AI-102 Plan and manage an Azure AI solution Practice Question
A company plans to use Azure Cognitive Search to index a large number of PDF documents stored in Azure Blob Storage. The documents contain sensitive personally identifiable information (PII). The search results should only be accessible to authorized users based on their Azure Active Directory (Azure AD) group membership. Which combination of features should the company implement?
⚠ Common exam trap
A common mix-up: candidates confuse Azure RBAC (which controls management-plane permissions) with data-plane security trimming, or they assume that storing group membership in the index alone is sufficient without implementing a query-time filter to enforce it.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Index the documents and use security filters with Azure AD group-based access control.
Azure Cognitive Search supports security trimming via OAuth 2.0 and Azure AD group-based access control. By storing group identifiers in a search index field and using a security filter, only users whose Azure AD group membership matches the stored group IDs can see the corresponding search results. This ensures that sensitive PII in PDF documents is only returned to authorized users without exposing the documents themselves.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate shared access signatures (SAS) for each document and include them in the search index.
Why it's wrong here
SAS is for blob access, not for search result filtering.
- ✓
Index the documents and use security filters with Azure AD group-based access control.
Why this is correct
Security filters allow restricting search results based on Azure AD group membership stored in the index.
- ✗
Use Azure RBAC to assign permissions to users for the search service and configure field-level security.
Why it's wrong here
RBAC controls service-level access, not document-level security in search results.
- ✗
Store Azure AD group membership in a field in the search index and configure an indexer to map the field.
Why it's wrong here
Field mapping is part of indexer configuration, but the statement is incomplete; the correct approach is to use security filters.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AI-102 question from scratch — 945 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.