AI-200 High-Yield 20

Every push to the main branch of a GitHub repository must rebuild a container image in Azure. The team has no build servers or self-hosted runners. What should you create?

1. ✓ A An ACR task with a source code commit trigger (correct answer)
2. B A GitHub Actions workflow on a self-hosted runner
3. C A scheduled az acr import job
4. D Geo-replication to the region closest to the developers

Shortcut: Rebuild on every git push with no build servers = ACR task with a commit trigger. A self-hosted runner is exactly the infrastructure the team doesn't have, az acr import copies existing images rather than building them, and geo-replication only copies images between regions.

Your container registry must be reachable only through a private endpoint and replicated to a second Azure region. What is the minimum ACR service tier?

1. A Basic
2. B Standard
3. ✓ C Premium (correct answer)
4. D Any tier, as long as the admin user is disabled

Shortcut: Private endpoint or geo-replication in ACR = Premium tier. Basic and Standard differ mainly in included storage and throughput, and disabling the admin user is a security setting available on every tier.

A Container Apps API must never suffer a cold start, but it should add replicas when HTTP traffic spikes. Which configuration meets both goals?

1. A Minimum replicas 0 with an HTTP scale rule
2. ✓ B Minimum replicas 1 with an HTTP scale rule (correct answer)
3. C Minimum replicas 0 with a CPU scale rule
4. D A fixed replica count equal to peak demand

Shortcut: No cold starts in Container Apps = minimum replicas of at least 1. A minimum of zero allows scale to zero, which brings cold starts back, and a fixed peak-sized count pays for idle replicas off-peak.

You want to send 10% of production traffic to a new Container Apps revision and give testers a stable URL that always reaches that revision. Which TWO settings should you use?

1. ✓ A Multiple revision mode with traffic weights (correct answer)
2. ✓ B A revision label (correct answer)
3. C Single revision mode
4. D A separate Container Apps environment for the new revision
5. E Scaling the old revision to zero replicas

Shortcut: Canary = multiple revision mode + traffic weights. Test URL for one revision = label. A label gives a specific revision its own stable URL, so testers can reach it whatever the traffic split.

A pod is in CrashLoopBackOff. Which command shows the output of the container instance that just crashed?

1. ✓ A kubectl logs <pod> --previous (correct answer)
2. B kubectl get events --watch
3. C kubectl top pod <pod>
4. D kubectl get endpoints

Shortcut: Why did my container crash? = kubectl logs --previous. Events show scheduling and probe problems but not application output, kubectl top shows CPU and memory use, and endpoints show which pods a Service sends traffic to.

Users must always see their own changes immediately, but it's fine if other users see them a moment later. Which Azure Cosmos DB consistency level meets this at the lowest cost?

1. A Strong
2. B Bounded staleness
3. ✓ C Session (correct answer)
4. D Eventual

Shortcut: Read your own writes = Session consistency (the default). Strong and Bounded staleness add latency and RU cost this scenario doesn't need, and Eventual doesn't guarantee users see their own writes.

You're adding vector similarity search to a new Azure Cosmos DB for NoSQL container. What must you configure for the embedding property?

1. ✓ A A vector embedding policy and a vector index in the indexing policy (correct answer)
2. B A composite index on the embedding property
3. C A unique key policy on the embedding property
4. D A change feed processor that calculates distances

Shortcut: Cosmos DB vector search = vector embedding policy + vector index, queried with VectorDistance(). Composite indexes and unique keys don't support similarity search, and the change feed doesn't calculate distances.

A change feed processor must react to new and updated items in a container. What else does it need?

1. ✓ A A lease container to store its progress (correct answer)
2. B A Service Bus queue to store checkpoints
3. C Strong consistency on the account
4. D A stored procedure that copies each change

Shortcut: Change feed processor = monitored container + lease container. It doesn't need Service Bus, a particular consistency level or stored procedures. In the default latest-version mode, deletes aren't delivered.

Which pgvector index type should you create only after the table already holds representative data, because it builds its clusters from the existing rows?

1. ✓ A IVFFlat (correct answer)
2. B HNSW
3. C B-tree
4. D GIN

Shortcut: IVFFlat = load the data first, then build the index. HNSW has no training step and can be created before any data is loaded, although building it after a bulk load is still faster.

A serverless app opens thousands of short-lived connections and is exhausting an Azure Database for PostgreSQL flexible server. What's the built-in fix?

1. ✓ A Enable the built-in PgBouncer and connect on port 6432 (correct answer)
2. B Raise max_connections to the highest allowed value
3. C Add read replicas
4. D Move the server to the Burstable tier

Shortcut: Too many PostgreSQL connections = built-in PgBouncer on port 6432. Raising max_connections costs memory for every connection, read replicas don't reduce connection churn on the primary, and the Burstable tier has less capacity.

Cached product prices in Azure Managed Redis must expire after five minutes, and must disappear immediately when a price changes. What should you do?

1. ✓ A Set a 300-second TTL on each key and delete the key when its price is updated (correct answer)
2. B Rely on the maxmemory eviction policy
3. C Refresh the whole cache from a scheduled job every five minutes
4. D Store prices without a TTL and flush the cache once a day

Shortcut: Fresh Redis data = TTL for expiry + delete the key on update. Eviction only happens under memory pressure, and scheduled refreshes or daily flushes leave stale prices in the cache.

A Service Bus message keeps failing. After enough attempts, Service Bus moves it aside so other messages keep flowing. Where does it go, and what sets the limit?

1. ✓ A The dead-letter subqueue, after MaxDeliveryCount attempts (correct answer)
2. B The dead-letter subqueue, as soon as its lock expires once
3. C A new topic, controlled by duplicate detection
4. D Nowhere: it is deleted when the lock duration ends

Shortcut: Poison message → dead-letter queue after MaxDeliveryCount (default 10). A single lock expiry just makes the message available again, and duplicate detection only discards repeated sends.

An Event Grid subscriber is offline for maintenance. By default, how long does Event Grid keep retrying delivery of an event?

1. A 30 minutes
2. ✓ B Up to 24 hours or 30 attempts (correct answer)
3. C 7 days
4. D It doesn't retry

Shortcut: Event Grid retries for 24 hours / 30 attempts by default; add dead-lettering to keep failures. You can lower both limits per subscription, and a dead-letter destination keeps events that still can't be delivered.

Millions of IoT readings per second must be ingested, read by several independent consumers, and replayed from earlier points in time. Which service fits?

1. ✓ A Azure Event Hubs (correct answer)
2. B Azure Service Bus queue
3. C Azure Event Grid
4. D Azure Storage queue

Shortcut: Streaming + replay + many independent readers = Event Hubs (consumer groups). Service Bus is for transactional messaging, Event Grid for discrete event notifications, and Storage queues for simple work queues.

An HTTP-triggered Azure Function must save each request body as a message on a Storage queue with the least code. What should you use?

1. ✓ A A queue output binding (correct answer)
2. B A queue trigger
3. C The Storage SDK with a connection string in the code
4. D A timer trigger that polls the HTTP endpoint

Shortcut: Write to another service with no SDK code = output binding. Run when something happens = trigger. A queue trigger starts a function when a message arrives, which is the opposite direction, and SDK code with an embedded connection string is more work and less secure.

An app's managed identity must read secret values from a Key Vault that uses Azure RBAC. Which role follows least privilege?

1. ✓ A Key Vault Secrets User (correct answer)
2. B Key Vault Reader
3. C Key Vault Contributor
4. D Key Vault Secrets Officer

Shortcut: Read secret values = Key Vault Secrets User. Reader = metadata only. Key Vault Reader sees metadata but not values, Key Vault Contributor manages the vault resource but not its data, and Key Vault Secrets Officer can also create and delete secrets.

An App Service app should read a database password from Key Vault through an ordinary app setting, with no code changes. What should the app setting's value be?

1. ✓ A @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/DbPassword/) (correct answer)
2. B The secret's current value, copied from Key Vault
3. C keyvault://myvault/DbPassword
4. D The Key Vault resource ID

Shortcut: Key Vault secret in an app setting, no code = @Microsoft.KeyVault(SecretUri=...). The identity needs permission to read secrets, such as the Key Vault Secrets User role. Copying the value breaks rotation, and the other formats aren't valid.

Several apps load settings from Azure App Configuration. They must pick up changes without restarting, but only once you've finished updating a group of related keys. What should the apps watch?

1. ✓ A A sentinel key that you update last, configured to reload all settings when it changes (correct answer)
2. B Every key individually, refreshed every second
3. C The versions of secrets in Key Vault
4. D The App Configuration store's activity log

Shortcut: Apply config changes together = watch one sentinel key and update it last. Watching every key separately costs far more requests and can load a half-finished set of changes.

A Python API should send traces, metrics and logs to Application Insights with the least setup code. What should you use?

1. ✓ A The Azure Monitor OpenTelemetry Distro, calling configure_azure_monitor() (correct answer)
2. B A hand-built TracerProvider, span processor and exporter
3. C The legacy Application Insights SDK with an instrumentation key
4. D Spans written to a log file and imported into Log Analytics

Shortcut: Python to Application Insights, fastest = configure_azure_monitor() from the OpenTelemetry Distro. Building the pipeline by hand works but takes more code, and the legacy SDK and instrumentation keys are being replaced by OpenTelemetry and connection strings.

Which KQL query returns the 95th-percentile request duration for each operation over the last hour?

1. ✓ A requests | where timestamp > ago(1h) | summarize percentile(duration, 95) by operation_Name (correct answer)
2. B requests | where timestamp > ago(1h) | project percentile(duration, 95)
3. C requests | summarize avg(duration) by operation_Name | where timestamp > ago(1h)
4. D traces | where timestamp > ago(1h) | top 95 by duration

Shortcut: KQL: filter with where first, then summarize <aggregation>() by <column>. project can't aggregate, filtering after summarize fails because timestamp is no longer a column, and top 95 returns 95 rows rather than a percentile.