Practice set 10 of 16 · AI-200 Exam Preparation
This set features 47 realistic scenario questions covering Service Bus, AKS, Cosmos DB, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 10 evaluates full-stack cloud AI architecture across Domain 1 (25%), Domain 2 (25%), Domain 3 (27%), and Domain 4 (23%).
Which ACR Tasks trigger rebuilds an image when a dependency in a linked Git repository changes, without any local Docker involvement?
Shortcut: A source code trigger binds an ACR Task to a Git repository and branch. Commits or pull requests queue a cloud build; no local Docker daemon participates.
A team needs to store relationship graphs and traverse connections between entities. Which Cosmos DB API is appropriate?
Shortcut: Cosmos DB for Gremlin implements the Apache TinkerPop Gremlin graph traversal language, suitable for social graphs, recommendation engines, and knowledge graphs.
Which Azure Defender plan protects Azure Container Registry images by scanning them for vulnerabilities?
Shortcut: Microsoft Defender for Containers scans ACR images on push and periodically re-scans stored images for known CVEs, providing vulnerability reports and recommendations in Defender for Cloud.
An analytics job must reprocess the last 3 days of events after a bug fix. What makes this possible?
Shortcut: Because the log is retained rather than consumed destructively, a processor can reset its checkpoint and replay from any offset or enqueued time still inside the retention period.
What command stops an AKS cluster to save compute costs while preserving its configuration?
Shortcut: az aks stop deallocates cluster VMs and pauses the control plane billing. The cluster configuration is preserved and can be resumed with az aks start.
Which authentication approach removes account keys from an application entirely?
Shortcut: Cosmos DB supports Azure AD data-plane RBAC. Assigning a managed identity the Cosmos DB Built-in Data Contributor role lets the SDK authenticate with a token, so no key exists to leak.
Which service enforces organisational standards such as 'all resources must have an owner tag'?
Shortcut: RBAC governs who may act; Azure Policy governs what configurations are permitted, evaluating resources at create time and auditing existing ones.
Which ACR task type supports running commands in a specific order with conditional logic, defined in a YAML file?
Shortcut: Multi-step tasks define a pipeline of steps in a YAML task file, supporting conditions, environment variables, and multiple container builds/runs in sequence.
An Event Grid subscription to an Azure Function endpoint fails consistently. Where should you first check for errors?
Shortcut: Event Grid subscription metrics show delivery success/failure counts. Function logs show whether invocations occurred and what errors happened. Use Azure Monitor diagnostics logs on the Event Grid topic for detailed tracing.
Which RDB persistence option in Azure Cache for Redis Premium creates a snapshot every 60 minutes?
Shortcut: RDB snapshots can be configured with intervals (15, 30, 60 minutes). The snapshot is a point-in-time binary dump of the entire dataset, useful for disaster recovery.
What is the maximum number of secrets per Key Vault?
Shortcut: Key Vault has no documented limit on the number of secrets. Limits apply to transactions per second (2000 GET secret/10 sec per vault in Standard). Large volumes should use multiple vaults.
An application needs to scale on Service Bus queue depth rather than CPU. Which AKS add-on provides this?
Shortcut: KEDA provides scalers for external event sources including Service Bus, Event Hubs, and Storage Queues, and can scale a deployment to zero when the source is empty.
To eliminate public exposure of the database server entirely, which networking option should be chosen at creation?
Shortcut: Private access injects the server into a delegated subnet with a private IP and no public endpoint. Firewall rules still leave a public endpoint reachable.
An organization needs FIPS 140-2 Level 3 validated key storage. What Azure service provides this beyond Key Vault Premium?
Shortcut: Azure Managed HSM provides FIPS 140-2 Level 3 validated, single-tenant HSM service. Key Vault Premium uses Level 2 HSMs. Azure Dedicated HSM provides the physical device for maximum control.
Which host.json setting limits the number of concurrent HTTP requests handled per instance?
Shortcut: maxConcurrentRequests caps in-flight executions per instance, and maxOutstandingRequests bounds queued requests. Both protect the instance from overload.
A Container App processes files from Azure Blob Storage when they are uploaded. Which job type and KEDA trigger combination is correct?
Shortcut: , new blob uploaded), then scale to zero after processing.
Which backup feature in Azure Database for PostgreSQL Flexible Server allows restore to any point within the retention period?
Shortcut: Flexible Server continuously archives WAL (write-ahead logs) enabling point-in-time restore to any second within the retention period (up to 35 days).
An Azure Function must sign data with a key that must never leave the vault. Which operation supports this?
Shortcut: Cryptographic operations such as sign, verify, wrap, and unwrap execute inside Key Vault. Non-exportable keys therefore never appear in application memory.
What is the effect of setting minReplicas to 1 on a Container App?
Shortcut: minReplicas 1 keeps a warm replica at all times. It eliminates cold-start latency but means you pay for that replica even with no traffic.
A cached response must be invalidated when its underlying record changes. Which approach is most reliable?
Shortcut: Write-through invalidation removes the stale entry deterministically at the moment of change. TTL alone leaves a stale window equal to the remaining TTL.
A consumer defers a Service Bus message using Defer(). How is the deferred message later retrieved?
Shortcut: Deferred messages are retained in the main queue but hidden. They must be explicitly received by sequence number (ReceiveDeferredMessageAsync(sequenceNumber)), which the application must track.
Which Log Analytics table stores Azure Activity Log events (Azure control plane operations)?
Shortcut: AzureActivity contains Activity Log events: CRUD operations on Azure resources, policy evaluations, service health events. Query it to investigate who created, modified, or deleted a resource.
A node pool needs to be upgraded to a newer OS image without upgrading the Kubernetes version. Which command does this?
Shortcut: az aks nodepool upgrade --node-image-only updates only the OS image (security patches) on nodes without changing the Kubernetes version.
What is the main advantage of Cosmos DB's hierarchical partition keys?
Shortcut: Hierarchical partition keys (up to 3 levels) distribute data more granularly, preventing hot partitions when a single partition key value approaches the 20 GB limit.
Which TWO statements correctly distinguish metric alerts from log search alerts?
Shortcut: Platform metrics are pre-aggregated, so metric alerts fire quickly and cheaply and do support dimensions. Log search alerts trade latency and query cost for the full expressiveness of KQL across arbitrary tables.
Which Azure Policy initiative enforces Kubernetes-level policies (pod security, namespace quotas) via Gatekeeper OPA on AKS?
Shortcut: Azure Policy for AKS uses OPA Gatekeeper to enforce policies at admission time, such as restricting privileged containers or requiring resource limits.
Which property should a consumer use to implement idempotency across redeliveries?
Shortcut: MessageId is stable across redeliveries of the same logical message, so recording processed MessageIds lets the handler discard duplicates safely.
A company needs Cosmos DB data to be backed up at a point-in-time and restored by the customer without contacting Microsoft Support. Which backup mode enables this?
Shortcut: Continuous backup mode (available in 7-day and 30-day tiers) allows self-service point-in-time restore to any second within the retention window without opening a support ticket.
Which setting controls how long data remains queryable in a Log Analytics workspace?
Shortcut: Retention governs the interactive query window. Beyond it, data can move to a cheaper archive tier and be restored or searched when needed.
After deleting a tag by mistake, you need to recover it. Which prerequisite must have been in place?
Shortcut: Soft delete retains deleted tags and manifests in a recoverable state for the configured retention window. Without it, deletion is immediate and permanent.
You must store both the source text and its embedding, then filter by category before the vector search. What is required for efficient execution?
Shortcut: Filtered vector search benefits from indexing the filter property as well as the vector path, allowing the engine to restrict the candidate set before computing distances.
A company needs to ensure all Azure VMs have a specific tag 'Environment' applied. Which Azure Policy effect automatically adds the tag if missing?
Shortcut: Modify effect can add, replace, or remove resource tags and properties on existing and new resources. A Modify policy with 'add' operation ensures the Environment tag is applied if missing.
Which Service Bus client library method enables efficient message processing across multiple concurrent processors?
Shortcut: ServiceBusProcessor with MaxConcurrentCalls processes messages concurrently. It handles lock renewal, error handling, and auto-complete/abandon, simplifying high-throughput consumers.
A registry must encrypt images with a customer-managed key (CMK) stored in Azure Key Vault. Which SKU supports this?
Shortcut: Customer-managed key encryption for ACR is a Premium-only feature. The CMK must be in an Azure Key Vault in the same region.
Which PostgreSQL extension is used to partition a large table by range (e.g., by date) for improved query performance?
Shortcut: PostgreSQL's native declarative partitioning (PARTITION BY RANGE/LIST/HASH) efficiently partitions large tables. pg_partman automates partition management (creating/dropping partitions).
An AKS pod must access Cosmos DB with a workload-specific identity. Which combination is correct?
Shortcut: Workload Identity gives the pod its own Entra ID identity. Pairing it with the Cosmos DB Built-in Data Contributor data role grants exactly the data access required.
Which Azure Policy for Kubernetes effect prevents pods that request privileged escalation from being admitted?
Shortcut: The Deny effect rejects non-compliant resources at admission through the Gatekeeper webhook. Audit only records violations after the fact.
What does enabling batched delivery on a subscription change?
Shortcut: Batching sends multiple events per HTTP request, controlled by maxEventsPerBatch and preferredBatchSizeInKilobytes, improving throughput for handlers that can process arrays.
Which index type suits equality lookups on a JSONB column's keys?
Shortcut: GIN indexes the contents of JSONB documents and supports containment operators efficiently. jsonb_path_ops produces a smaller, faster index for the @> operator.
A team stores database passwords in Key Vault. The application must handle Key Vault throttling gracefully. Which HTTP status code indicates throttling?
Shortcut: Key Vault returns HTTP 429 when the request rate exceeds the vault's throttle limits. Implement exponential backoff retry logic and Retry-After header handling in the application.
How do you mount Azure Files as a volume in a Container App?
Shortcut: Container Apps supports Azure Files as a persistent volume. You configure the storage in the environment and then reference it as a volume mount in the container's configuration.
No order may be published without its database write succeeding. Which pattern satisfies this?
Shortcut: Service Bus transactions cannot enlist an external database, so no distributed transaction is available. The outbox pattern makes the event part of the same local transaction as the order, and a relay publishes it afterwards, so the two can never diverge.
Billing must process each customer's events strictly in order. What is required?
Shortcut: Sessions bind all messages with the same SessionId to one consumer holding an exclusive lock, which is what preserves FIFO per customer while still allowing many customers to be processed in parallel. A single global consumer would also preserve order but destroys throughput.
Billing occasionally charges twice during redeploys. Which TWO measures address this?
Shortcut: Service Bus is at-least-once, so a redeploy that interrupts processing after the charge but before settlement causes redelivery. Consumer-side idempotency on MessageId makes reprocessing harmless, and broker duplicate detection removes repeats caused by publisher retries. Receive-and-delete would lose messages instead.
Which TWO decisions satisfy the telemetry requirements for the two consuming teams?
Shortcut: Consumer groups are independent views of the same stream with their own offsets, so both teams read everything without interfering. Replay is possible only within the retention window, so it must cover the required three days. Sharing one consumer group would make the two teams compete for partitions.
Telemetry for a given vehicle must be processed in order. How is that achieved?
Shortcut: Event Hubs guarantees ordering only within a partition. Hashing a stable partition key such as the vehicle id co-locates that vehicle's events in one partition. Sessions are a Service Bus feature, and a single partition would cap throughput at one consumer.
The notification service overwhelms an SMS gateway limited to 10 requests per second. What is the correct design?
Shortcut: A queue absorbs the burst and decouples arrival rate from processing rate. Bounding consumer concurrency, for example with maxConcurrentCalls, holds the outbound rate under the gateway's limit. Scaling out or retrying harder increases pressure on the very component that is failing.