AI-200 Security And Observability Practice Test 7 — 15 Questions

Question 1

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Purchase Azure reservations or provisioned throughput commitments for steady-state workloads.. Option B is correct because Azure reservations and provisioned throughput commitments (for example, Azure OpenAI Provisioned Throughput Units or Azure AI Search provisioned capacity) offer significant discounts over pay-as-you-go pricing for predictable, steady-state workloads, lowering cost while maintaining guaranteed capacity and reliability. Option C is correct because right-sizing VM and GPU SKUs using historical Azure Monitor utilization metrics ensures you pay only for the compute capacity actually needed, eliminating over-provisioning waste without reducing the performance required by the workload. Option D is correct because Azure Machine Learning compute clusters support min_nodes=0, which automatically scales the cluster down to zero nodes when idle, so you incur no compute charges during idle periods while still scaling back up on demand, preserving availability. Option A is incorrect because deleting Application Insights workspaces and halting telemetry removes observability, degrading reliability, troubleshooting, and performance tuning rather than reducing spend responsibly. Option E is incorrect because running all development and production workloads on the highest-tier enterprise GPUs 24/7 regardless of usage maximizes cost and wastes capacity, directly contradicting the goal of cost optimization.

Answer

Delete all Application Insights workspaces and stop collecting any monitoring telemetry.

Answer

Run all development and production workloads on the highest tier enterprise GPUs 24/7 regardless of usage.

Question 2

An enterprise application uses Azure AI Search and needs to authenticate securely to an Azure OpenAI backend without exposing credentials in connection strings. What is the recommended approach?

Accepted Answer

Configure a system-assigned managed identity on the Azure AI Search service and assign the Cognitive Services OpenAI User role on the Azure OpenAI resource.. A system-assigned or user-assigned managed identity should be enabled on the Azure AI Search service and granted the Cognitive Services OpenAI User role on the Azure OpenAI resource.

Answer

Create a shared access signature (SAS) token for the Azure OpenAI endpoint and rotate it every 30 days.

Answer

Use HTTP basic authentication with a pre-shared service principal secret.

Answer

Store the Azure OpenAI primary key in an Azure App Configuration service and reference it via Key Vault.

Question 3

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

Accepted Answer

Configure a Private Endpoint for the Azure AI Search service and integrate your App Service with the virtual network.. Azure Private Endpoint provides private IP addresses from your VNet to securely connect to Azure AI Search, keeping traffic off the public internet.

Answer

Enable Cross-Origin Resource Sharing (CORS) with a restricted origin list.

Answer

Enable TLS mutual authentication (mTLS) on the Azure AI Search service.

Answer

Configure IP access control lists on the Azure AI Search firewall to allow only the App Service outbound IPs.

Question 4

You need to monitor the monthly cost of an Azure AI Document Intelligence resource to ensure it does not exceed a specified budget. Where should you configure an automated notification when the cost reaches 80% of the budget?

Accepted Answer

Create a Budget in Azure Cost Management + Billing with an alert threshold set to 80%.. Azure Cost Management + Billing Budgets are the native mechanism for setting spending thresholds and triggering automated notifications (email or action groups) when actual or forecasted cost reaches a defined percentage of the budget. Setting an 80% threshold on a budget scoped to the Document Intelligence resource is the correct approach.

Answer

Configure an alert rule in Azure Monitor on the Document Intelligence resource metric 'Transactions'.

Answer

Set up an action group in Azure Advisor to monitor billing anomalies.

Answer

Create an expenditure alert inside the Azure AI Foundry portal.

Question 5

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

Accepted Answer

Use the TelemetryClient class and its TrackEvent method with a dictionary of custom dimensions.. The TelemetryClient class in the Application Insights SDK is the primary API for sending custom telemetry, and its TrackEvent method accepts a dictionary of custom dimensions (properties) that are indexed and queryable in Application Insights. This allows you to attach arbitrary key-value pairs such as prompt token counts and user IDs to a custom event, which then appear as customDimensions in the telemetry schema. Unlike plain logging, this approach preserves structured data and integrates with the full Application Insights analytics and filtering capabilities.

Answer

Configure the AzureMonitorLogExporter in the standard logging pipeline.

Answer

Use the DiagnosticSource class to emit unstructured string logs to Console.

Answer

Use the AzureKeyVaultClient to store transient custom properties.

Question 6

An enterprise deployment of Azure OpenAI requires data encryption using a key that your security team fully manages and controls in Azure Key Vault. What must you configure?

Accepted Answer

Configure Customer-Managed Keys (CMK) using an Azure Key Vault key with soft-delete and purge protection enabled, linked via a managed identity.. Customer-Managed Keys (CMK) let you encrypt Azure OpenAI data with a key you own in Azure Key Vault, and the resource accesses it via a managed identity. Soft-delete and purge protection must be enabled on the vault so the key cannot be permanently destroyed, which would render the data unrecoverable. This is the only option that gives the security team full control of the key lifecycle.

Answer

Store the API keys in Azure Key Vault and enable automatic rotation every 7 days.

Answer

Configure infrastructure encryption at rest using a Microsoft-managed default key.

Answer

Enable Always Encrypted on the Azure OpenAI resource configuration plane.

Question 7

You need to view real-time log streams from an Azure Container App running a custom LangChain agent. Which Azure CLI command should you execute?

Accepted Answer

az containerapp logs show --name --resource-group --follow. The Azure CLI command 'az containerapp logs show' retrieves logs from a Container App, and the '--follow' flag streams them in real time (similar to tail -f). This is the correct command to view live log output from a running Container App hosting a LangChain agent.

Answer

az cognitiveservices account log-stream --name <account-name>

Answer

az aks browsed --name <cluster-name>

Answer

az monitor metrics tail --resource <resource-id>

Question 8

Your company policy requires all outbound traffic from an Azure Machine Learning workspace to pass through a centralized firewall. Which feature must be implemented?

Accepted Answer

Configure workspace outbound rules with fully qualified domain name (FQDN) tags and route traffic through Azure Firewall.. To force all outbound traffic from an Azure Machine Learning workspace through a centralized firewall, you must configure workspace outbound rules using FQDN tags and route traffic through Azure Firewall. This is done by placing the workspace in a virtual network with a user-defined route (UDR) that points to Azure Firewall as the next hop, and then using Azure Firewall FQDN tags (such as AzureML) to allow required outbound traffic. This ensures that all egress is inspected and controlled by the firewall.

Answer

Enable public network access with selected IP addresses set to the firewall IP.

Answer

Use Azure Bastion to inspect all outbound connections from the workspace nodes.

Answer

Deploy the workspace without virtual network isolation and rely on Network Security Groups.

Question 9

You need to restrict access to an Azure OpenAI resource so that only requests originating from a specific Azure Virtual Network are permitted. What should you configure?

Accepted Answer

Configure the Azure OpenAI resource networking settings to allow access from 'Selected networks' and add your Virtual Network subnet.. Virtual network rules (service endpoints or private endpoints) on the Azure OpenAI firewall can restrict access to specific VNets.

Answer

Enable Cross-Origin Resource Sharing (CORS) and specify the VNet IP range.

Answer

Assign the Cognitive Services Contributor role to the Virtual Network principal.

Answer

Enable Microsoft Defender for Cloud on the Virtual Network.

Question 10

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

Accepted Answer

Azure Monitor metrics explorer on the Azure OpenAI resource.. Azure Monitor metrics explorer surfaces the built-in Azure OpenAI metrics, including Prompt Tokens, Completion Tokens, and Total Tokens, as pre-built charts on the Azure OpenAI resource. These metrics are emitted automatically per deployment and can be split by model or deployment name, making them the fastest way to trend token consumption for capacity forecasting.

Answer

Microsoft Purview data lineage maps.

Answer

Azure Advisor cost optimization recommendations.

Answer

Azure Log Analytics workspace without Application Insights configured.

Question 11

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

Accepted Answer

Use IHttpClientFactory to manage client lifecycles instead of instantiating new HttpClient objects per request.. In .NET, creating a new HttpClient per request leads to socket exhaustion because each instance holds its own connection pool and disposed clients leave sockets in TIME_WAIT. IHttpClientFactory pools and reuses HttpMessageHandler instances, resolving the exhaustion while still allowing per-request client configuration.

Answer

Configure a private endpoint between the App Service and Azure OpenAI.

Answer

Enable Always On in the App Service configuration settings.

Answer

Increase the TCP keep-alive timeout on the Azure App Service instance configuration.

Question 12

You are auditing your Azure AI services to ensure that all API keys are rotated regularly. What is the recommended practice for managing credentials in an enterprise AI solution?

Accepted Answer

Eliminate API keys by migrating authentication to Microsoft Entra ID managed identities.. Microsoft Entra ID managed identities let an Azure resource authenticate to another Azure service (such as Azure AI Search, Azure OpenAI, or Key Vault) without any secret stored in code or configuration. The identity is created and its credentials are rotated automatically by the platform, which eliminates the entire key-rotation problem the question describes. This is Microsoft's recommended enterprise pattern for service-to-service authentication in AI solutions.

Answer

Hardcode primary and secondary keys in application configuration files with failover logic.

Answer

Store API keys in plain text in Azure DevOps variable groups.

Answer

Rotate API keys manually every 7 days using the Azure portal.

Question 13

You want to set up an alert when the availability of your Azure AI custom model endpoint drops below 99%. Which Azure service should you use?

Accepted Answer

Azure Monitor metric alerts configured on the 'Availability' or 'HttpServerErrors' metrics.. Azure Monitor metric alerts evaluate platform metrics such as Availability and HttpServerErrors against thresholds and fire notifications or actions when breached. Configuring a metric alert on Availability with a threshold below 99% is the direct way to detect endpoint availability drops.

Answer

Azure Policy definitions with audit effects.

Answer

Azure Cost Management anomaly detection.

Answer

Microsoft Defender for Cloud vulnerability assessment.

Question 14

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Accepted Answer

Deploy the private endpoint into a subnet within your Virtual Network.. Option B is correct because a private endpoint is a network interface created inside a subnet of your Virtual Network, so the endpoint must be deployed into a VNet subnet to give the Azure OpenAI resource a private IP address reachable from that network. Option C is correct because name resolution must map the Azure OpenAI FQDN (for example, <resource>.openai.azure.com) to the private endpoint's private IP; this is done by integrating with a private DNS zone such as privatelink.openai.azure.com and linking it to the VNet. Option E is correct because when creating the private endpoint you must specify the target sub-resource (group ID) of the Azure OpenAI service, which is 'account', so the endpoint connects to the correct service component. Option A is not required and is in fact contrary to the goal, since private endpoint access typically involves disabling or restricting public network access rather than enabling it with unrestricted IP ranges. Option D is incorrect because a private endpoint's network interface receives a private IP address from the subnet; it is not assigned a public IP address.

Answer

Enable public network access on the Azure OpenAI resource with unrestricted IP ranges.

Answer

Assign a public IP address directly to the private endpoint network interface.

Question 15

Which TWO mechanisms can be used to monitor and optimize costs associated with Azure AI services?

Accepted Answer

Azure Budgets with configured email alert notifications.. Azure Budgets (option D) let you set spending thresholds on a scope such as a resource group or subscription and trigger email alert notifications when actual or forecasted costs approach or exceed the budget, which directly supports monitoring and controlling Azure AI service spend. Azure Advisor cost recommendations (option E) analyze usage telemetry to surface right-sizing guidance and idle or underutilized resource cleanup, which is exactly the optimization mechanism for reducing AI service costs. The remaining options are unrelated to cost management: Network Watcher IP flow logs (A) capture network traffic metadata for connectivity and security troubleshooting, Application Insights live metrics stream (B) provides real-time performance and telemetry diagnostics for applications, and Azure Bastion session monitoring logs (C) record secure RDP/SSH session activity through Bastion hosts, none of which report or optimize billing costs.

Answer

Network Watcher IP flow logs.

Answer

Application Insights live metrics stream.

Answer

Azure Bastion session monitoring logs.