Practice set 7 of 16 · AI-200 Exam Preparation
This set features 48 realistic scenario questions covering AKS, Key Vault, Service Bus, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 7 provides scenario drills across Domain 1 (Containers: 25%), Domain 2 (Data: 25%), Domain 3 (Messaging: 27%), and Domain 4 (Security: 23%).
Which Durable pattern runs many activities in parallel and aggregates their results?
Shortcut: WhenAll to collect results once all complete.
How do you make an AKS cluster's API server accessible only via a private IP address within the VNet?
Shortcut: --enable-private-cluster deploys the API server with a private IP only, accessible via Private Link. The API server FQDN resolves privately within the VNet.
Which Azure Cache for Redis tier supports private endpoints to restrict access to a VNet?
Shortcut: Private endpoints are supported on Premium and Enterprise tiers. For Basic/Standard, you can use firewall rules with allowed IP ranges as an alternative.
What does the assignableScopes property of a custom role control?
Shortcut: assignableScopes limits the subscriptions or management groups in which the role definition is available for assignment. It does not itself grant any access.
Which messaging pattern does a Service Bus queue implement?
Shortcut: A Service Bus queue implements point-to-point: multiple competing consumers can receive from the queue, but each message is delivered to exactly one consumer (load balancing).
Which setting completely disables public internet access to an ACR registry?
Shortcut: --public-network-access Disabled blocks all public internet access. Access can then only occur via private endpoints inside the VNet.
A hybrid search must combine keyword relevance and vector similarity. Which PostgreSQL combination supports this natively?
Shortcut: PostgreSQL can run full-text ranking (ts_rank over a GIN-indexed tsvector) and vector distance in the same query, blending both signals, often via reciprocal rank fusion.
An AKS cluster must mount Key Vault secrets as files in pods. Which solution enables this without code changes?
Shortcut: The Secrets Store CSI Driver with the AKS Key Vault add-on mounts secrets, keys, and certificates from Key Vault as files or Kubernetes secrets, using workload identity for authentication.
Messages are accumulating in the dead-letter queue with reason 'MaxDeliveryCountExceeded'. What is the correct investigative step?
Shortcut: Repeated exhaustion of delivery attempts indicates a poison message or a systematic handler bug. Raising the count only delays the failure; the payload and exception must be examined.
A workload must run only on nodes with GPUs. Nodes are tainted 'sku=gpu:NoSchedule'. What must the pod spec contain?
Shortcut: A toleration allows the pod onto tainted nodes but does not attract it there. Pair the toleration with nodeSelector or nodeAffinity to ensure it lands on GPU nodes specifically.
Which approach is recommended to avoid index bloat with pgvector HNSW index on a table with frequent updates?
Shortcut: Frequent updates can bloat HNSW indexes. Running VACUUM ANALYZE periodically removes dead tuples and updates planner statistics, maintaining query performance.
Which Key Vault feature automatically notifies systems or triggers actions when a key or certificate is about to expire?
Shortcut: Key Vault integrates with Event Grid to publish near-expiry (CertificateNearExpiry, KeyNearExpiry), expired, and other lifecycle events, enabling automated renewal workflows.
A team uses SQL filters on a Service Bus topic subscription to route messages. Which SQL filter expression matches messages with property OrderType = 'Express'?
Shortcut: Service Bus SQL filters use SQL-like syntax with single-quoted string literals. OrderType = 'Express' matches messages where the user-defined property OrderType equals 'Express'.
A pod must be prevented from starting until its dependency is reachable, and must be removed from the load balancer if it later becomes unhealthy. Which TWO probes are required?
Shortcut: The startup probe holds off the other probes until the container has finished initialising, which prevents a slow-starting pod being killed. The readiness probe controls Service endpoint membership, so a pod that becomes unhealthy is removed from load balancing without being restarted.
Which command atomically sets a key only if it does not exist, with a 30-second expiry, forming the basis of a distributed lock?
Shortcut: SET with NX and EX in a single call is atomic. Separate SETNX and EXPIRE calls risk leaving a lock without a TTL if the client crashes between them.
What does a Key Vault certificate object bundle together?
Shortcut: A certificate object links an addressable key and secret so the full credential can be retrieved and renewed as a unit, optionally with an integrated issuer for auto-renewal.
What problem does an Event Grid domain solve?
Shortcut: A domain provides one publishing endpoint and manages many topics beneath it, letting each tenant subscribe only to its own topic. It is the standard multi-tenant pattern.
A Container App running with external ingress needs a custom domain and TLS certificate. Which feature is used?
Shortcut: Container Apps supports custom domains with either a free Azure-managed certificate (auto-renewed) or a bring-your-own certificate uploaded to the environment.
Which Cosmos DB conflict resolution policy is used when multiple regions write to the same item simultaneously?
Shortcut: Last Write Wins uses a user-defined numeric property (default _ts) to determine which write survives. Custom conflict resolution uses a stored procedure for merge logic.
Which Azure Monitor component aggregates and visualizes metrics and logs from multiple sources in customisable dashboards?
Shortcut: Azure Monitor Workbooks combine metrics, logs, and parameters into rich interactive reports. They support conditional rendering, parameters, and can be shared across the team.
An application must process events from Azure Blob Storage when new blobs are created in a specific container. Which event type should the subscription filter on?
Shortcut: BlobCreated fires when a blob is successfully written. , /blobServices/default/containers/mycontainer) to limit to a specific container.
Which authentication configuration lets a Container App require Azure AD sign-in without any code changes?
Shortcut: Container Apps supports built-in authentication that intercepts requests before they reach the container, handling the OIDC flow and injecting identity headers.
An application reads documents rarely but needs strong read-after-write guarantees. Multi-region writes are not required. Which consistency level should you choose?
Shortcut: Strong consistency guarantees linearizability. If the workload doesn't require multi-master writes and can accept slightly higher read latency, Strong provides the simplest programming model with no stale reads.
What happens to events once the retention period elapses?
Shortcut: Event Hubs is a time-retention log. Events age out after the retention window regardless of whether they were read, which is why Capture is used for durable archival.
Which KQL function filters to the last 24 hours?
Shortcut: ago(24h) yields the timestamp 24 hours before now, so 'where timestamp > ago(24h)' scopes the query to the last day.
Which AKS feature allows burst scaling to Azure Container Instances (ACI) without adding real nodes?
Shortcut: Virtual nodes use the ACI connector to schedule pods directly on ACI infrastructure, enabling near-instant burst scaling without provisioning VM-based nodes.
Which approach supports heavy analytical scans over operational data without consuming transactional RU/s?
Shortcut: Analytical store keeps a column-oriented copy updated automatically and is queried through Synapse Link. It is billed separately and does not draw on transactional RU/s.
An Azure Function processes Event Hubs events. The function is falling behind. How does Event Hubs partition scaling work with Functions?
Shortcut: Each Event Hub partition is processed by exactly one function instance. , 32 partitions = max 32 function instances).
How many role assignments can be created per Azure subscription?
Shortcut: Azure limits role assignments to 2,000 per subscription. For large organisations, use security groups — assign roles to groups rather than individual users to reduce the count.
A company wants to reduce AKS costs by running batch workloads on preemptible VMs. Which node pool type should they use?
Shortcut: Spot node pools use Azure Spot VMs (unused capacity at up to 90% discount) suitable for fault-tolerant batch workloads. Pods must handle eviction gracefully.
An app needs to store both the raw text and its embedding in PostgreSQL. What is the recommended table design?
Shortcut: Storing text, embedding, and metadata in a single table simplifies queries and enables efficient hybrid search. The vector column type stores the embedding natively with index support.
A Service Bus-triggered function must process at most 4 messages concurrently per instance. Where is this configured?
Shortcut: json controls extension concurrency. Setting maxConcurrentCalls bounds parallel message handling per instance, which protects downstream dependencies.
Which authentication flow should a Container App use to call Azure SQL with no stored credentials?
Shortcut: The app requests a token for the SQL resource using its managed identity and connects as an Entra ID principal, so no password exists anywhere in the system.
You want automated rebuilds whenever the 'python:3.12-slim' base image receives a security patch. What must be true for the ACR base image update trigger to fire?
Shortcut: ACR Tasks record the base image dependency at build time. With the base image trigger enabled, ACR watches that dependency (in ACR or Docker Hub) and queues a rebuild when the digest changes.
Which storage consideration applies when storing 1536-dimension float vectors?
Shortcut: A vector(1536) holds 1536 four-byte floats plus overhead, around 6 KB per row. At millions of rows this dominates table size and index memory, so halfvec or dimensionality reduction is often used.
Which Event Hubs tier supports Schema Registry for Avro schema enforcement on published events?
Shortcut: Event Hubs Schema Registry (for Apache Avro schema management) is available in Standard, Premium, and Dedicated tiers. It validates event schemas at publish time.
A secret's value must be rotated automatically on a schedule. Which feature enables this without manual intervention?
Shortcut: Key Vault supports secret rotation policies that trigger Event Grid events at near-expiry. An Azure Function or Logic App handles the actual rotation (fetch new value, update secret), then updates the secret version.
How long is the authentication token valid after running az acr login?
Shortcut: az acr login tokens expire after 3 hours. For automation use service principals or managed identities with longer-lived credentials.
What does the maxmemory-policy configuration control in Azure Cache for Redis?
Shortcut: maxmemory-policy defines what Redis does when it reaches the memory limit: evict the least recently used key (allkeys-lru), expire keys with TTL (volatile-lru), or return errors (noeviction).
What is the purpose of auto-forwarding on a subscription?
Shortcut: Auto-forwarding relays messages from a queue or subscription to another entity in the same namespace, enabling fan-in and multi-stage topologies without custom relay code.
A team needs to route Application Insights alerts to a PagerDuty on-call rotation. Which Azure Monitor feature handles alert routing?
Shortcut: Action Groups define notification and action targets (email, SMS, webhook, Azure Function, Logic App, ITSM Connector, PagerDuty). Multiple alert rules share the same action group.
Which storage class is appropriate for a ReadWriteMany volume shared by several pods across nodes?
Shortcut: Azure Disk supports ReadWriteOnce, binding to a single node. Azure Files uses SMB/NFS and supports ReadWriteMany, allowing concurrent mounts across nodes.
A cache-aside implementation suffers a thundering herd when a hot key expires. Which mitigation is most appropriate?
Shortcut: A mutex or lock key ensures a single rebuild on expiry. Adding TTL jitter and probabilistic early refresh further spreads the load.
Which authentication method is recommended for a production application connecting to Azure Service Bus?
Shortcut: Managed identity eliminates credential management. Assign the Azure Service Bus Data Sender or Data Receiver role to the managed identity for least-privilege access.
An application receives HTTP 429 from Key Vault under load. What is the correct remedy?
Shortcut: Key Vault enforces per-vault transaction limits. Fetching a secret on every request is an anti-pattern; cache the value and retry with backoff on throttling.
How do you share configuration between a Container App and Azure Key Vault without storing secrets in environment variables?
Shortcut: Container Apps can reference Key Vault secrets directly in its secrets configuration. These are then available as environment variables or volume mounts to the app.
What is the recommended partition key strategy for a Cosmos DB container storing IoT telemetry from thousands of devices?
Shortcut: deviceId provides high cardinality (many distinct values), distributing data evenly across partitions. Avoid low-cardinality keys like region or date alone, which create hot partitions.
Which authentication method should a publisher use instead of an access key?
Shortcut: Entra ID authentication with the EventGrid Data Sender role removes static keys and gives per-identity auditing and revocation.