AI-200 Security And Observability — Timed 40 Questions

Question 1

An enterprise AI application experiences intermittent HTTP 429 (Too Many Requests) errors when calling Azure OpenAI Service during peak hours. You need to analyze the exact token consumption trends and throttling patterns over the past week. Where should you look first in Azure Monitor?

40 minute time limit — choose an answer to begin.

Accepted Answer

Azure Monitor Metrics explorer, charting 'Processed Tokens' and 'Token Generation' metrics filtered by deployment name. Azure Monitor Metrics explorer allows you to chart metrics such as 'Processed Tokens' and 'Token Generation' filtered by deployment name. These metrics provide exact token consumption trends and can help identify throttling patterns (e.g., spikes that lead to 429 errors). This is the most direct way to analyze token usage over time.

Answer

Log Analytics workspace querying the AzureActivity table for throttling events

Answer

Azure Cost Management and Billing dashboard for daily spend trends

Answer

Application Insights availability tests configured with a 5-minute frequency

Question 2

You have a custom machine learning model deployed as a managed online endpoint in Azure Machine Learning. You need to ensure that scoring requests made to the endpoint are encrypted in transit and that client authentication is enforced using JSON Web Tokens (JWT). What authentication method does the managed online endpoint support by default?

Accepted Answer

Token-based authentication using Azure AD access tokens and key-based authentication. Azure Machine Learning managed online endpoints support two authentication modes by default: key-based authentication (using a primary/secondary key) and token-based authentication using Microsoft Entra ID access tokens (which are JWTs). Because the question requires JWT-based client authentication and encryption in transit, the token-based Microsoft Entra ID option is correct. Managed endpoints always serve over HTTPS, satisfying the encryption-in-transit requirement.

Answer

Shared Access Signatures (SAS) tokens generated from Azure Blob Storage accounts

Answer

Basic HTTP authentication with plain-text username and password headers

Answer

Anonymous access with rate limiting enabled via network security groups

Question 3

You are troubleshooting a Python application that fails to connect to Azure Key Vault using a managed identity. You want to inspect the exact exception stack trace and identify whether the managed identity token request failed. Where should you look in your local development or cloud diagnostics?

Accepted Answer

Application Insights exceptions and traces tables in the Log Analytics workspace. Application Insights stores exception telemetry and trace logs in the 'exceptions' and 'traces' tables of the associated Log Analytics workspace, capturing the full stack trace including the ManagedIdentityCredential or DefaultAzureCredential token acquisition failure. Querying these tables with KQL lets you pinpoint whether the token request to the IMDS endpoint (169.254.169.254) failed or the Key Vault call was rejected.

Answer

Azure Security Center threat detection alerts

Answer

Azure Key Vault access policies audit logs

Answer

Azure Advisor cost optimization recommendations

Question 4

You want to check the current monthly spend on your Azure OpenAI Service resource and identify which model deployments are consuming the most budget. Which Azure portal tool should you use?

Accepted Answer

Cost Analysis in Azure Cost Management + Billing. Cost Analysis in Azure Cost Management + Billing is the portal tool that breaks down spend by resource, service, resource group, and tag, and it can filter specifically to an Azure OpenAI resource to show monthly spend and per-deployment/model consumption. It provides the granularity needed to identify which model deployments drive the most cost. This is the only option designed for cost visibility and analysis.

Answer

Azure Security Center

Answer

Azure Monitor Metrics explorer

Answer

Azure Resource Health

Question 5

You have configured distributed training for a large language model across multiple nodes in an Azure Machine Learning cluster. Training jobs are failing with socket timeout errors between nodes. You need to verify internal node-to-node communication and ensure that the underlying Network Security Group (NSG) rules permit communication on the required ports. Which ports must be open between nodes in the cluster?

Accepted Answer

TCP ports 443, 22, and custom high-range ports (e.g., 40000-49999) for MPI distributed training communication. Distributed MPI training across Azure ML nodes requires SSH (TCP 22) for orchestration, HTTPS (TCP 443) for Azure control-plane and storage communication, and a high port range (commonly 40000-49999) for the MPI rendezvous and inter-process communication. NSG rules must allow these between nodes in the same subnet or across peered subnets. Without the high-range ports open, MPI ranks cannot establish sockets and jobs fail with timeout errors.

Answer

Port 1433 for SQL Server database communication

Answer

Port 3389 exclusively for Remote Desktop protocol across Linux nodes

Answer

Only port 80 and port 443 for standard web traffic

Question 6

Your organization requires that all cognitive service keys stored in Azure Key Vault are automatically rotated every 90 days. What native Azure Key Vault feature should you configure to accomplish this?

Accepted Answer

Key Vault secret rotation policies integrated with Azure Functions. Azure Key Vault natively supports rotation policies on secrets and keys, where the vault triggers an Azure Function (or Event Grid notification) on a schedule to generate a new version. Configuring a rotation policy with a 90-day interval and pointing it at a rotation function is the supported, native mechanism for automatic secret rotation. This keeps cognitive service keys fresh without manual intervention.

Answer

Azure Automation state configuration (DSC)

Answer

Azure Policy append effects

Answer

Azure Active Directory password writeback

Question 7

You are troubleshooting a Python application that uses Azure SDK libraries to interact with Azure AI services. The application is flooding Log Analytics with excessive telemetry, causing unexpected cost increases. You want to dynamically adjust the sampling rate of Application Insights without redeploying application code. How can you achieve this?

Accepted Answer

Configure adaptive sampling in the Application Insights SDK configuration or connection string parameters to automatically reduce telemetry volume. Adaptive sampling (A) is an Application Insights feature that automatically adjusts the volume of telemetry sent based on actual traffic, and it can be configured via the SDK or connection string without redeploying code. This directly reduces ingestion volume and Log Analytics cost while preserving statistically representative samples. It is the intended mechanism for dynamic telemetry control.

Answer

Modify Azure subscription billing policies to cap Log Analytics data ingestion at zero cost

Answer

Delete the Log Analytics workspace and recreate it with a lower pricing tier

Answer

Use Azure Policy to deny all incoming Application Insights trace requests

Question 8

You are optimizing costs for an AI workload running on Azure Kubernetes Service (AKS). You notice that GPU node pools are underutilized during weekends. You want to scale down the GPU node pool to 0 nodes on weekends and scale back up on Monday mornings. What Kubernetes native feature or Azure integration should you use?

Accepted Answer

AKS cluster autoscaler configured with node pool scaling profiles down to zero, or Azure Automation runbooks invoking az aks nodepool scale. The AKS cluster autoscaler supports scaling node pools down to zero (scale-to-zero) when no pods require those nodes, and you can combine it with scheduled scaling profiles or Azure Automation runbooks that invoke 'az aks nodepool scale --node-count 0' on Friday and back up on Monday. This is the native, supported way to eliminate GPU node costs during idle weekends while preserving the cluster and workloads.

Answer

Delete the entire AKS cluster every Friday night and recreate it every Monday using ARM templates

Answer

Use Azure Policy to deny GPU pod scheduling on weekends

Answer

Configure Azure Cost Management to automatically pause billing for GPU SKUs on weekends

Question 9

Your organization mandates that all data transferred between your Azure web application and Azure OpenAI Service must not traverse public internet routers, even within Azure's backbone. Which Azure networking configuration provides this guarantee?

Accepted Answer

Azure Private Link with private endpoints. Azure Private Link with private endpoints creates a private IP address for the Azure OpenAI Service within your virtual network, so all traffic between your web app and the service travels entirely over the Azure backbone network and never touches public internet routers. This is the only option that guarantees no public internet traversal because the service is accessed via a private endpoint (a network interface with a private IP in your VNet), and DNS resolution is typically configured to resolve the service's public name to that private IP. Other options either still use public endpoints or do not control the network path at the IP layer.

Answer

Public IP addresses with strict Network Security Group rules

Answer

Azure Traffic Manager with weighted routing

Answer

Azure CDN with geo-filtering

Question 10

You are investigating an incident where an AI model endpoint experienced a spike in memory consumption, resulting in Out-Of-Memory (OOM) container crashes. You want to query Log Analytics to find the exact container memory working set percentage across all replicas during the past 2 hours. Which table and KQL query should you use?

Accepted Answer

InsightsMetrics | where TimeGenerated > ago(2h) | where Namespace == 'container' and Name == 'MemoryWorkingSetBytes' | summarize avg(Val) by Computer. Container metrics in Azure Monitor are stored in the `InsightsMetrics` table where `Namespace == 'container'` and `Name == 'memoryWorkingSetBytes'` or similar performance counters.

Answer

SecurityEvent | where TimeGenerated > ago(2h) | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(2h) | summarize count() by OperationName

Answer

AppTraces | where TimeGenerated > ago(2h) | summarize count() by Message

Question 11

Your Python AI application is deployed to Azure App Service and connects to Azure Key Vault using a managed identity. Recently, you rotated the Key Vault secret value, but your App Service application is still retrieving the old secret value. What is the most likely reason for this behavior?

Accepted Answer

The application or Key Vault reference client is caching the secret value locally in memory. The most likely reason is that the application or the Key Vault reference client is caching the secret value locally in memory. Azure Key Vault references in App Service are resolved at runtime, but many client libraries (e.g., Azure.Identity, Key Vault SDK) cache secrets for a default period (often 1 hour) to reduce latency and throttling. After rotation, the cached value persists until the cache expires or the app restarts. Therefore, the app continues to retrieve the old secret until the cache is refreshed.

Answer

Log Analytics ingestion latency delayed the secret propagation

Answer

Managed identities cannot read updated secrets without a subscription reboot

Answer

Azure Key Vault automatically prevents secret updates within 30 days of creation

Question 12

Your Azure Machine Learning workspace is secured inside a virtual network with private endpoints. To ensure that data scientists can securely train models and access data stores without exposing resources to the public internet, which THREE of the following configurations must be established? (Choose three)

Accepted Answer

Private endpoints for associated Azure Storage accounts, Key Vault, and Azure Container Registry.. Option A is correct because when an Azure Machine Learning workspace is placed behind a virtual network, the dependent resources it relies on — Azure Storage (for datasets and model artifacts), Key Vault (for secrets), and Azure Container Registry (for training images) — must each be reached over Private Link via private endpoints so that traffic stays on the Microsoft backbone and no public exposure occurs. Option B is correct because setting the workspace's publicNetworkAccess to Disabled ensures the workspace's own endpoints (studio, API, and its managed resources) are only reachable through the private endpoint, preventing any public-internet access path. Option C is correct because data scientists still need a secure ingress path to reach compute instances and private endpoints from their client machines; Azure Bastion, ExpressRoute, or a site-to-site/point-to-site VPN provides that private connectivity without exposing compute to the internet. Option D is not correct because assigning public IPs to compute instances directly contradicts the goal of keeping resources off the public internet and is not a supported secure pattern for private workspaces. Option E is not correct because anonymous public scoring endpoints would expose model deployments to the internet, violating the requirement that resources not be publicly accessible.

Answer

Public IP addresses assigned directly to every compute instance for direct SSH debugging.

Answer

Enabling anonymous public scoring endpoints for all model deployments.

Question 13

When monitoring an Azure OpenAI Service deployment using Azure Monitor, which TWO metrics are commonly tracked to evaluate throughput and capacity limits? (Choose two)

Accepted Answer

Active Connections / Request Count. Option A (Active Connections / Request Count) is correct because Azure OpenAI Service exposes request-level metrics in Azure Monitor, such as total calls and active connections, which directly reflect the throughput and load being placed on a deployment. Option C (Processed Tokens or Generated Tokens metrics) is correct because token consumption metrics (e.g., processed prompt tokens and generated completion tokens) are the primary indicators of capacity usage against a model's tokens-per-minute (TPM) quota, making them essential for evaluating throughput limits. Option B is incorrect because Azure SQL Database DTU percentage is a database performance metric unrelated to Azure OpenAI Service deployments. Option D is incorrect because VM disk IOPS counters apply to virtual machine storage performance, not to the cognitive service's inference throughput. Option E is incorrect because Azure Backup vault storage consumption measures backup data retention, which has no bearing on Azure OpenAI capacity or throughput.

Answer

Azure SQL Database DTU percentage utilization

Answer

Virtual Machine disk IOPS performance counters

Answer

Azure Backup vault storage consumption

Question 14

You are troubleshooting a slow-performing Azure AI Search service that indexes millions of documents. You want to check performance counters and query execution metrics using Azure Monitor. Which THREE of the following metrics or log categories are available for Azure AI Search? (Choose three)

Accepted Answer

Throttled Search Queries Percentage (queries dropped due to capacity limits). Azure AI Search exposes service-level metrics through Azure Monitor, and option B (Throttled Search Queries Percentage) is one of them: it reports the percentage of search queries rejected because the service hit its capacity limits (e.g., replica/partition throughput or query-per-second limits), which is exactly the kind of capacity signal needed when diagnosing a slow, overloaded service. Option D (Storage Size) is also a native Azure AI Search metric, showing the amount of disk space consumed by the service's indexes, which helps determine whether the index size is approaching partition storage limits and causing performance degradation. Option E (Search Latency) is likewise a built-in Azure AI Search metric that measures the time taken to process search queries, making it the most direct indicator of the slow query performance described in the scenario. Options A, C, and E-unrelated items (Azure SQL Database transaction log backup success rate and Azure Bastion active SSH session count) belong to other Azure services entirely and are not emitted by Azure AI Search, so they cannot be used to troubleshoot this service.

Answer

Azure SQL Database transaction log backup success rate

Answer

Azure Bastion active SSH session count

Question 15

You are troubleshooting a custom LLM application deployed to an Azure Kubernetes Service (AKS) cluster. Requests are failing intermittently with HTTP 429 errors from Azure OpenAI. You need to implement a resilient observability and retry strategy using Azure Monitor. Which metric should you monitor to identify throttling?

Accepted Answer

Monitor the 'Requests' metric filtered by Response Code 429 and set up smart detection rules in Application Insights.. HTTP 429 from Azure OpenAI indicates rate-limit throttling, so the correct signal is the Requests metric filtered by Response Code 429 in Application Insights. Monitoring that metric and configuring smart detection or alert rules lets you detect throttling patterns and trigger retry/backoff logic. This directly addresses the intermittent 429 failures.

Answer

Monitor 'Disk Queue Length' on the persistent volumes attached to the pods.

Answer

Monitor 'CPU Utilization' of the AKS pods running the client application.

Answer

Monitor 'Network Outbound' bytes from the AKS cluster.

Question 16

Your development team wants to trace downstream calls made by a Semantic Kernel agent to Azure OpenAI and an external plugin. Which SDK package and feature should you integrate into your .NET application?

Accepted Answer

Configure Application Insights telemetry via the Microsoft.ApplicationInsights.AspNetCore NuGet package and enable dependency tracking.. Application Insights, integrated via the Microsoft.ApplicationInsights.AspNetCore NuGet package, provides automatic dependency tracking that captures outbound HTTP calls, including those made by Semantic Kernel to Azure OpenAI and external plugins. This telemetry is sent to Azure Monitor and visualized in the Application Insights resource, enabling distributed tracing across the agent's downstream calls. The SDK's dependency tracking module instruments HttpClient and other libraries, so no custom code is needed to trace these calls.

Answer

Use Azure Event Grid to capture telemetry events published by Semantic Kernel.

Answer

Configure Azure Monitor Workspace and collect Prometheus metrics from the application.

Answer

Write custom middleware to log every prompt and response to Azure Blob Storage.

Question 17

You are configuring network security for an Azure Machine Learning workspace. Compute instances must be accessible via Jupyter Lab, but no public IP addresses can be associated with the compute instances. Which configuration is required?

Accepted Answer

Create the compute instance with no public IP and configure a private endpoint for the workspace, accessing via Azure Bastion or workspace workspace-managed network isolation.. To allow Jupyter Lab access to a compute instance with no public IP, you create the compute instance without a public IP, configure a private endpoint for the workspace (or use workspace-managed network isolation), and access it through Azure Bastion or a VPN/ExpressRoute connection. This preserves private-only connectivity while enabling browser-based Jupyter access.

Answer

Use ExpressRoute with public peering to route traffic directly to the compute instance public IP.

Answer

Deploy the compute instance in a public subnet with Network Security Group (NSG) rules blocking port 22.

Answer

Enable Azure Firewall with DNAT rules routing traffic to the compute instance public IP.

Question 18

You are investigating performance degradation in an Azure AI Search vector search index. You need to run a Kusto Query Language (KQL) query in Application Insights to analyze dependency durations for search queries. Which table should you query?

Accepted Answer

Query the 'traces' table where message contains 'SearchLatency'.. Dependencies in Application Insights are stored in the 'dependencies' table, which records outgoing HTTP calls to Azure AI Search.

Question 19

Which TWO Azure services or features can be used to securely store and reference secrets such as connection strings for an Azure AI Search service without hardcoding them?

Accepted Answer

Managed Identities. Azure Key Vault (option B) is the dedicated Azure service for securely storing and centrally managing secrets such as connection strings, API keys, and certificates, and applications can reference these secrets at runtime via the Key Vault SDK or REST API instead of hardcoding them. Managed Identities (option A) complement Key Vault by providing an automatically managed identity in Microsoft Entra ID for the Azure resource, allowing it to authenticate to Key Vault (via RBAC or access policies) without embedding credentials in code, thus enabling secure secret retrieval. Together they form the recommended pattern for eliminating hardcoded connection strings. Option C is wrong because Azure Blob Storage public containers expose data anonymously and are not a secrets store. Option D is wrong because unencrypted plain-text variable groups provide no protection for sensitive values. Option E is wrong because local application configuration JSON files typically store secrets in cleartext and are not a secure, centralized secret-management mechanism.

Answer

Azure Blob Storage public containers

Answer

Azure DevOps variable groups with unencrypted plain text

Answer

Local application configuration JSON files

Question 20

When troubleshooting performance issues in an enterprise Azure OpenAI deployment using Application Insights, which TWO Kusto Query Language (KQL) queries or techniques help identify slow model responses?

Accepted Answer

Querying the 'availabilityResults' table for ping test response codes.. Querying the 'dependencies' table for slow durations and inspecting custom dimensions or request items are effective techniques.

Answer

Querying the 'performanceCounters' table for CPU usage.