SELECT * FROM command syntax traditionally used in relational SQL databases.

Answer

The DROP TABLE administrative command inside Application Insights log streams.

Question 4

You want to ensure that your Azure AI infrastructure costs are properly attributed to different business departments. Which TWO features should you configure? (Choose two)

Accepted Answer

Azure resource tags for department identification (e.g., Department=Finance). Resource tagging and Cost Management export/cost views help organize and attribute costs by department.

Answer

Azure Key Vault cryptographic keys

Answer

Application Insights availability probes

Answer

Azure Firewall network rules

Question 5

Your team is preparing an Azure AI application for production release. You need to implement robust monitoring and observability. Which TWO of the following steps should be taken? (Choose two)

Accepted Answer

Configure Azure Monitor metric alerts and action groups for resource utilization and throttling thresholds.. Option C is correct because Azure Monitor metric alerts with action groups provide automated, threshold-based notifications for resource utilization (such as CPU, memory, and request rates) and throttling (HTTP 429 responses), which are essential for detecting production issues proactively. Option D is correct because integrating the Application Insights SDK into the application code enables distributed tracing of requests, dependency calls, and exceptions, giving the end-to-end observability needed to diagnose failures and performance bottlenecks in an Azure AI application. Option A is incorrect because deleting Log Analytics workspaces weekly destroys the historical telemetry and query capability that monitoring depends on. Option B is incorrect because relying solely on manual user bug reports provides no automated telemetry, leaving blind spots and delaying detection. Option E is incorrect because disabling diagnostic logging removes the audit and operational data needed for troubleshooting and compliance.

Answer

Delete all log analytics workspaces weekly.

Answer

Rely solely on manual user bug reports without automated telemetry.

Answer

Disable all diagnostic logging to reduce storage overhead.

Question 6

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

Accepted Answer

Implement fallback routing or secondary region endpoints for high availability.. Implementing retry logic with exponential backoff in SDK clients and configuring circuit breaker patterns or fallback endpoints helps handle transient failures.

Answer

Disable all exception handling so unhandled errors crash the server.

Answer

Terminate the application process immediately on the first transient timeout.

Answer

Remove all timeout configurations from HTTP client connections.

Question 7

You are auditing an Azure AI platform for security vulnerabilities. You want to ensure that secrets, connection strings, and certificates are handled in compliance with security best practices. Which THREE of the following practices should you enforce? (Choose three)

Accepted Answer

Implement automated secret rotation policies for API keys and service credentials.. Option A is correct because automated secret rotation policies for API keys and service credentials limit the blast radius of a leaked secret by ensuring credentials expire and are replaced on a schedule, which is a core Azure Key Vault and security best-practice control. Option D is correct because managed identities let Azure services authenticate to resources such as Key Vault and Azure SQL without storing static connection strings or credentials in application configuration files, eliminating a common credential-exposure vector. Option E is correct because enabling Key Vault soft-delete and purge protection prevents accidental or malicious permanent deletion of secrets, certificates, and keys, preserving recoverability during the retention period. Option B is wrong because committing production database passwords to public GitHub repositories exposes credentials to anyone and violates every secret-management best practice. Option C is wrong because granting every employee administrator access to all Key Vault secrets violates least privilege and dramatically increases the risk of insider misuse or compromise.

Answer

Commit production database passwords to public GitHub repositories for easy developer access.

Answer

Grant every employee administrator access to all Key Vault secrets.

Question 8

You want to monitor the security posture and compliance score of your Azure AI resources. Which TWO of the following tools should you use? (Choose two)

Accepted Answer

Azure Policy compliance dashboard for regulatory standard evaluations. Option D is correct because the Azure Policy compliance dashboard evaluates resources against built-in and custom policy definitions, including regulatory standard initiatives such as ISO 27001, NIST SP 800-53, and PCI DSS, and reports each resource's compliance state, which directly addresses monitoring the compliance score of Azure AI resources. Option E is correct because Microsoft Defender for Cloud continuously assesses Azure resources, including AI services, against security benchmarks and surfaces security recommendations plus a Secure Score that quantifies the overall security posture. The two together cover the compliance dimension (Azure Policy) and the security-posture dimension (Defender for Cloud) requested in the scenario. Option A is incorrect because Azure Container Registry storage tiers only control image storage performance and cost, not security or compliance evaluation. Option B is incorrect because the Azure DNS zone editor manages DNS records and has no role in security posture or regulatory compliance scoring. Option C is incorrect because Azure Cost Management provides billing and cost forecasting data, not security recommendations or compliance assessments.

Answer

Azure Container Registry storage tiers

Answer

Azure DNS zone editor

Answer

Azure Cost Management for billing forecasts

Question 9

When analyzing cost reports in Azure Cost Management for your machine learning and AI services, which TWO grouping or filtering options help identify spending anomalies? (Choose two)

Accepted Answer

Filter by Service Name (e.g., 'Cognitive Services' or 'Machine Learning') to track specific AI spend.. Option A is correct because Azure Cost Management supports filtering by Service Name (the meter's service, such as 'Cognitive Services' or 'Machine Learning'), which isolates AI-related charges so anomalies in those specific services become visible against the rest of the bill. Option E is correct because grouping by Resource Group or Resource Name aggregates costs per workload, letting you pinpoint which specific ML/AI resource (for example, a GPU-enabled VM or an Azure Machine Learning workspace) is driving an unexpected spike. Options B, C, and D are incorrect because Application Insights trace message text, VM mouse device driver versions, and Azure DNS record TTL settings are not cost dimensions in Cost Management; they are telemetry, hardware, and DNS configuration data respectively, and none of them can be used to group or filter cost report data.

Answer

Group costs by Application Insights trace message text.

Answer

Group costs by virtual machine mouse device driver versions.

Answer

Filter by Azure DNS record TTL settings.

Question 10

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and connects to Azure OpenAI. You need to ensure comprehensive security across network, identity, and secrets. Which THREE of the following configurations should you deploy? (Choose three)

Accepted Answer

Azure AD Workload Identity for Kubernetes pods to securely access Azure OpenAI without static keys.. Option A is correct because Microsoft Entra ID Workload Identity federates a Kubernetes service account with an Microsoft Entra ID identity via OIDC, letting pods obtain Microsoft Entra ID tokens for Azure OpenAI through the token projection without embedding static API keys. Option B is correct because Kubernetes Network Policies enforce pod-level ingress/egress rules (via the cluster's CNI, e.g., Azure CNI with Calico or Cilium), segmenting pod-to-pod traffic and limiting lateral movement inside the AKS cluster. Option C is correct because the Azure Key Vault Provider for Secrets Store CSI Driver mounts Key Vault secrets, keys, and certificates into pods as volumes, keeping secrets out of etcd and manifests and enabling rotation and managed-identity-based access. Option D is wrong because granting cluster-admin to unauthenticated container images is a severe privilege-escalation and unauthenticated-access risk, violating least privilege. Option E is wrong because disabling TLS on ingress controllers exposes traffic in plaintext, breaking confidentiality and integrity for inbound connections.

Answer

Grant cluster-admin permissions to every unauthenticated container image.

Answer

Disable all TLS encryption on Kubernetes ingress controllers.

Question 11

You are designing an operational dashboard in Azure Monitor. Which TWO visualization components can you include in an Azure Workbook? (Choose two)

Accepted Answer

KQL query result grids and charts. Option B is correct because Azure Workbooks natively render KQL query results as grids, charts, and other visualizations, which is the core mechanism for displaying Log Analytics data in a workbook. Option E is correct because Workbooks can also visualize Azure Monitor platform metrics directly through metric chart components, letting you combine metrics and logs in one dashboard. Options A, C, and D are incorrect because DDL scripts, Key Vault plain-text secrets, and Docker image binary layers are not visualization components and cannot be embedded as workbook tiles; Workbooks only display query/metric-based visualizations, text, links, and parameters.

Answer

Azure SQL database table creation scripts (DDL)

Answer

Azure Key Vault plain-text master password files

Answer

Docker container image binary layers

Question 12

Your organization wants to ensure that all Azure AI development follows strict security and observability standards. Which TWO of the following practices should be enforced across teams? (Choose two)

Accepted Answer

Require Application Insights integration on all deployed web and AI applications.. Option C is correct because Application Insights provides the telemetry, distributed tracing, and logging needed to meet observability standards for deployed web and AI applications, enabling monitoring of requests, dependencies, and failures. Option D is correct because managed identities let Azure services authenticate to resources such as Key Vault, Storage, and Azure OpenAI without storing credentials in code, which directly enforces strict security standards for service-to-service authentication. Option A is wrong because disabling monitoring removes the observability required by the scenario and undermines incident detection and diagnostics. Option B is wrong because shared root passwords eliminate accountability and violate least-privilege and credential-hygiene principles. Option E is wrong because storing production database passwords in public README files exposes secrets and is a severe security violation.

Answer

Disable all monitoring to reduce cloud resource costs.

Answer

Use shared root passwords for all virtual machines.

Answer

Allow developers to store production database passwords in public README files.

Question 13

You are troubleshooting a scenario where an Azure App Service hosting an AI frontend cannot communicate with an Azure OpenAI endpoint secured by a private endpoint in a different virtual network. Which THREE of the following networking configurations should you verify? (Choose three)

Accepted Answer

Virtual network peering between the App Service VNet and the private endpoint VNet.. Option B is correct because the App Service VNet and the private endpoint VNet must be peered (or otherwise connected via a gateway/transit) so that traffic can flow between them; without peering, the App Service cannot reach the private endpoint's private IP. Option C is correct because App Service must have regional VNet integration enabled, which routes outbound application traffic from the app into the delegated integration subnet, allowing it to reach the peered VNet and the private endpoint. Option E is correct because the private endpoint's FQDN (e.g., <resource>.privatelink.openai.azure.com) must resolve to the private IP via a private DNS zone linked to the relevant VNets; without this DNS integration, name resolution returns the public IP and the connection fails. Option A is not relevant because Azure Front Door geo-filtering affects inbound HTTP traffic distribution, not internal DNS resolution or App Service-to-private-endpoint connectivity. Option D is not relevant because local admin passwords on worker instances have no bearing on VNet routing, peering, or private DNS resolution for private endpoint access.

Answer

Azure Front Door geo-filtering rules blocking all international DNS queries.

Answer

Local admin passwords on the App Service worker instances.

Question 14

When configuring Azure Monitor alerts for an AI application, which TWO action types can be included in an Action Group to notify operations personnel? (Choose two)

Accepted Answer

Webhook integration to trigger automated incident creation in ITSM tools. Action groups support multiple notification channels including email, SMS, push notifications, and webhooks.

Answer

Direct formatting of Azure billing invoices

Answer

Automated deletion of Azure subscription resources

Answer

Local BIOS firmware updates for physical hypervisors

Question 15

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

Accepted Answer

Disable local authentication on the Azure OpenAI resource and grant users the Cognitive Services OpenAI User role.. Azure role-based access control (Azure RBAC) can be used to authenticate requests to Azure OpenAI by disabling local authentication (API keys) via the 'disableLocalAuth' property.

Answer

Configure a managed identity on the app service and store the API key in Azure Key Vault.

Answer

Implement Cross-Origin Resource Sharing (CORS) rules on the Azure OpenAI resource.

Answer

Enable soft-delete on the Azure OpenAI resource.