CCNA Security And Observability Questions

You are troubleshooting a scenario where an Azure App Service hosting an AI frontend cannot communicate with an Azure OpenAI endpoint secured by a private endpoint in a different virtual network. Which THREE of the following networking configurations should you verify? (Choose three)

You need to review the security recommendations provided by Microsoft for your Azure AI resources, such as enabling HTTPS-only traffic and configuring managed identities. Which Azure tool provides these prioritized security recommendations and a security score?

You are troubleshooting an AI application where users experience intermittent authentication failures when the application attempts to acquire tokens from Azure Active Directory for calling Cognitive Services. You want to inspect the exact HTTP status codes and error descriptions returned during token acquisition. Which namespace or log table should you analyze in Log Analytics?

You are configuring network security for an Azure Machine Learning workspace. Compute instances must be accessible via Jupyter Lab, but no public IP addresses can be associated with the compute instances. Which configuration is required?

Your Azure AI application sends requests to multiple cognitive services. You need to route diagnostic logs and metrics from your Azure OpenAI and Azure AI Language services to a centralized Log Analytics workspace across different resource groups. What is the recommended way to configure this?

You are using Application Insights to monitor a Retrieval-Augmented Generation (RAG) application. You need to log custom dimensions such as prompt token counts and user IDs alongside standard telemetry. Which class should you use in your C# application?

You are troubleshooting intermittent HTTP 429 (Too Many Requests) errors from an Azure OpenAI deployment. Which metric in Azure Monitor should you inspect to confirm whether token rate limits are being exceeded?

You need to secure access to an Azure AI Search service so that a Python web app running on Azure App Service can query indices without embedding API keys in configuration files. What is the most secure authentication mechanism to configure?

You need to check the health status of Azure AI services globally and see if any regional outages are currently impacting your deployed models. Which Azure tool should you consult?

You are optimizing an enterprise AI architecture for cost and performance. Which THREE of the following strategies effectively reduce Azure AI and infrastructure spending without sacrificing reliability? (Choose three)

Your Azure Machine Learning workspace is secured behind a virtual network with private endpoints. Data scientists need to access the workspace notebooks and compute instances securely from their on-premises corporate network without exposing management ports to the public internet. What hybrid networking feature should you establish?

Which TWO roles are commonly assigned when granting a managed identity access to consume Azure OpenAI services via Azure RBAC?

Your organization requires that all cognitive service keys stored in Azure Key Vault are automatically rotated every 90 days. What native Azure Key Vault feature should you configure to accomplish this?

Which TWO mechanisms can be used to monitor and optimize costs associated with Azure AI services?

Which THREE configuration steps are required when setting up a Private Endpoint for an Azure OpenAI resource?

Your organization requires strict network isolation for all Azure AI services. Which TWO of the following networking features should you configure to prevent public internet exposure? (Choose two)

Your team is running an AI copilot application that uses Azure OpenAI. To comply with data residency regulations, you need to verify that prompts and completions are processed entirely within a specific Azure region and that no data is persisted outside that region. Where can you verify regional data processing and residency commitments?

Your enterprise AI solution runs on Azure Kubernetes Service (AKS) and connects to Azure OpenAI. You need to ensure comprehensive security across network, identity, and secrets. Which THREE of the following configurations should you deploy? (Choose three)

You are investigating performance degradation in an Azure AI Search vector search index. You need to run a Kusto Query Language (KQL) query in Application Insights to analyze dependency durations for search queries. Which table should you query?

Your Azure AI application relies on Azure OpenAI and Azure AI Search. You need to troubleshoot a sudden surge in HTTP errors and latency. Which THREE of the following Azure Monitor / Application Insights features or tools should you use to diagnose the issue? (Choose three)

You are deploying an Azure OpenAI Service resource and need to ensure that API keys are not used for authentication. Which configuration should you apply?

You are troubleshooting a performance issue in an AI application where dependency calls to Azure OpenAI take significantly longer during periods of high traffic. You want to query Log Analytics to find the 95th percentile (p95) duration of all dependency calls to Azure OpenAI over the past 24 hours. Which KQL query should you execute?

You want to receive an email notification whenever monthly spending on your Azure OpenAI Service exceeds $5,000. Which Azure feature should you configure?

You need to secure an Azure Machine Learning workspace against data exfiltration. Which THREE configurations should you implement?

You need to monitor the monthly spending on Azure OpenAI token consumption and receive an alert when expenditures exceed a predefined threshold. Which tool should you use?

You are configuring diagnostic logging for an enterprise Azure OpenAI Service deployment. You need to forward logs to multiple destinations for security analysis and archiving. Which THREE of the following destinations are supported by Azure Monitor diagnostic settings? (Choose three)

An enterprise application uses Azure AI Search and needs to authenticate securely to an Azure OpenAI backend without exposing credentials in connection strings. What is the recommended approach?

You are troubleshooting a Python application that fails to connect to Azure Key Vault using a managed identity. You want to inspect the exact exception stack trace and identify whether the managed identity token request failed. Where should you look in your local development or cloud diagnostics?

You want to view an end-to-end distributed trace of a user request flowing from an Azure Front Door through an API Management gateway, into an Azure Function, and finally to an Azure OpenAI model call. Which Application Insights feature visualizes this entire call chain and highlights latency bottlenecks?

You need to view real-time log streams from an Azure Container App running a custom LangChain agent. Which Azure CLI command should you execute?

Which TWO Azure services or features can be used to securely store and reference secrets such as connection strings for an Azure AI Search service without hardcoding them?

You are troubleshooting a Python application that uses Azure SDK libraries to interact with Azure AI services. The application is flooding Log Analytics with excessive telemetry, causing unexpected cost increases. You want to dynamically adjust the sampling rate of Application Insights without redeploying application code. How can you achieve this?

You are configuring network security for an Azure AI Search service that indexes data from an Azure SQL Database. Both services are in the same region. You want to ensure that Azure AI Search can securely connect to Azure SQL Database without allowing inbound traffic from any public IP addresses. Which feature should you use on Azure SQL Database?

Your Python-based AI service runs on an Azure Virtual Machine and connects to Azure OpenAI. To adhere to security best practices, you decide to eliminate storage of credentials on the VM disk by enabling a system-assigned managed identity on the virtual machine. How does your Python code obtain an access token using this managed identity?

Your company policy requires all outbound traffic from an Azure Machine Learning workspace to pass through a centralized firewall. Which feature must be implemented?

Your Azure AI application encounters transient network errors when calling cognitive services. Which TWO strategies should you implement in your code or architecture to handle these failures gracefully? (Choose two)

You are securing an Azure AI Search service. Which THREE of the following actions are recommended for implementing a robust security posture? (Choose THREE)

Your development team wants to trace downstream calls made by a Semantic Kernel agent to Azure OpenAI and an external plugin. Which SDK package and feature should you integrate into your .NET application?

Your production Azure Machine Learning inference endpoint is failing due to unauthorized access attempts. You decide to use Managed Identities to secure the connection to an Azure Key Vault. What is the correct sequence of operations to ensure the scoring script can retrieve secrets?

Your enterprise AI system processes sensitive Personal Identifiable Information (PII). Compliance regulations require that audit logs capturing who accessed the AI endpoints must be retained immutably for 5 years without possibility of deletion. Where should you configure this immutability policy?

You want to monitor the health of your AI services. Which TWO of the following can be configured to alert you automatically when model latency exceeds a predefined threshold? (Choose TWO)

An enterprise application calls multiple Azure AI Language services. You need to trace requests across multiple distributed microservices to diagnose high latency issues. Which Azure Monitor capability should you implement?

Your team is using managed identities to connect an Azure App Service web app to an Azure OpenAI resource. The connection fails with a 403 Forbidden error. What is the most likely root cause?

You are troubleshooting a custom LLM application deployed to an Azure Kubernetes Service (AKS) cluster. Requests are failing intermittently with HTTP 429 errors from Azure OpenAI. You need to implement a resilient observability and retry strategy using Azure Monitor. Which metric should you monitor to identify throttling?

You have deployed an AI model in Azure Machine Learning. You want to set up an alert that triggers an email to the operations team whenever the CPU utilization of the compute instance exceeds 90% for longer than 15 minutes. Which Azure Monitor feature should you configure?

You want to set up an alert when the availability of your Azure AI custom model endpoint drops below 99%. Which Azure service should you use?

You are troubleshooting a live AI web application where users report intermittent 504 Gateway Timeout errors when submitting large text prompts to a custom model endpoint. You want to check if the backend inference container is timing out or crashing. Where should you examine container-level stdout/stderr logs in Azure Container Apps?

You are auditing an Azure AI platform for security vulnerabilities. You want to ensure that secrets, connection strings, and certificates are handled in compliance with security best practices. Which THREE of the following practices should you enforce? (Choose three)

You are configuring an Azure OpenAI service instance. You need to ensure that the service is only accessible from your corporate virtual network and that public internet access is completely disabled. Which configuration should you implement?

You are configuring role-based access control for an Azure AI Search service. A data scientist needs to index content and query documents, but must not be permitted to manage service-level keys or change admin configurations. Which built-in role should you assign?

You have an Azure OpenAI model deployment and need to monitor token consumption metrics over time to forecast future usage. Which tool provides pre-built charts for prompt and completion token counts?

You are setting up monitoring for a custom machine learning scoring script running inside an Azure Container Instance. You want to track custom metrics such as inference prediction confidence scores over time in Application Insights. How should you record these custom metrics in your Python scoring script?

You are monitoring a custom AI application using Application Insights. You need to track the duration of specific LLM prompt processing calls. Which telemetry type should you use to record this performance data?

Your data science team uses Azure Machine Learning notebooks. To prevent data exfiltration, you need to ensure that users cannot download datasets or trained model artifacts directly from the workspace to their local corporate laptops. Which feature should you configure?

You are deploying an Azure OpenAI Service resource in a secured virtual network. You need to ensure that client applications inside a peered virtual network can access the Azure OpenAI endpoint without traversing the public internet, while completely blocking public network access. Which feature should you configure?

Your organization wants to ensure that all Azure AI development follows strict security and observability standards. Which TWO of the following practices should be enforced across teams? (Choose two)

An Azure Machine Learning model is deployed to a Kubernetes cluster. Users report intermittent 503 errors. You suspect the underlying compute nodes are overloaded. Where should you look first to correlate these errors with infrastructure health?

An enterprise AI application experiences intermittent HTTP 429 (Too Many Requests) errors when calling Azure OpenAI Service during peak hours. You need to analyze the exact token consumption trends and throttling patterns over the past week. Where should you look first in Azure Monitor?

You are investigating performance degradation in an Azure Machine Learning inference pipeline. Which TWO of the following steps are appropriate for diagnosing the bottleneck? (Choose TWO)

You are debugging a Python application integrated with Application Insights. You notice that custom telemetry events generated in a background worker thread are not appearing in Application Insights. What is the most likely cause of this issue?

You are reviewing security logs in Azure Key Vault and notice unexpected access attempts from an unrecognized IP address. You need to immediately revoke all active Azure Active Directory tokens issued to a specific compromised user or service principal across your Azure AI applications. What action should you take?

You need to prevent accidental deletion of a production Azure OpenAI resource that contains critical customer deployment configurations. Which Azure resource lock configuration should you apply?

You are designing an operational dashboard in Azure Monitor. Which TWO visualization components can you include in an Azure Workbook? (Choose two)

You want to ensure that your Azure AI infrastructure costs are properly attributed to different business departments. Which TWO features should you configure? (Choose two)

You need to ensure that PII (Personally Identifiable Information) detected in your AI application logs is automatically masked before it is persisted in Log Analytics. What is the recommended approach?

You need to analyze log queries across multiple AI applications and infrastructure components to identify custom performance bottlenecks. Which query language is used in Azure Monitor Log Analytics to write queries against collected log data?

You need to monitor the monthly cost of an Azure AI Document Intelligence resource to ensure it does not exceed a specified budget. Where should you configure an automated notification when the cost reaches 80% of the budget?

You are troubleshooting a slow-performing Azure AI Search service that indexes millions of documents. You want to check performance counters and query execution metrics using Azure Monitor. Which THREE of the following metrics or log categories are available for Azure AI Search? (Choose three)

Your machine learning engineering team needs to run training jobs on Azure Machine Learning compute clusters. To minimize costs during off-peak hours, you need to configure the compute cluster to automatically scale down to zero nodes when no jobs are queued, and scale up when jobs are submitted. What setting should you configure on the compute cluster?

You are configuring comprehensive observability for an intelligent application built on Azure AI Document Intelligence and Azure OpenAI. Which THREE telemetry types or tools should you configure in Application Insights to capture complete operational insights? (Choose three)

Your enterprise AI application is deployed across multiple Azure regions for high availability. You need to ensure that logs from Application Insights instances in all regions are aggregated into a single central Log Analytics workspace for unified querying. How should you configure this?

When configuring Azure Monitor alerts for an AI application, which TWO action types can be included in an Action Group to notify operations personnel? (Choose two)

You want to ensure that no AI services can be created in unauthorized Azure regions across your entire subscription. Which Azure governance tool should you use to enforce this restriction?

Your team is developing an AI solution that uses Azure Cognitive Services. You need to ensure that the API keys cannot be extracted from the client-side mobile application. What is the recommended architectural pattern to achieve this?

You want to monitor the security posture and compliance score of your Azure AI resources. Which TWO of the following tools should you use? (Choose two)