Courseiva

CCNA Security And Observability Questions

22 of 97 questions · Page 2/2 · Security And Observability · Answers revealed

Practice these questionsDomain overviewAll questions
76
Multi-Selectmedium

Which THREE logs or telemetry types should you collect in Azure Monitor to comprehensively troubleshoot an AI-powered web application?

Select 3 answers
A.Application requests and response status codes.
B.Dependency tracking for calls to Azure OpenAI and Azure AI Search.
C.Azure Bastion audit logs.
D.Trace logs emitted by the application code.
E.Azure Firewall packet capture PCAP files.
AnswersA, B, D

Request and response telemetry captures HTTP status codes, latency and failure rates at the application boundary, exposing which AI-backed endpoints are failing. This satisfies the stem's requirement to comprehensively troubleshoot the AI-powered web application by correlating front-end behaviour with back-end AI calls.

Why this answer

Application Insights collects request telemetry, dependency tracking for API calls, and trace logs for debugging logic.

Practice this question →
77
Multi-Selecteasy

You are managing costs for an Azure AI solution and want to prevent unexpected budget overruns. Which TWO of the following cost monitoring and governance tools can you use? (Choose two)

Select 2 answers
A.Azure Advisor cost recommendations
B.Azure Bastion subnet configuration
C.Azure Key Vault access policies
D.Azure Service Health incident dashboard
E.Azure Cost Management budgets and alerts
AnswersA, E

Azure Advisor analyses resource configuration and usage to surface cost recommendations, such as right-sizing or removing idle resources, letting you act before spend escalates. It provides the governance insight needed to prevent unexpected budget overruns in the AI solution.

Why this answer

Azure Advisor cost recommendations (A) is correct because it analyzes resource usage and configuration and surfaces actionable recommendations to reduce spend, such as rightsizing or shutting down idle resources, which directly helps prevent budget overruns. Azure Cost Management budgets and alerts (E) is correct because you can define a budget threshold and configure alerts that trigger when actual or forecasted costs approach or exceed that amount, enabling proactive governance. Azure Bastion subnet configuration (B) is incorrect because it concerns secure RDP/SSH connectivity to VMs, not cost monitoring or governance.

Azure Key Vault access policies (C) is incorrect because it governs secrets, keys, and certificate permissions, not spending. Azure Service Health incident dashboard (D) is incorrect because it reports platform outages and service issues, not cost or budget data.

Exam trap

AI-200 often tests whether candidates confuse general Azure governance services (Advisor, Cost Management) with unrelated services like Bastion, Key Vault, or Service Health, which sound administrative but have no cost-monitoring capability.

Practice this question →
78
MCQmedium

Your enterprise security team mandates that all outbound traffic from your Azure Machine Learning workspace must pass through a centralized Azure Firewall, and no public IP addresses can be associated with workspace compute instances. Which workspace network isolation configuration should you select?

A.Public workspace with basic password authentication enabled on compute instances
B.Workspace using dynamic public IP allocation with Network Security Group (NSG) allow rules
C.Serverless compute instances with public endpoint access enabled
D.Workspace with a managed virtual network and outbound rules configured for user-defined routing through Azure Firewall
AnswerD

A managed virtual network isolates compute with no public IPs, and outbound rules let you force egress through your Azure Firewall via user-defined routes. This meets both constraints: centralised firewall inspection and no public IP addresses on compute instances.

Why this answer

To route all outbound traffic through a centralized Azure Firewall and prevent public IPs on compute instances, you must use a workspace with a managed virtual network and configure outbound rules for user-defined routing (UDR) through the firewall. This setup isolates compute in a private network and forces egress via the firewall.

Exam trap

AI-200 often tests the difference between public and private workspace configurations; candidates may choose NSG-based options thinking they provide isolation, but only managed VNet with UDR enforces no public IPs and centralized egress.

How to eliminate wrong answers

Option A is wrong because a public workspace with basic password authentication does not provide network isolation and allows public endpoints. Option B is wrong because dynamic public IP allocation with NSG rules still exposes compute instances to the internet and does not force traffic through Azure Firewall. Option C is wrong because serverless compute with public endpoint access enabled directly contradicts the requirement of no public IPs and centralized egress control.

Practice this question →
79
MCQmedium

Your application makes frequent calls to Azure AI Document Intelligence. You need to ensure that if a transient network failure or HTTP 503 service unavailable error occurs, the Python SDK automatically retries the failed requests with exponential backoff. How should you initialize the client to support robust retry behavior?

A.Write a custom infinite while loop wrapping every API call without sleep intervals
B.Disable all exception handling so the application crashes immediately on error
C.Configure Azure Traffic Manager with failover routing priorities
D.Instantiate the client with custom retry policy parameters (e.g., retry_total, retry_backoff_factor)
AnswerD

Passing retry_total and retry_backoff_factor configures the SDK's retry policy, enabling automatic retries with exponential backoff on transient failures and HTTP 503 responses. This satisfies the requirement for robust, automatic retry behaviour without custom wrapper code.

Why this answer

The Azure SDK for Python (azure-ai-documentintelligence / azure-ai-formrecognizer) exposes a retry policy through the client constructor, where you can pass retry_total, retry_backoff_factor, retry_on_status_codes, and related kwargs. Setting retry_backoff_factor enables exponential backoff automatically, and retry_total caps the number of attempts. This is the SDK-native, supported way to handle transient 503s and socket errors without hand-rolling logic.

Exam trap

AI-200 often tests whether candidates reach for infrastructure-level solutions (Traffic Manager, custom loops) when the correct answer is a client-side SDK configuration parameter that already implements exponential backoff.

How to eliminate wrong answers

Option A is wrong because an infinite while loop with no sleep creates a tight retry storm that hammers the service, ignores exponential backoff, and can trigger throttling or runaway costs. Option B is wrong because disabling exception handling causes immediate crashes on transient errors, which is the opposite of robust retry behavior. Option C is wrong because Azure Traffic Manager is DNS-level global routing for regional failover, not per-request retry logic inside a Python SDK client.

Practice this question →
80
MCQeasy

You are developing an AI application in Azure and need to monitor custom telemetry, trace dependencies, and track dependency failures for calls made to an external machine learning model endpoint. Which Azure service should you use?

A.Azure Advisor
B.Microsoft Defender for Cloud
C.Azure Policy
D.Application Insights
AnswerD

Application Insights provides distributed tracing, dependency tracking and custom telemetry through the Azure Monitor SDK, capturing outbound calls to the external model endpoint and their failures. This satisfies the requirement to trace dependencies and monitor custom telemetry.

Why this answer

Application Insights is Azure's application performance monitoring (APM) service, providing custom telemetry via the SDK, distributed tracing across dependencies, and failure tracking for outbound calls. It is the correct choice for monitoring an AI app's calls to an external ML endpoint, including latency, failure rates, and dependency maps.

Exam trap

AI-200 often tests whether candidates confuse monitoring/APM (Application Insights) with governance (Azure Policy) or security posture (Defender for Cloud), luring them toward services that do not collect runtime telemetry.

How to eliminate wrong answers

Option A is wrong because Azure Advisor gives best-practice recommendations on cost, security, reliability, and performance — it does not collect application telemetry or trace dependencies. Option B is wrong because Microsoft Defender for Cloud is a cloud security posture and workload protection service (CSPM/CWPP), not an APM tool. Option C is wrong because Azure Policy governs resource compliance and configuration, not runtime application telemetry.

Practice this question →
81
MCQhard

Your team has noticed a significant cost spike in your Azure OpenAI usage. You need to identify which specific deployment is responsible for the highest token consumption. Which tool provides the most granular visibility into this data?

A.Azure Monitor metrics with splitting on the 'DeploymentName' dimension.
B.Azure Advisor cost recommendations.
C.Application Insights logs via KQL query on the 'requests' table.
D.Azure Cost Management analysis on the resource group.
AnswerA

Azure Monitor metrics expose token usage split by the 'DeploymentName' dimension, isolating consumption per deployment. This granularity identifies which specific deployment drives the cost spike, unlike aggregated billing views that cannot attribute spend to individual deployments.

Why this answer

Azure Monitor platform metrics for Azure OpenAI expose a 'DeploymentName' dimension on metrics such as TokenTransaction, ProcessedPromptTokens, and GeneratedCompletionTokens. Splitting on that dimension gives per-deployment token consumption, which is the most granular native view for attributing cost to a specific deployment.

Exam trap

The trap here is assuming Application Insights or Cost Management gives per-deployment token detail, when only Azure Monitor platform metrics with the DeploymentName dimension natively provide that granularity.

How to eliminate wrong answers

Option B is wrong because Azure Advisor provides high-level cost recommendations and does not break down token usage per deployment. Option C is wrong because Application Insights 'requests' table captures request telemetry only if the app is instrumented and does not natively expose token counts per deployment without custom logging. Option D is wrong because Azure Cost Management aggregates spend at the resource or resource-group level and cannot attribute cost to an individual model deployment.

Practice this question →
82
MCQeasy

You want to find out which Azure subscriptions and resource groups are incurring the highest costs for Azure Machine Learning compute instances this month. Where should you view this cost breakdown?

A.Azure Advisor security dashboard
B.Application Insights availability tests
C.Azure Monitor Metric alerts
D.Cost Analysis grouped by Resource Group and filtered by Service Name 'Machine Learning'
AnswerD

Cost Analysis supports grouping by Resource Group and filtering by Service Name, so filtering 'Machine Learning' isolates compute instance spend and grouping reveals the highest-cost subscriptions and resource groups, satisfying the stem's breakdown requirement precisely.

Why this answer

Cost Analysis in Azure Cost Management allows you to group and filter costs by subscription, resource group, and resource type.

Practice this question →
83
MCQhard

An AI application hosted in Azure App Service throws intermittent socket exhaustion errors under heavy load when calling Azure OpenAI. You suspect improper HTTP client management. How should you fix this in .NET?

A.Configure a private endpoint between the App Service and Azure OpenAI.
B.Use IHttpClientFactory to manage client lifecycles instead of instantiating new HttpClient objects per request.
C.Enable Always On in the App Service configuration settings.
D.Increase the TCP keep-alive timeout on the Azure App Service instance configuration.
AnswerB

IHttpClientFactory pools and recycles underlying HttpMessageHandler instances, so sockets are reused rather than exhausted. Creating a new HttpClient per request leaves handlers undisposed, exhausting ephemeral ports under load. The factory directly resolves the intermittent socket exhaustion constraint.

Why this answer

In .NET, creating a new HttpClient per request leads to socket exhaustion because each instance holds its own connection pool and disposed clients leave sockets in TIME_WAIT. IHttpClientFactory pools and reuses HttpMessageHandler instances, resolving the exhaustion while still allowing per-request client configuration.

Exam trap

AI-200 often tests whether candidates recognize socket exhaustion as an HttpClient lifecycle issue rather than a networking or App Service configuration issue, luring them toward private endpoints or Always On.

How to eliminate wrong answers

Option A is wrong because a private endpoint addresses network isolation and does not fix socket lifecycle management. Option C is wrong because Always On keeps the App Service warm but does not affect HttpClient socket reuse. Option D is wrong because increasing TCP keep-alive does not address the root cause of creating and disposing HttpClient instances per request.

Practice this question →
84
MCQhard

Your Azure OpenAI model deployment is experiencing a sudden latency spike. You want to determine if the bottleneck is due to server-side processing time or network transport overhead in your client application. Which Application Insights telemetry property should you inspect?

A.Dependency telemetry duration compared against custom client-side timers wrapping the API call
B.Azure Storage replication lag metrics
C.Azure Advisor performance score
D.Azure Policy compliance evaluation duration
AnswerA

Comparing dependency telemetry duration with custom client-side timers isolates server-side processing from network transport: the dependency duration captures the outbound call as measured by the SDK, while your own timer wraps the full round trip. Any gap between them quantifies transport and client overhead, directly satisfying the stem's requirement to separate the two latency sources.

Why this answer

Application Insights dependency telemetry records the duration of outbound calls (including Azure OpenAI) as measured server-side by the SDK, so comparing that duration against a custom client-side timer that wraps the same API call isolates network/transport overhead from server processing time. If the client timer is much larger than the dependency duration, the delta is transport or client-side latency.

Exam trap

AI-200 often tests whether candidates can distinguish server-side telemetry (dependency duration) from end-to-end client measurement — picking a governance or cost tool instead of Application Insights dependency data is the common wrong path.

How to eliminate wrong answers

Option B is wrong because Azure Storage replication lag is unrelated to Azure OpenAI inference latency and would not appear in Application Insights dependency data for the model call. Option C is wrong because Azure Advisor performance scores are periodic best-practice recommendations, not per-request latency telemetry. Option D is wrong because Azure Policy compliance evaluation duration measures governance scan time, not API call latency.

Practice this question →
85
MCQeasy

You are managing costs for multiple Azure AI services used by different business units. You need to track expenditure against specific departmental budgets and receive automated alerts when spending exceeds 80% of the allocated budget. Which Azure feature should you use?

A.Azure Advisor cost recommendations
B.Azure Monitor autoscale settings
C.Azure Cost Management Budgets with alert conditions
D.Azure Service Health alerts
AnswerC

Azure Cost Management Budgets let you set a monetary threshold scoped to a department and trigger alert conditions when actual or forecast spend reaches 80%. This directly satisfies the requirement to track expenditure against specific budgets with automated notifications.

Why this answer

Azure Cost Management Budgets let you define a monetary threshold scoped to a subscription, resource group, or specific resource, and attach alert conditions (e.g., 80% of budget) that fire via email or Action Groups. This is the only native Azure feature that directly ties spend tracking to a departmental budget with automated threshold alerts. Budgets can be filtered by tag, resource group, or service, so each business unit's AI spend can be isolated.

Exam trap

The trap here is confusing cost governance features (Budgets, Advisor) with operational monitoring features (Azure Monitor, Service Health) — only Budgets actually enforce spend thresholds with alerts.

How to eliminate wrong answers

Option A is wrong because Azure Advisor cost recommendations only surface optimization suggestions (e.g., right-size VMs); they do not track spend against a budget or send threshold alerts. Option B is wrong because Azure Monitor autoscale adjusts resource instance counts based on load metrics, not monetary budgets. Option D is wrong because Azure Service Health alerts notify about platform incidents and planned maintenance, not cost thresholds.

Practice this question →
86
Multi-Selectmedium

Your company policy requires securing AI model endpoints by disabling public internet access and ensuring all API requests use secure managed identities. Which TWO actions must you take? (Choose two)

Select 2 answers
A.Disable public network access on the Azure AI service resource and configure a private endpoint.
B.Expose the AI endpoint via an unencrypted HTTP binding for maximum performance.
C.Store all AI model weights and endpoint keys in public GitHub repositories for CI/CD access.
D.Configure a shared access signature (SAS) token with a 10-year expiration period.
E.Assign the appropriate Azure RBAC role to the application's managed identity on the AI service.
AnswersA, E

Disabling public network access removes the internet-facing route to the Azure AI resource, while a private endpoint assigns it a private IP inside your virtual network. Together they satisfy the policy's isolation requirement, forcing all traffic through your VNet rather than the public internet.

Why this answer

Option A is correct because disabling public network access on the Azure AI service resource and configuring a private endpoint ensures the endpoint is reachable only through a private IP address inside the virtual network, satisfying the requirement to remove public internet exposure. Option E is correct because assigning the appropriate Azure RBAC role (for example, Cognitive Services User or equivalent) to the application's managed identity on the AI service enables token-based, keyless authentication via Microsoft Entra ID, which is exactly how secure managed identities are used for API requests. Option B is wrong because an unencrypted HTTP binding violates the security requirement and offers no managed identity authentication.

Option C is wrong because storing model weights and endpoint keys in public GitHub repositories exposes secrets and is a severe security violation. Option D is wrong because a long-lived SAS token is a shared secret credential, not a managed identity, and a 10-year expiration creates an unacceptable security risk.

Exam trap

AI-200 often tests the misconception that a SAS token or API key rotation is equivalent to managed-identity authentication, when the exam explicitly requires keyless Entra ID access plus network isolation.

Practice this question →
87
MCQeasy

You need to ensure that traffic between your Azure App Service hosting an AI wrapper and your Azure AI Search instance does not traverse the public internet. Which feature should you implement?

A.Enable Cross-Origin Resource Sharing (CORS) with a restricted origin list.
B.Enable TLS mutual authentication (mTLS) on the Azure AI Search service.
C.Configure a Private Endpoint for the Azure AI Search service and integrate your App Service with the virtual network.
D.Configure IP access control lists on the Azure AI Search firewall to allow only the App Service outbound IPs.
AnswerC

A Private Endpoint assigns Azure AI Search a private IP inside your virtual network, and App Service virtual network integration routes traffic over that private path. This keeps queries off the public internet, satisfying the stem's no-public-internet constraint.

Why this answer

Azure Private Endpoint provides private IP addresses from your VNet to securely connect to Azure AI Search, keeping traffic off the public internet.

Practice this question →
88
MCQeasy

You are setting up Azure Monitor alerts for an Azure AI Search service. You want an SMS message to be sent to the on-call engineer whenever the search query latency exceeds 500ms. What component of Azure Monitor links the metric alert to the SMS notification channel?

A.Azure Service Health
B.Log Analytics workspace
C.Action group
D.Diagnostic setting
AnswerC

An action group holds the notification actions, including SMS, and is referenced by the alert rule. When query latency exceeds 500ms, the metric alert fires and triggers the action group, which sends the SMS to the on-call engineer.

Why this answer

An action group in Azure Monitor defines the set of notifications and actions that fire when an alert rule is triggered. When you create a metric alert for search query latency, you attach an action group that contains the SMS receiver (phone number) for the on-call engineer. The action group is the binding layer between the alert rule's condition and the notification channel, so it is the correct component here.

Exam trap

AI-200 often tests whether candidates confuse the alert rule (the condition) with the action group (the notification/action binding), so the trap is picking a telemetry-routing or health service instead of the component that actually delivers the SMS.

How to eliminate wrong answers

Option A is wrong because Azure Service Health reports platform-wide outages, planned maintenance, and advisories for Azure services — it does not deliver metric-threshold notifications for your own resources. Option B is wrong because a Log Analytics workspace is a data store and query engine for logs and metrics; it can host log-based alerts but does not itself define SMS notification channels. Option D is wrong because a diagnostic setting routes resource telemetry (logs/metrics) to destinations such as Log Analytics, Storage, or Event Hubs — it does not send notifications to people.

Practice this question →
89
MCQhard

You are auditing an Azure AI solution for security compliance. You discover that developers have been hardcoding storage account connection strings in source code repositories. You need to remediate this immediately by migrating secrets to Azure Key Vault and ensuring your Python application retrieves them securely at runtime using a managed identity. Which Python library and credential class should your code use?

A.pyodbc with direct ODBC connection strings containing embedded passwords
B.azure-storage-blob with StorageSharedKeyCredential initialized with plain-text keys
C.azure-identity package with DefaultAzureCredential and azure-keyvault-secrets
D.requests library making direct REST calls with master subscription keys
AnswerC

The azure-identity package's DefaultAzureCredential authenticates the Python application to Key Vault via the managed identity, eliminating hardcoded connection strings. Combined with azure-keyvault-secrets, SecretClient retrieves secrets at runtime, satisfying the requirement to remove credentials from source code and authenticate without stored passwords.

Why this answer

The azure-identity package with DefaultAzureCredential combined with azure-keyvault-secrets is the correct approach: DefaultAzureCredential automatically chains managed identity, environment credentials, and developer credentials, so the app authenticates to Key Vault without hardcoded secrets, then retrieves the storage connection string at runtime. This eliminates secrets from source code and supports passwordless authentication. It is the Microsoft-recommended pattern for secure secret retrieval in Python.

Exam trap

AI-200 often tests whether candidates pick a credential class that still requires a plain-text key (like StorageSharedKeyCredential) instead of the passwordless DefaultAzureCredential plus Key Vault pattern.

How to eliminate wrong answers

Option A is wrong because pyodbc with embedded passwords in ODBC connection strings perpetuates the exact hardcoding problem being remediated and does not use managed identity or Key Vault. Option B is wrong because StorageSharedKeyCredential requires a plain-text account key, which is itself a secret that must be stored and rotated; it does not solve the hardcoding issue and bypasses Key Vault. Option D is wrong because direct REST calls with master subscription keys embed privileged credentials in code and do not use managed identity, Key Vault, or the azure-identity credential chain.

Practice this question →
90
Multi-Selectmedium

When troubleshooting a Python AI application integrated with Application Insights, you want to ensure comprehensive error tracking and telemetry collection. Which TWO of the following SDK practices should you implement? (Choose two)

Select 2 answers
A.Disable the Application Insights telemetry client entirely in production to save bandwidth.
B.Wrap unhandled exception handling with telemetry_client.track_exception() to capture stack traces.
C.Route all application logs exclusively to local text files on ephemeral container storage.
D.Explicitly call telemetry_client.flush() before application exit to ensure buffered items are transmitted.
E.Store plain-text passwords in telemetry custom dimensions.
AnswersB, D

Wrapping unhandled exceptions with `telemetry_client.track_exception()` captures full stack traces and exception details, satisfying the stem's requirement for comprehensive error tracking. Unlike generic logging, this method records the exception type, message and traceback as structured telemetry in Application Insights, enabling precise failure diagnosis across the Python AI application.

Why this answer

Option B is correct because telemetry_client.track_exception() explicitly records exception details, including the exception type, message, and stack trace, into Application Insights, which is essential for diagnosing unhandled errors in a Python AI application. Option D is correct because the Application Insights SDK buffers telemetry and sends it asynchronously; calling telemetry_client.flush() before the process exits ensures buffered items are transmitted rather than lost, which is critical in short-lived or containerized workloads. Option A is wrong because disabling the telemetry client in production eliminates the error tracking and telemetry collection the scenario requires.

Option C is wrong because routing logs only to local text files on ephemeral container storage means they are lost when the container is recycled and never reach Application Insights. Option E is wrong because storing plain-text passwords in custom dimensions exposes secrets in telemetry data and violates security best practices.

Exam trap

AI-200 often tests the misconception that telemetry is sent immediately and reliably; candidates forget that the SDK buffers telemetry and that flush() is required on exit, and they may also overlook that track_exception() is the correct API for capturing stack traces rather than relying on default logging.

Practice this question →
91
MCQmedium

Your AI application is hosted on Azure App Service and connects to Azure Cosmos DB and Azure OpenAI. You want to ensure that if credentials or connection strings ever leak, they cannot be used from unauthorized networks. Which feature should you implement?

A.Disabling managed identities across all application components
B.IP firewall rules and virtual network service rules on the backend services restricting access to App Service
C.Configuring Azure Front Door with SSL offloading only
D.Enabling public anonymous access with client-side rate limiting
AnswerB

IP firewall rules and virtual network service rules on Cosmos DB and Azure OpenAI restrict backend access to traffic originating from the App Service's outbound addresses or delegated subnet. Even if credentials leak, requests from unauthorised networks are rejected at the service boundary.

Why this answer

To prevent leaked credentials from being used from unauthorized networks, you should implement IP firewall rules and virtual network service rules on the backend services (Azure Cosmos DB and Azure OpenAI) to restrict access to only the App Service's outbound IP addresses or its virtual network. This ensures that even if credentials leak, they cannot be used from outside the allowed network.

Exam trap

AI-200 often tests network security controls. Candidates might focus on authentication or front-end security, but the question specifically asks about restricting access from unauthorized networks, which is achieved via IP firewall and virtual network rules.

How to eliminate wrong answers

Option A is wrong because disabling managed identities would remove a secure authentication method and is not a security best practice. Option C is wrong because Azure Front Door with SSL offloading only handles incoming traffic to the app; it does not restrict access to backend services based on network. Option D is wrong because enabling public anonymous access with client-side rate limiting is insecure and does not prevent unauthorized network access.

Practice this question →
92
MCQhard

An enterprise deployment of Azure OpenAI requires data encryption using a key that your security team fully manages and controls in Azure Key Vault. What must you configure?

A.Store the API keys in Azure Key Vault and enable automatic rotation every 7 days.
B.Configure Customer-Managed Keys (CMK) using an Azure Key Vault key with soft-delete and purge protection enabled, linked via a managed identity.
C.Configure infrastructure encryption at rest using a Microsoft-managed default key.
D.Enable Always Encrypted on the Azure OpenAI resource configuration plane.
AnswerB

Customer-Managed Keys wrap the data encryption key with a key your team owns in Azure Key Vault, so Microsoft cannot access it. Soft-delete and purge protection prevent irreversible key loss, and the managed identity grants Azure OpenAI secure access without storing credentials.

Why this answer

Customer-Managed Keys (CMK) let you encrypt Azure OpenAI data with a key you own in Azure Key Vault, and the resource accesses it via a managed identity. Soft-delete and purge protection must be enabled on the vault so the key cannot be permanently destroyed, which would render the data unrecoverable. This is the only option that gives the security team full control of the key lifecycle.

Exam trap

AI-200 often tests the misconception that storing API keys in Key Vault equals customer-managed encryption — candidates confuse secret management with CMK data encryption.

How to eliminate wrong answers

Option A is wrong because storing API keys in Key Vault is secret management, not data encryption — it does not make the security team the owner of the encryption key. Option C is wrong because Microsoft-managed keys mean Microsoft controls the key lifecycle, which contradicts the requirement for customer control. Option D is wrong because Always Encrypted is a SQL Server/Azure SQL feature and does not apply to the Azure OpenAI resource configuration plane.

Practice this question →
93
MCQeasy

Your development team needs to store API keys and connection strings for an Azure Cognitive Search service securely without embedding them in the source code. Where should you store these secrets?

A.An Azure Storage Table with public read permissions
B.An environment variable in the application's appsettings.json file
C.Azure Key Vault
D.The Azure AI Studio model deployment configuration metadata
AnswerC

Azure Key Vault stores secrets such as API keys and connection strings in a hardened, access-controlled vault, letting applications retrieve them at runtime via managed identities instead of hard-coding them. This satisfies the stem's constraint of keeping credentials out of source code.

Why this answer

Azure Key Vault is the dedicated Azure service for storing and tightly controlling access to secrets, keys, and certificates. Storing API keys and connection strings there keeps them out of source code and enables RBAC, auditing, and managed identity access.

Exam trap

AI-200 often tests whether candidates confuse configuration management (appsettings.json, environment variables) with secret management, leading them to pick a file-based option that still exposes credentials.

How to eliminate wrong answers

Option A is wrong because an Azure Storage Table with public read permissions exposes secrets to anyone with the URL, a severe security violation. Option B is wrong because appsettings.json is source-controlled configuration and embedding secrets there leaks them into repositories and build artifacts. Option D is wrong because AI Studio deployment metadata is not a secrets store and does not provide access control or auditing for credentials.

Practice this question →
94
MCQeasy

A team member needs read-only access to view AI model deployment metrics in Azure Monitor but should not be able to change any resource settings. Which built-in role should you assign?

A.Reader
B.Log Analytics Reader
C.Monitoring Reader
D.Contributor
AnswerC

Monitoring Reader grants read-only access to monitoring data and metrics across Azure Monitor without permitting changes to resource settings. It satisfies the least-privilege requirement, unlike Contributor or Owner, which would allow configuration modifications the team member must not perform.

Why this answer

The 'Monitoring Reader' role provides sufficient permissions to view all monitoring data, including metrics and logs, without allowing modifications.

Practice this question →
95
MCQeasy

You want to set up an alert that notifies you whenever an Azure AI service resource is deleted or modified in your subscription. Which Azure feature should you use to capture these management-plane operations?

A.Azure Cost Management budget alert
B.Azure Monitor Activity Log alert
C.Azure Advisor recommendation alert
D.Application Insights availability test
AnswerB

Activity Log alerts capture management-plane operations such as resource deletion or modification across the subscription, which is exactly the control-plane scope the stem describes. Metric alerts and resource health cover performance or availability signals instead, so they cannot detect these administrative changes.

Why this answer

Azure Monitor Activity Log alerts capture subscription-level management-plane events such as resource creation, deletion, and modification, making them the correct choice for notifying on resource changes. Activity Log records control-plane operations across all Azure resources in a subscription. This is distinct from metric or log alerts, which target resource telemetry rather than management operations.

Exam trap

AI-200 often tests the confusion between control-plane (Activity Log) and data-plane (resource/diagnostic logs) monitoring, so candidates pick Application Insights or Advisor when the question is about resource lifecycle events.

How to eliminate wrong answers

Option A is wrong because Cost Management budget alerts only fire when spending crosses defined thresholds — they have no visibility into resource create/delete/modify events. Option C is wrong because Azure Advisor recommendation alerts notify on new Advisor recommendations (cost, security, reliability suggestions), not on management-plane operations. Option D is wrong because Application Insights availability tests are synthetic HTTP probes that measure endpoint uptime from external locations, not subscription-level resource changes.

Practice this question →
96
MCQeasy

You want to create a centralized dashboard in the Azure portal that displays custom AI model performance metrics alongside infrastructure CPU and memory metrics. Which Azure Monitor feature should you create?

A.Azure Workbook
B.Azure Service Bus queue
C.Azure Key Vault access policy
D.Azure Container Registry webhook
AnswerA

Azure Workbook combines multiple data sources, including custom metrics and platform metrics, into a single interactive report. It satisfies the stem's requirement to display AI model performance alongside infrastructure CPU and memory metrics in one centralised Azure portal dashboard.

Why this answer

Azure Workbook is the correct choice because it provides a flexible canvas for combining and visualizing data from multiple sources, including custom metrics from AI models and infrastructure metrics like CPU and memory. Workbooks allow you to create interactive reports and dashboards that can be shared across teams, making them ideal for centralized monitoring. They support parameters, charts, grids, and text, enabling a unified view of disparate telemetry.

Exam trap

AI-200 often tests the distinction between monitoring and visualization tools versus other Azure services that serve different purposes, such as messaging, security, or container management.

How to eliminate wrong answers

Option B is wrong because Azure Service Bus queue is a messaging service for decoupling applications, not a monitoring or dashboard tool. Option C is wrong because Azure Key Vault access policy controls permissions to secrets, keys, and certificates, not visualization of metrics. Option D is wrong because Azure Container Registry webhook triggers actions on container image events, not for displaying metrics.

Practice this question →
97
Multi-Selectmedium

When analyzing cost reports in Azure Cost Management for your machine learning and AI services, which TWO grouping or filtering options help identify spending anomalies? (Choose two)

Select 2 answers
A.Filter by Service Name (e.g., 'Cognitive Services' or 'Machine Learning') to track specific AI spend.
B.Group costs by Application Insights trace message text.
C.Group costs by virtual machine mouse device driver versions.
D.Filter by Azure DNS record TTL settings.
E.Group costs by Resource Group or Resource Name to pinpoint expensive workloads.
AnswersA, E

Filtering by Service Name isolates charges such as Cognitive Services or Machine Learning, removing unrelated subscription spend so an AI-specific cost spike becomes visible. This satisfies the stem's requirement for a filtering option that identifies spending anomalies in AI services.

Why this answer

Option A is correct because Azure Cost Management supports filtering by Service Name (the meter's service, such as 'Cognitive Services' or 'Machine Learning'), which isolates AI-related charges so anomalies in those specific services become visible against the rest of the bill. Option E is correct because grouping by Resource Group or Resource Name aggregates costs per workload, letting you pinpoint which specific ML/AI resource (for example, a GPU-enabled VM or an Azure Machine Learning workspace) is driving an unexpected spike. Options B, C, and D are incorrect because Application Insights trace message text, VM mouse device driver versions, and Azure DNS record TTL settings are not cost dimensions in Cost Management; they are telemetry, hardware, and DNS configuration data respectively, and none of them can be used to group or filter cost report data.

Exam trap

AI-200 often tests whether candidates recognize that Cost Management only groups/filters on real cost dimensions (service, resource, tag, meter) — options referencing log text, driver versions, or DNS TTL are distractors.

Practice this question →
← PreviousPage 2 of 2 · 97 questions total

Ready to test yourself?

Try a timed practice session using only Security And Observability questions.

Start 20-question session