CCNA Ml Model Lifecycle And Operations Questions

Model accuracy (A) is a standard evaluation metric that can be logged during training via mlflow.log_metric or Run.log in Azure ML to track how well the model predicts correct labels. Custom metrics (C) are explicitly supported through the Azure ML SDK and MLflow APIs, allowing you to log any domain-specific numeric value (e.g., F1 score, AUC, business KPIs) with log_metric or log_row. Training loss (E) is a core optimization metric that is routinely logged per epoch or step to monitor convergence and detect overfitting.

The unmarked options do not belong because a compute instance IP address (B) is infrastructure metadata, not a performance metric, and a workspace subscription ID (D) is an Azure resource identifier used for billing and access control, not a training performance measurement.

Option B is correct because registering the model in the Azure ML Model Registry with versioning creates an immutable, uniquely identifiable record (name:version) that links each deployed artifact to its exact lineage, enabling rollback and audit. Option C is correct because adding experiment tags to the model artifact attaches metadata such as run ID, dataset version, and git commit, which are queryable and provide the contextual provenance needed to trace a model back to its training experiment. Option E is correct because storing the training script hash in the model properties creates a cryptographic fingerprint that proves which exact code produced the model, ensuring reproducibility and detecting any drift between the deployed model and its source code.

Option A is not appropriate because a shared local folder is not versioned, not immutable, and not accessible across pipeline agents, so it cannot guarantee traceability. Option D is incorrect because deleting training logs destroys the audit trail and provenance evidence required for traceability.

In Azure Machine Learning, experiment lineage (reproducibility tracking) records the artifacts needed to reproduce a run: option B, the training code/snapshot, is captured because Azure ML stores a snapshot of the script/notebook submitted for the run in the experiment's output/artifact store. Option C, the used datasets, is captured because each run logs the input dataset references (name/version or datastore path) so the exact data used can be traced. Option D, the environment definition, is captured because the run records the Azure ML environment (Docker image, conda/pip dependencies, and environment version/hash) that executed the training.

Option A, hardware manufacturer, is not tracked as lineage — Azure ML logs the compute SKU/size and node information, not the physical hardware vendor. Option E, number of team members, is not part of experiment lineage; it is workspace/identity metadata unrelated to run reproducibility.

Option B (Compute cluster) is correct because an Azure Machine Learning workspace hosts managed compute resources such as compute clusters (AmlCompute), which are used to run training pipelines and jobs and are created as child resources of the workspace. Option E (Datastore) is correct because a datastore is a workspace-level resource that stores connection information to Azure storage services (Blob, File, Data Lake, SQL) so experiments can access data without embedding credentials. Option A (External website) is not a workspace resource; a workspace does not create or manage public websites.

Option C (Azure Active Directory) is incorrect because Microsoft Entra ID (Azure AD) is a tenant-level identity service that exists independently and is only associated with the workspace for authentication, not created inside it. Option D (Office 365 tenant) is incorrect because an Office 365 tenant is a separate Microsoft 365 organizational boundary unrelated to Azure Machine Learning workspace resources.

Compute Cluster (B) is correct because it is Azure Machine Learning's managed, scalable multi-node compute target designed specifically for training and batch scoring jobs, supporting autoscaling and GPU/CPU SKUs. Compute Instance (C) is also correct because it is a managed single-node cloud workstation that can run training scripts and notebooks interactively, making it suitable for development and smaller training workloads. Key Vault (A) is a secrets-management service, not a compute resource, so it cannot train models.

Web App (D) is a PaaS hosting service for web applications, and Azure SQL (E) is a managed relational database, neither of which provides the compute environment for ML training.

The model package must contain the serialized model artifact itself, so option C (Model weights in pickle/onnx format) is correct because this is the trained artifact that will be loaded to produce predictions. Option D (Inference script, score.py) is correct because the deployment service needs an entry point that defines init() and run() to load the model and handle scoring requests. Option E (Environment file, conda.yaml) is correct because it declares the exact Python and library dependencies required to recreate the runtime environment so the model executes consistently.

Option A (Training dataset) is not included because the package is for inference, not retraining, and shipping raw training data is unnecessary and often a privacy/compliance risk. Option B (Pipeline definition) is not included because a pipeline describes the training/retraining workflow, not the deployable scoring artifact.

Option C is correct because storing secrets (storage account keys, connection strings, service principal credentials) in Azure Key Vault keeps them out of notebooks, scripts, and source control, and lets the workspace retrieve them via its managed identity rather than hard-coded values. Option D is correct because Azure RBAC enforces least-privilege access to the workspace, compute, datastores, and models, ensuring only authorized identities can read, train, deploy, or manage ML assets. Option E is correct because private endpoints place the workspace and its associated resources (such as storage, Key Vault, and container registry) on a private IP within your VNet, removing public internet exposure and blocking exfiltration.

Option A is not recommended because allowing all traffic in NSGs defeats network segmentation and exposes the workspace to unauthorized access. Option B is not recommended because making datastores public exposes training data and model artifacts to anonymous or unauthenticated access, violating data-protection requirements.

Option C (View run history) is correct because the Azure Machine Learning studio provides an Experiments and Runs interface where you can inspect each run's metrics, logs, and outputs for tracking and comparison. Option E (Register a new dataset) is correct because the studio's Data section (Datastores/Datasets) lets you create and register datasets from datastores, local files, or web URLs for reuse in experiments and pipelines. Options A (Modify global azure subscriptions) and D (Configure networking in the tenant) are incorrect because subscription-level and tenant-wide networking settings are managed in the Azure portal or Microsoft Entra admin center, not in the ML studio.

Option B (Manage office 365 users) is incorrect because Office 365 user administration is handled through the Microsoft 365 admin center, not Azure Machine Learning studio.

Deployment status logs (A) are essential because they show the orchestration-level events and errors from the deployment controller, such as failed rollouts, image pull errors, or readiness probe failures, directly indicating why the deployment did not succeed. Application output logs (B), typically captured from stdout/stderr, reveal runtime errors, exceptions, and startup failures inside the deployed containers that would not appear in orchestration logs. Container build logs (D) are critical when the failure originates during image construction, showing failed build steps, dependency errors, or Dockerfile issues before the image ever reaches the deployment stage.

User browser logs (C) reflect client-side rendering or network issues and are not authoritative for server-side deployment failures, while Azure billing logs (E) only track cost and usage data and provide no diagnostic value for a failed deployment.

Option C is correct because mounting a dataset exposes it as a FUSE-based virtual filesystem (e.g., /mnt/azureml/...) so the compute target reads only the files it needs on demand, avoiding the full download-and-copy overhead that inflates startup and I/O time. Option D is correct because enabling step run reuse lets Azure ML skip re-executing a pipeline step when its code, inputs, parameters, and environment are unchanged, returning the cached output and eliminating redundant compute. Option E is correct because ParallelRunStep partitions a batch workload across multiple nodes/processes of the cluster and runs them concurrently, cutting wall-clock time for large-scale scoring or data processing.

Option A is not appropriate because adding workspaces only multiplies management boundaries and does not speed up a single pipeline's execution. Option B is not appropriate because undersized clusters for every step cause throttling, longer runtimes, and possible out-of-memory failures rather than faster execution.

Options D and E are correct because retraining triggers based on performance degradation must directly measure how well the model's predictions match ground truth: model prediction precision (D) captures the proportion of positive predictions that are actually correct, and model prediction accuracy (E) captures the overall fraction of correct predictions, both of which decline when the model drifts or degrades. Monitoring these model-quality metrics lets you set thresholds (e.g., accuracy drops below 90% or precision falls by 5%) that signal when retraining is warranted. Option A (CPU usage of the inference cluster) is an infrastructure resource metric that reflects load or scaling needs, not model correctness.

Option B (network latency) measures communication delay and says nothing about prediction quality. Option C (number of active users) is a traffic/usage metric that may correlate with load but does not indicate whether the model's predictions have degraded.

Key Vault integration (A) is essential because it securely stores and centrally manages secrets, keys, and certificates used by the Azure ML workspace, compute, and endpoints, keeping credentials out of code and configuration files. Managed Identity (B) is essential because it gives the workspace and its compute resources an automatically managed identity in Microsoft Entra ID, enabling passwordless, least-privilege access to Key Vault, Storage, and ACR without embedding credentials. Virtual Network (VNet) (D) is essential because it provides network isolation for the workspace, compute clusters/instances, and private endpoints, restricting traffic to approved subnets and preventing exposure over the public internet.

Opening inbound ports in the NSG (C) is not a security feature but a weakening of the perimeter, since production workloads should minimize inbound exposure and instead use private endpoints or Azure Bastion/JIT access. Public IP exposure (E) is not a security feature either, as assigning public IPs increases the attack surface and contradicts the private-networking posture expected in production.

A Managed Online Deployment in Azure Machine Learning requires an environment definition (B), which specifies the Docker image and dependencies (e.g., conda.yaml) used to build the scoring container. It also requires an inference script (C), typically score.py, that defines the init() and run() functions to load the model and handle scoring requests. A registered model (D) is also required, since the deployment must reference a model asset (by name and version) from the workspace registry to serve predictions.

A GPU compute instance (A) is not mandatory because managed online endpoints can run on CPU SKUs, and a training dataset (E) is irrelevant to inference-time deployment.