AI-200 Security And Observability Practice Test 8 — 15 Questions

Question 1

You are troubleshooting intermittent HTTP 429 (Too Many Requests) errors from an Azure OpenAI deployment. Which metric in Azure Monitor should you inspect to confirm whether token rate limits are being exceeded?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Normalized Token Utilization. Normalized Token Utilization measures the percentage of token limits consumed against your provisioned or pay-as-you-go capacity.

Answer

System Assigned Managed Identity Success Rate

Answer

Virtual Network Gateway Packet Drops

Answer

Data Ingestion Volume (GB)

Question 2

Your company policy requires securing AI model endpoints by disabling public internet access and ensuring all API requests use secure managed identities. Which TWO actions must you take? (Choose two)

Accepted Answer

Disable public network access on the Azure AI service resource and configure a private endpoint.. Disabling public network access requires Private Endpoints, and managed identity authentication requires configuring the target service's access control via Azure RBAC.

Answer

Expose the AI endpoint via an unencrypted HTTP binding for maximum performance.

Answer

Store all AI model weights and endpoint keys in public GitHub repositories for CI/CD access.

Answer

Configure a shared access signature (SAS) token with a 10-year expiration period.

Question 3

You are configuring comprehensive observability for an intelligent application built on Azure AI Document Intelligence and Azure OpenAI. Which THREE telemetry types or tools should you configure in Application Insights to capture complete operational insights? (Choose three)

Accepted Answer

Configure dependency tracking to monitor outgoing HTTP calls made to Azure AI REST endpoints.. Application Insights collects custom telemetry, tracks downstream dependencies, and records unhandled application exceptions.

Answer

Install the Azure Firewall policy manager directly onto the Application Insights SDK.

Answer

Use Azure Active Directory conditional access policies to restart unhealthy worker threads.

Question 4

You are configuring an Azure OpenAI service instance. You need to ensure that the service is only accessible from your corporate virtual network and that public internet access is completely disabled. Which configuration should you implement?

Accepted Answer

Create a Private Endpoint, disable public network access in the Networking tab, and verify the DNS zone configuration.. Private endpoints provide a secure connection to the service via a private IP in your VNet, and disabling public network access ensures the service is not exposed to the public internet.

Answer

Set the firewall rules to block all traffic and allow only the specific IP address of your NAT gateway.

Answer

Configure a Service Tag in the Network Security Group to allow only specific IP ranges.

Answer

Implement Azure AD Conditional Access policies to restrict access based on user location.

Question 5

To optimize costs and monitor consumption for an Azure OpenAI deployment across multiple business units, which THREE practices should you implement? (Choose three)

Accepted Answer

Apply Azure resource tags representing cost centers or business units to all AI service instances.. Cost optimization and monitoring for Azure AI include tagging resources, setting up budgets, and evaluating provisioned versus pay-as-you-go capacity.

Answer

Delete all Log Analytics diagnostic logs immediately upon generation to reduce storage billing.

Answer

Provision maximum possible provisioned throughput units permanently regardless of active workload.

Question 6

Your production Azure Machine Learning inference endpoint is failing due to unauthorized access attempts. You decide to use Managed Identities to secure the connection to an Azure Key Vault. What is the correct sequence of operations to ensure the scoring script can retrieve secrets?

Accepted Answer

Enable a System-assigned Managed Identity on the endpoint and grant the identity the Key Vault Secrets User role.. You must enable the system-assigned managed identity on the Managed Online Endpoint and then grant that identity 'Get' permissions on the Key Vault access policy.

Answer

Grant the Azure Machine Learning workspace identity contributor access to the entire Key Vault resource.

Answer

Assign the endpoint a Service Principal secret and store it in the environment variables of the scoring script.

Answer

Create a User-assigned Managed Identity and manually inject the OAuth token into the request header.

Question 7

You are monitoring a custom AI application using Application Insights. You need to track the duration of specific LLM prompt processing calls. Which telemetry type should you use to record this performance data?

Accepted Answer

Dependency telemetry. Dependencies are used to track calls to external services like APIs, databases, or LLM endpoints, making them ideal for tracking processing duration.

Answer

Trace telemetry

Answer

Request telemetry

Answer

Custom Metrics

Question 8

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

Accepted Answer

Azure Monitor metrics with splitting on the 'DeploymentName' dimension.. Azure Monitor metrics provide the 'Processed Tokens' metric, which can be split by 'DeploymentName' to see usage per model deployment.

Answer

Azure Advisor cost recommendations.

Answer

Application Insights logs via KQL query on the 'requests' table.

Answer

Azure Cost Management analysis on the resource group.

Question 9

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

Accepted Answer

Container Insights in Azure Monitor.. Container Insights (part of Azure Monitor) provides integrated monitoring for AKS, allowing you to correlate pod restarts and node resource exhaustion with application errors.

Answer

Azure Key Vault audit logs.

Answer

Log Analytics Workspace 'AppRequests' table.

Answer

Azure Machine Learning studio 'Endpoints' monitoring tab.

Question 10

You need to ensure that PII (Personally Identifiable Information) detected in your AI application logs is automatically masked before it is persisted in Log Analytics. What is the recommended approach?

Accepted Answer

Implement an ITelemetryProcessor in the application SDK.. Using an Application Insights Telemetry Processor allows you to intercept telemetry items, inspect content, and mask sensitive strings before the data leaves the application process.

Answer

Enable PII masking in the Azure OpenAI resource settings.

Answer

Use Azure Policy to deny logs containing specific patterns.

Answer

Configure a Log Analytics Data Collection Rule (DCR) to filter logs.

Question 11

A team member needs read-only access to view AI model deployment metrics in Azure Monitor but should not be able to change any resource settings. Which built-in role should you assign?

Accepted Answer

Monitoring Reader. The 'Monitoring Reader' role provides sufficient permissions to view all monitoring data, including metrics and logs, without allowing modifications.

Answer

Reader

Answer

Log Analytics Reader

Answer

Contributor

Question 12

You are troubleshooting a latency issue with an AI model deployed in a Virtual Machine. You suspect the issue is related to storage IOPS limits. Which tool should you use to check the storage performance metrics?

Accepted Answer

Azure Monitor Metrics for the Virtual Machine.. Azure Monitor 'Metrics' for the Virtual Machine resource provides 'Disk Read Operations/sec' and 'Disk Write Operations/sec', which are key for diagnosing IOPS bottlenecks.

Answer

Azure Network Watcher.

Answer

Azure Resource Graph Explorer.

Answer

Application Insights Dependency logs.

Question 13

You are securing an Azure AI Search service. Which THREE of the following actions are recommended for implementing a robust security posture? (Choose THREE)

Accepted Answer

Enable Private Endpoint access and disable public network access.. Private endpoints, RBAC, and disabling API keys in favor of Entra ID are the three pillars of securing AI Search.

Answer

Store all search index data in a public blob container for faster access.

Answer

Use an Admin API key for all read-only client applications.

Question 14

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

Accepted Answer

Use Application Insights to examine the 'Dependencies' and 'Requests' logs for duration outliers.. Analyzing telemetry through Application Insights and checking endpoint logs in the workspace are the standard methods to isolate performance issues.

Answer

Change the SKU of the underlying compute cluster to a lower tier.

Answer

Restart the Azure Machine Learning workspace to clear cache.

Answer

Delete and recreate the deployment without checking logs.

Question 15

You want to monitor the health of your AI services. Which TWO of the following can be configured to alert you automatically when model latency exceeds a predefined threshold? (Choose TWO)

Accepted Answer

Azure Monitor Metric Alerts.. Azure Monitor Alerts and Log Analytics alerts can both be configured to trigger based on threshold conditions for AI service metrics.

Answer

Azure Resource Graph alerts.

Answer

Azure Advisor alerts.

Answer

Microsoft Defender for Cloud alerts.