Security And Observability

You are troubleshooting a scenario where an Azure App Service hosting an AI frontend cannot communicate with an Azure OpenAI endpoint secured by a private endpoint in a different virtual network. Which THREE of the following networking configurations should you verify? (Choose three)

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

You are configuring network security for an Azure Machine Learning workspace. Compute instances must be accessible via Jupyter Lab, but no public IP addresses can be associated with the compute instances. Which configuration is required?

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

You are troubleshooting intermittent HTTP 429 (Too Many Requests) errors from an Azure OpenAI deployment. Which metric in Azure Monitor should you inspect to confirm whether token rate limits are being exceeded?

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Which TWO roles are commonly assigned when granting a managed identity access to consume Azure OpenAI services via Azure RBAC?

Your organization requires that all cognitive service keys stored in Azure Key Vault are automatically rotated every 90 days. What native Azure Key Vault feature should you configure to accomplish this?

Which TWO mechanisms can be used to monitor and optimize costs associated with Azure AI services?

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

Your team is running an AI copilot application that uses Azure OpenAI. To comply with data residency regulations, you need to verify that prompts and completions are processed entirely within a specific Azure region and that no data is persisted outside that region. Where can you verify regional data processing and residency commitments?

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and connects to Azure OpenAI. You need to ensure comprehensive security across network, identity, and secrets. Which THREE of the following configurations should you deploy? (Choose three)

You are investigating performance degradation in an Azure AI Search vector search index. You need to run a Kusto Query Language (KQL) query in Application Insights to analyze dependency durations for search queries. Which table should you query?

Your Azure AI application relies on Azure OpenAI and Azure AI Search. You need to troubleshoot a sudden surge in HTTP errors and latency. Which THREE of the following Azure Monitor / Application Insights features or tools should you use to diagnose the issue? (Choose three)

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

You are troubleshooting a performance issue in an AI application where dependency calls to Azure OpenAI take significantly longer during periods of high traffic. You want to query Log Analytics to find the 95th percentile (p95) duration of all dependency calls to Azure OpenAI over the past 24 hours. Which KQL query should you execute?

You want to receive an email notification whenever monthly spending on your Azure OpenAI Service exceeds $5,000. Which Azure feature should you configure?

You need to secure an Azure Machine Learning workspace against data exfiltration. Which THREE configurations should you implement?

You need to monitor the monthly spending on Azure OpenAI token consumption and receive an alert when expenditures exceed a predefined threshold. Which tool should you use?

You are configuring diagnostic logging for an enterprise Azure OpenAI Service deployment. You need to forward logs to multiple destinations for security analysis and archiving. Which THREE of the following destinations are supported by Azure Monitor diagnostic settings? (Choose three)

An enterprise application uses Azure AI Search and needs to authenticate securely to an Azure OpenAI backend without exposing credentials in connection strings. What is the recommended approach?

You are troubleshooting a Python application that fails to connect to Azure Key Vault using a managed identity. You want to inspect the exact exception stack trace and identify whether the managed identity token request failed. Where should you look in your local development or cloud diagnostics?

You want to view an end-to-end distributed trace of a user request flowing from an Azure Front Door through an API Management gateway, into an Azure Function, and finally to an Azure OpenAI model call. Which Application Insights feature visualizes this entire call chain and highlights latency bottlenecks?

You need to view real-time log streams from an Azure Container App running a custom LangChain agent. Which Azure CLI command should you execute?

Which TWO Azure services or features can be used to securely store and reference secrets such as connection strings for an Azure AI Search service without hardcoding them?

You are troubleshooting a Python application that uses Azure SDK libraries to interact with Azure AI services. The application is flooding Log Analytics with excessive telemetry, causing unexpected cost increases. You want to dynamically adjust the sampling rate of Application Insights without redeploying application code. How can you achieve this?

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

Your company policy requires all outbound traffic from an Azure Machine Learning workspace to pass through a centralized firewall. Which feature must be implemented?

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

You are securing an Azure AI Search service. Which THREE of the following actions are recommended for implementing a robust security posture? (Choose THREE)

Your development team wants to trace downstream calls made by a Semantic Kernel agent to Azure OpenAI and an external plugin. Which SDK package and feature should you integrate into your .NET application?

Your production Azure Machine Learning inference endpoint is failing due to unauthorized access attempts. You decide to use Managed Identities to secure the connection to an Azure Key Vault. What is the correct sequence of operations to ensure the scoring script can retrieve secrets?

Your enterprise AI system processes sensitive Personal Identifiable Information (PII). Compliance regulations require that audit logs capturing who accessed the AI endpoints must be retained immutably for 5 years without possibility of deletion. Where should you configure this immutability policy?

You want to monitor the health of your AI services. Which TWO of the following can be configured to alert you automatically when model latency exceeds a predefined threshold? (Choose TWO)

An enterprise application calls multiple Azure AI Language services. You need to trace requests across multiple distributed microservices to diagnose high latency issues. Which Azure Monitor capability should you implement?

Your team is using managed identities to connect an Azure App Service web app to an Azure OpenAI resource. The connection fails with a 403 Forbidden error. What is the most likely root cause?

When troubleshooting performance issues in an enterprise Azure OpenAI deployment using Application Insights, which TWO Kusto Query Language (KQL) queries or techniques help identify slow model responses?

You are troubleshooting a custom LLM application deployed to an Azure Kubernetes Service (AKS) cluster. Requests are failing intermittently with HTTP 429 errors from Azure OpenAI. You need to implement a resilient observability and retry strategy using Azure Monitor. Which metric should you monitor to identify throttling?

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

You want to set up an alert when the availability of your Azure AI custom model endpoint drops below 99%. Which Azure service should you use?

You are troubleshooting a live AI web application where users report intermittent 504 Gateway Timeout errors when submitting large text prompts to a custom model endpoint. You want to check if the backend inference container is timing out or crashing. Where should you examine container-level stdout/stderr logs in Azure Container Apps?

You are auditing an Azure AI platform for security vulnerabilities. You want to ensure that secrets, connection strings, and certificates are handled in compliance with security best practices. Which THREE of the following practices should you enforce? (Choose three)

You are configuring an Azure OpenAI service instance. You need to ensure that the service is only accessible from your corporate virtual network and that public internet access is completely disabled. Which configuration should you implement?

You are configuring role-based access control for an Azure AI Search service. A data scientist needs to index content and query documents, but must not be permitted to manage service-level keys or change admin configurations. Which built-in role should you assign?

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

You are monitoring a custom AI application using Application Insights. You need to track the duration of specific LLM prompt processing calls. Which telemetry type should you use to record this performance data?

Your data science team uses Azure Machine Learning notebooks. To prevent data exfiltration, you need to ensure that users cannot download datasets or trained model artifacts directly from the workspace to their local corporate laptops. Which feature should you configure?

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Your organization wants to ensure that all Azure AI development follows strict security and observability standards. Which TWO of the following practices should be enforced across teams? (Choose two)

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

An enterprise AI application experiences intermittent HTTP 429 (Too Many Requests) errors when calling Azure OpenAI Service during peak hours. You need to analyze the exact token consumption trends and throttling patterns over the past week. Where should you look first in Azure Monitor?

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

You are debugging a Python application integrated with Application Insights. You notice that custom telemetry events generated in a background worker thread are not appearing in Application Insights. What is the most likely cause of this issue?

You are reviewing security logs in Azure Key Vault and notice unexpected access attempts from an unrecognized IP address. You need to immediately revoke all active Azure Active Directory tokens issued to a specific compromised user or service principal across your Azure AI applications. What action should you take?

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

You are designing an operational dashboard in Azure Monitor. Which TWO visualization components can you include in an Azure Workbook? (Choose two)

You want to ensure that your Azure AI infrastructure costs are properly attributed to different business departments. Which TWO features should you configure? (Choose two)

You need to ensure that PII (Personally Identifiable Information) detected in your AI application logs is automatically masked before it is persisted in Log Analytics. What is the recommended approach?

You need to analyze log queries across multiple AI applications and infrastructure components to identify custom performance bottlenecks. Which query language is used in Azure Monitor Log Analytics to write queries against collected log data?

You need to monitor the monthly cost of an Azure AI Document Intelligence resource to ensure it does not exceed a specified budget. Where should you configure an automated notification when the cost reaches 80% of the budget?

You are troubleshooting a slow-performing Azure AI Search service that indexes millions of documents. You want to check performance counters and query execution metrics using Azure Monitor. Which THREE of the following metrics or log categories are available for Azure AI Search? (Choose three)

Your machine learning engineering team needs to run training jobs on Azure Machine Learning compute clusters. To minimize costs during off-peak hours, you need to configure the compute cluster to automatically scale down to zero nodes when no jobs are queued, and scale up when jobs are submitted. What setting should you configure on the compute cluster?

You are configuring comprehensive observability for an intelligent application built on Azure AI Document Intelligence and Azure OpenAI. Which THREE telemetry types or tools should you configure in Application Insights to capture complete operational insights? (Choose three)

Your enterprise AI application is deployed across multiple Azure regions for high availability. You need to ensure that logs from Application Insights instances in all regions are aggregated into a single central Log Analytics workspace for unified querying. How should you configure this?

When configuring Azure Monitor alerts for an AI application, which TWO action types can be included in an Action Group to notify operations personnel? (Choose two)

You want to ensure that no AI services can be created in unauthorized Azure regions across your entire subscription. Which Azure governance tool should you use to enforce this restriction?

Your team is developing an AI solution that uses Azure Cognitive Services. You need to ensure that the API keys cannot be extracted from the client-side mobile application. What is the recommended architectural pattern to achieve this?

You want to monitor the security posture and compliance score of your Azure AI resources. Which TWO of the following tools should you use? (Choose two)

You need to export Azure Monitor metric and log data to an external SIEM solution for security auditing. Which Azure feature should you use to stream this telemetry in real-time to an external Event Hub?

Your enterprise AI solution runs across multiple subscriptions. You want to implement centralized cost allocation tags for all Azure AI resources to ensure every resource is tagged with 'CostCenter' and 'Environment'. Which Azure feature should you use to automatically audit and enforce these tags?

You are analyzing security and compliance logs in an Azure Log Analytics workspace. You want to write KQL queries to investigate potential security incidents or token acquisition failures. Which THREE of the following KQL tables or operators are valid and useful for this investigation? (Choose three)

You are designing a secure enterprise AI architecture on Azure. Which TWO of the following practices should you implement to secure credentials and service access? (Choose two)

When monitoring an Azure OpenAI Service deployment using Azure Monitor, which TWO metrics are commonly tracked to evaluate throughput and capacity limits? (Choose two)

Your organization mandates that all data transferred between your Azure web application and Azure OpenAI Service must not traverse public internet routers, even within Azure's backbone. Which Azure networking configuration provides this guarantee?

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and utilizes Azure Key Vault to store secrets and API keys for cognitive services. You need to provide pods with secure, credential-less access to Azure Key Vault without storing connection strings in Kubernetes secrets or environment variables. Which integration should you implement?

You are auditing your Azure subscription for security best practices related to Azure AI resources. Which TWO of the following actions help enforce governance and security? (Choose two)

To optimize costs and monitor consumption for an Azure OpenAI deployment across multiple business units, which THREE practices should you implement? (Choose three)

You are investigating an incident where an AI model endpoint experienced a spike in memory consumption, resulting in Out-Of-Memory (OOM) container crashes. You want to query Log Analytics to find the exact container memory working set percentage across all replicas during the past 2 hours. Which table and KQL query should you use?

You are deploying an Azure OpenAI Service resource and must ensure that all traffic from your virtual network reaches the endpoint without traversing the public internet. Which feature should you configure?

You need to ensure that all data sent to Azure OpenAI Service is encrypted at rest using a custom encryption key that your organization controls and rotates. Which feature must you configure?

You need to restrict access to an Azure OpenAI resource so that only requests originating from a specific Azure Virtual Network are permitted. What should you configure?

You are troubleshooting a latency issue with an AI model deployed in a Virtual Machine. You suspect the issue is related to storage IOPS limits. Which tool should you use to check the storage performance metrics?

You want to check the current monthly spend on your Azure OpenAI Service resource and identify which model deployments are consuming the most budget. Which Azure portal tool should you use?

Your team is preparing an Azure AI application for production release. You need to implement robust monitoring and observability. Which TWO of the following steps should be taken? (Choose two)

You are auditing your Azure AI services to ensure that all API keys are rotated regularly. What is the recommended practice for managing credentials in an enterprise AI solution?

Which THREE logs or telemetry types should you collect in Azure Monitor to comprehensively troubleshoot an AI-powered web application?

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Your Python AI application is deployed to Azure App Service and connects to Azure Key Vault using a managed identity. Recently, you rotated the Key Vault secret value, but your App Service application is still retrieving the old secret value. What is the most likely reason for this behavior?

You have a custom machine learning model deployed as a managed online endpoint in Azure Machine Learning. You need to ensure that scoring requests made to the endpoint are encrypted in transit and that client authentication is enforced using JSON Web Tokens (JWT). What authentication method does the managed online endpoint support by default?

Your Azure Machine Learning workspace is secured inside a virtual network with private endpoints. To ensure that data scientists can securely train models and access data stores without exposing resources to the public internet, which THREE of the following configurations must be established? (Choose three)

Your enterprise security team mandates that all outbound traffic from your Azure Machine Learning workspace must pass through a centralized Azure Firewall, and no public IP addresses can be associated with workspace compute instances. Which workspace network isolation configuration should you select?

Your application makes frequent calls to Azure AI Document Intelligence. You need to ensure that if a transient network failure or HTTP 503 service unavailable error occurs, the Python SDK automatically retries the failed requests with exponential backoff. How should you initialize the client to support robust retry behavior?

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

You have configured distributed training for a large language model across multiple nodes in an Azure Machine Learning cluster. Training jobs are failing with socket timeout errors between nodes. You need to verify internal node-to-node communication and ensure that the underlying Network Security Group (NSG) rules permit communication on the required ports. Which ports must be open between nodes in the cluster?

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

Your company policy requires securing AI model endpoints by disabling public internet access and ensuring all API requests use secure managed identities. Which TWO actions must you take? (Choose two)

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

When troubleshooting a Python AI application integrated with Application Insights, you want to ensure comprehensive error tracking and telemetry collection. Which TWO of the following SDK practices should you implement? (Choose two)

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

An enterprise deployment of Azure OpenAI requires data encryption using a key that your security team fully manages and controls in Azure Key Vault. What must you configure?

Your development team needs to store API keys and connection strings for an Azure Cognitive Search service securely without embedding them in the source code. Where should you store these secrets?

A team member needs read-only access to view AI model deployment metrics in Azure Monitor but should not be able to change any resource settings. Which built-in role should you assign?

You are optimizing costs for an AI workload running on Azure Kubernetes Service (AKS). You notice that GPU node pools are underutilized during weekends. You want to scale down the GPU node pool to 0 nodes on weekends and scale back up on Monday mornings. What Kubernetes native feature or Azure integration should you use?

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

You want to create a centralized dashboard in the Azure portal that displays custom AI model performance metrics alongside infrastructure CPU and memory metrics. Which Azure Monitor feature should you create?

When analyzing cost reports in Azure Cost Management for your machine learning and AI services, which TWO grouping or filtering options help identify spending anomalies? (Choose two)