Plan and manage an Azure AI solution →hardMultiple Select

AI-102 Plan and manage an Azure AI solution Practice Question

You are deploying an Azure AI solution that uses Azure AI Language and Azure AI Vision. You need to ensure that the solution can be deployed repeatedly to multiple environments with consistent configuration and that secrets are managed securely. (Choose two.)

⚠ Common exam trap

The trap here is assuming that storing secrets in a parameters file or Git repository is acceptable if access is restricted, when in fact secrets should always be stored in a dedicated secure store like Azure Key Vault.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Use Azure Key Vault to store the Azure AI service keys and reference the secrets from the ARM template.

To achieve repeatable deployments with consistent configuration, use infrastructure as code such as ARM templates. To manage secrets securely, store keys in Azure Key Vault and reference them from the templates. Combining these two practices allows the same deployment process to be used across environments while keeping secrets out of source control and deployment definitions.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Use Azure Key Vault to store the Azure AI service keys and reference the secrets from the ARM template.
Why this is correct
Azure Key Vault provides secure storage for secrets. By referencing Key Vault secrets from an ARM template, you avoid hardcoding keys in the template or parameters. This allows the same template to be deployed to multiple environments while retrieving environment-specific secrets from Key Vault, meeting both consistency and security requirements.
✗
Store the Azure AI service keys in the ARM template parameters file.
Why it's wrong here
Storing keys in a parameters file, even if it is not checked into source control, embeds secrets in the deployment definition. This is not secure because the keys can be exposed in deployment history or logs. Secrets should be stored in Azure Key Vault and referenced securely, not placed directly in template parameters.
✗
Use the Azure portal to manually create the Azure AI resources in each environment.
Why it's wrong here
Manual creation through the portal is error-prone and does not provide repeatable or consistent deployments. It also increases administrative effort and the risk of configuration drift between environments. This approach does not meet the requirement for repeatable deployments with consistent configuration.
✗
Store the Azure AI service keys in a Git repository and use a pipeline to inject them during deployment.
Why it's wrong here
Storing keys in a Git repository exposes them to anyone with repository access and in the version history. Even if injected during deployment, the secrets are compromised. This is insecure and violates the requirement to manage secrets securely. Key Vault should be used instead.
✓
Use an ARM template to define the Azure AI resources and their configurations.
Why this is correct
ARM templates provide infrastructure as code, enabling repeatable and consistent deployments across environments. They define the resources and their properties declaratively, so the same template can be used to deploy to development, test, and production. This satisfies the requirement for consistent configuration and repeatable deployments.

Go deeper

AI-102 Plan and manage an Azure AI solution Practice Question

Why each option matters

Option-by-option breakdown

Related to this question