Practice set 3 of 16 · AI-200 Exam Preparation
This set features 48 realistic scenario questions covering AKS, Container Registry, Cosmos DB, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 3 balances containerized deployment lifecycles with distributed telemetry collection: Domain 1 (25%), Domain 2 (25%), Domain 3 (27%), and Domain 4 (23%).
A workflow requires that messages from a single session (e.g., all messages for one order) are processed in order by the same consumer. Which feature enables this?
Shortcut: Service Bus sessions enable FIFO ordering for groups of related messages. All messages with the same SessionId are handled by a single consumer in the order they were sent.
Which property in a Cosmos DB container controls how data is distributed across logical partitions?
Shortcut: The partition key determines how documents are grouped into logical partitions. Choosing a high-cardinality partition key (many distinct values) ensures even distribution of data and throughput.
Which Key Vault tier supports Hardware Security Module (HSM)-backed keys with FIPS 140-2 Level 2 validation?
Shortcut: Key Vault Premium tier stores keys in HSMs validated to FIPS 140-2 Level 2. For FIPS 140-2 Level 3, use Azure Managed HSM (a separate service).
A team deploys a DaemonSet in AKS. How many pods does it run per node?
Shortcut: DaemonSets ensure exactly one pod runs on every eligible node (or a subset via node selector/tolerations). Used for log agents, monitoring agents, etc.
What is the purpose of a checkpoint in the Event Processor client?
Shortcut: Event Hubs never deletes on read. Checkpoints persist the last processed offset in a blob store, so a restarted or rebalanced processor resumes rather than reprocessing everything.
Which session parameter tunes the recall/latency trade-off for HNSW at query time?
Shortcut: ef_search controls how many candidates are examined per query. Higher values improve recall at the cost of latency, and can be set per session or per transaction.
Which component decides who is notified when an alert rule fires?
Shortcut: The alert rule defines the condition; the action group defines the response, including email, SMS, webhook, Logic App, Function, and ITSM connectors.
What is the Event Grid event delivery guarantee?
Shortcut: Event Grid provides at-least-once delivery. For each event, it retries delivery using exponential backoff for up to 24 hours (configurable). Events may be delivered more than once; handlers should be idempotent.
Which Redis data structure is optimal for implementing a leaderboard sorted by score?
Shortcut: Sorted Sets store members with a floating-point score, sorted by score automatically. ZADD, ZRANK, ZRANGE enable efficient leaderboard operations (add score, get rank, list top N).
An application requires persistent storage that can be mounted by multiple pods simultaneously across nodes. Which Azure storage type should you use?
Shortcut: Azure Disk supports ReadWriteOnce (single node). Azure Files (SMB/NFS) supports ReadWriteMany, allowing concurrent mounts from multiple pods/nodes.
Which Application Insights feature automatically detects anomalies in request failure rates and response times without manual threshold configuration?
Shortcut: Smart Detection (now Detector rules) uses machine learning to automatically detect unusual changes in failure rates, response times, dependency failures, and memory leaks without requiring manual alert thresholds.
An orchestration must call activity B with the output of activity A, then C with B's output. Which Durable Functions pattern is this?
Shortcut: CallActivityAsync calls.
Which pattern implements a fixed-window rate limiter of 100 requests per minute per user?
Shortcut: INCR on a key such as rl:{user}:{minute} is atomic; setting EXPIRE when the counter is first created makes the window self-cleaning. A sorted set supports sliding windows at higher cost.
What is the difference between a system-assigned and user-assigned managed identity?
Shortcut: System-assigned identity is created with and deleted with the resource. User-assigned identity is a standalone Azure resource that can be assigned to multiple services and persists independently.
What is the maximum message lock duration in Azure Service Bus?
Shortcut: The initial lock duration is configurable (max 5 minutes per renewal). Applications can renew the lock (RenewMessageLock) as long as needed, up to the message TTL, for long-running processing.
Which AKS network plugin assigns pods IP addresses directly from the VNet subnet, enabling direct pod addressing from on-premises?
Shortcut: Azure CNI allocates pod IPs from the VNet subnet, so pods are routable within the VNet and from peered/on-prem networks. kubenet uses an overlay with NAT and requires user-defined routes.
What does the probes_per_query parameter control in pgvector IVFFlat indexes?
Shortcut: probes=N) controls how many inverted list clusters are scanned during search. Higher values improve recall but increase query time.
Which mechanism can explicitly block an action even when an allow assignment exists?
Shortcut: Deny assignments take precedence over allow assignments. They are created by the platform, not directly by users, and are how managed applications protect their resources.
A subscriber should receive only messages where the 'priority' property equals 'high'. What do you configure?
Shortcut: Subscription rules filter topic messages. A correlation filter matching a property is the most efficient; a SQL filter supports richer expressions at slightly higher cost.
What is the maximum storage size per logical partition in Cosmos DB?
Shortcut: Each logical partition in Cosmos DB has a maximum size of 20 GB. Choose a partition key that distributes data across many logical partitions to avoid hitting this limit.
Which built-in RBAC role grants read-only image pull access to an ACR registry?
Shortcut: AcrPull grants pull (read) permission only. AcrPush adds push/write. Reader grants broader Azure management plane read access.
An IoT application produces millions of telemetry events per second. Which Event Hubs tier is appropriate for this scale?
Shortcut: Event Hubs Dedicated provides isolated, single-tenant clusters with guaranteed capacity (Capacity Units), supporting millions of events/sec with 90-day retention and no throughput unit limits.
What is the purpose of Key Vault key rotation?
Shortcut: Key rotation creates a new key version. The new version becomes active for new operations. Old versions remain available for decryption of data encrypted with them (retained in vault).
Which consistency level guarantees read-your-own-writes within a client session while remaining cheaper than Strong?
Shortcut: Session consistency uses a session token to guarantee monotonic reads and read-your-own-writes for that client. It is the default and offers the best balance of consistency and cost.
You need to route only blob-created events for files ending in '.jpg'. How is this configured most efficiently?
Shortcut: subjectBeginsWith and subjectEndsWith are evaluated by Event Grid before delivery, avoiding both delivery cost and handler invocations for irrelevant events.
A secret must be rotated automatically every 60 days. Which combination implements this?
Shortcut: Key Vault rotation policies emit near-expiry events. A subscriber, typically a Function, performs the credential change at the source system and writes the new version back.
An AI application uses Azure Cache for Redis to cache embedding vectors to avoid redundant inference calls. Which Redis command stores a vector as a binary string?
Shortcut: , float32 bytes) and stored as binary strings via SET/GET. For structured caching with expiry, SET with EX (expiry) is most common.
An app must be reachable only by other apps in the same environment. Which ingress setting applies?
Shortcut: Internal ingress publishes the app on the environment's internal load balancer with a private FQDN. Disabling ingress entirely would make it unreachable even internally.
Which Azure Functions trigger fires when a new message arrives in an Azure Service Bus queue?
Shortcut: The Service Bus trigger listens to a queue or topic subscription and invokes the function for each message. It handles PeekLock, abandonment on failure, and dead-lettering automatically.
An Application Insights availability test sends HTTP requests every 5 minutes from multiple Azure regions. What is this monitoring?
Shortcut: Availability tests (URL ping or standard tests) monitor external endpoints from multiple Azure PoP locations, alerting if the endpoint is unreachable or response time exceeds a threshold.
Why should an IVFFlat index be created after loading representative data rather than on an empty table?
Shortcut: IVFFlat partitions the vector space using k-means over existing rows. Built on an empty or unrepresentative table, the centroids are meaningless and recall collapses.
Two independent applications must each read the full event stream without interfering. What do you create?
Shortcut: Consumer groups are independent views of the same stream, each with its own offsets, allowing multiple applications to consume all events at their own pace.
Which alert type evaluates a KQL query on a schedule and fires when results cross a threshold?
Shortcut: Log search alerts run a saved KQL query at an interval and evaluate the result count or a numeric column. Metric alerts operate on pre-aggregated platform metrics with lower latency.
Which scale rule type triggers scaling when a specific number of messages are queued in Azure Service Bus?
Shortcut: KEDA-based custom scaling rules connect to external event sources like Service Bus, Event Hubs, and storage queues using the same KEDA scalers as Kubernetes.
A Flexible Server instance must accept connections from an AKS pod without exposing the database to the internet. Which connectivity method should you use?
Shortcut: Private endpoint creates a private IP for the PostgreSQL server within the VNet, or VNet injection (Flexible Server) places the server directly in a delegated subnet. No public exposure needed.
An Event Grid event subscription cannot deliver an event after exhausting retries. Where is the event sent?
Shortcut: Configure a dead-letter destination (Azure Blob Storage) on the subscription. Undeliverable events are written there for later inspection. Without dead-lettering, events are dropped after retry exhaustion.
A team follows just-in-time access principles. Which Azure AD (Entra ID) feature grants temporary elevated access for a specified duration?
Shortcut: PIM enables eligible role assignments where users must activate their role (with justification, MFA, approval) for a time-limited period. This implements just-in-time privileged access.
Which Azure Managed Redis tier is required for RediSearch vector capabilities?
Shortcut: Vector search depends on the RediSearch module, available in Enterprise tiers and Azure Managed Redis. Basic and Standard OSS tiers do not include modules.
An approval step must pause the workflow until a human clicks a link, potentially days later. Which Durable Functions capability supports this?
Shortcut: The human interaction pattern uses WaitForExternalEvent. The orchestration is dehydrated while waiting and rehydrated when RaiseEventAsync delivers the event, incurring no compute cost meanwhile.
Which authentication method should a GitHub Actions workflow use to push to ACR without storing long-lived secrets?
Shortcut: OIDC workload identity federation lets GitHub Actions exchange its short-lived OIDC token for an Azure AD access token. No client secret or admin credential is stored in the repository.
What is the difference between the Owner and Contributor built-in roles?
Shortcut: Authorization/roleAssignments/write, which is the ability to grant access to others.
A Cosmos DB query runs without the partition key. What is the performance impact?
Shortcut: Cross-partition queries fan out to every partition, multiplying RU cost. Always include the partition key in queries where possible for single-partition (efficient) execution.
Which Service Bus message property allows a consumer to schedule a message to be available for processing at a future time?
Shortcut: ScheduledEnqueueTimeUtc defers message delivery until a specific time. The message is stored in Service Bus but not visible to consumers until that time is reached.
The audit cannot prove which build was running during an incident. Which change addresses the finding at its root?
Shortcut: A tag is a mutable pointer, so api:latest can resolve to different images over time. A digest is content-addressed and cannot be reassigned, which is what makes the deployed artefact provable after the fact. Tag locking prevents an already-released tag being overwritten.
Which TWO changes remove the committed database password from the cluster while satisfying least privilege?
Shortcut: Workload Identity gives each pod a distinct Azure identity, so permissions are scoped per workload rather than shared. The CSI driver then delivers the secret from Key Vault at mount time, so nothing is stored in the repository. Base64 is encoding, not encryption; the kubelet identity is shared by every pod on the node and breaks least privilege; ConfigMaps are plain text.
Registry traffic must never traverse the public internet. Which configuration satisfies this?
Shortcut: A private endpoint gives the registry a private IP inside the VNet. io, or clients would still resolve and use the public endpoint. Private endpoints require the Premium tier.
Which TWO node pool decisions best match the workload profile described?
Shortcut: Spot nodes are heavily discounted but can be evicted with 30 seconds' notice, which suits interruptible batch work only. The bursty intake API needs a user pool with the autoscaler so capacity follows the morning spike. System pods must never sit on Spot, and fixing the node count at peak wastes the overnight trough.
A separate internal API is being moved to Container Apps and must scale to zero overnight. Which scaling configuration achieves this?
Shortcut: Scale to zero requires minReplicas 0 together with an event-driven or HTTP rule, because KEDA needs a signal that can be evaluated while no replica is running. A CPU rule cannot scale from zero: with no replica there is no CPU metric to read.