AI-200 Practice Set 11: 47 Exam-Style Questions

What is the Event Grid Basic tier limit for custom events per second compared to the Standard tier?

1. A Basic: 10/s, Standard: unlimited
2. ✓ B Basic: 5,000/s (shared), Standard: dedicated throughput units (correct answer)
3. C They are equivalent
4. D Basic: 100/s, Standard: 10,000/s

Shortcut: Event Grid Basic tier provides shared infrastructure at 5000 events/sec. Standard tier (Namespace topics) offers dedicated throughput units with higher limits and pull delivery support.

Which probe prevents a slow-starting container from being killed before it finishes initialising?

1. A Liveness probe with a short period
2. ✓ B Startup probe with a generous failureThreshold (correct answer)
3. C Readiness probe only
4. D No probe

Shortcut: The startup probe suspends liveness and readiness checks until it succeeds, so a long initialisation does not trigger repeated restarts.

A Python application uses the redis-py library. Which method correctly retrieves multiple keys in a single network round trip?

1. A Calling get() in a loop
2. B Using pipeline() to batch GET commands
3. ✓ C Using mget([key1, key2, ...]) (correct answer)
4. D Using asyncio with separate get() calls

Shortcut: mget fetches multiple keys in a single command and round trip. pipeline() batches arbitrary commands, also reducing round trips. mget is the most idiomatic for bulk key retrieval.

A team configures Application Insights sampling. What does adaptive sampling adjust automatically?

1. A Log Analytics workspace retention
2. ✓ B The fraction of telemetry items tracked, reducing volume and cost while preserving statistical accuracy (correct answer)
3. C Alert thresholds
4. D Metric aggregation intervals

Shortcut: Adaptive sampling dynamically adjusts the sampling percentage to maintain a target telemetry volume. It ensures representative data at reduced cost, preserving operation counts for accurate failure rate calculations.

What is the effect of sending events without a partition key?

1. A The send fails
2. ✓ B Events are distributed round-robin across partitions, maximising throughput but losing per-key ordering (correct answer)
3. C All events go to partition 0
4. D Events are duplicated

Shortcut: Without a key the client balances events across partitions for maximum throughput. Ordering guarantees are then only per partition, not per logical entity.

How does DAPR simplify microservice development in AKS?

1. A Replaces Kubernetes networking
2. ✓ B Provides building blocks (state management, pub/sub, service invocation, secrets) via a sidecar API (correct answer)
3. C Handles node scaling automatically
4. D Acts as an ingress controller

Shortcut: DAPR injects a sidecar container into pods, exposing a language-agnostic API for state management, pub/sub, service-to-service calls, secrets, and more, abstracting infrastructure complexity.

Which metric most directly indicates that a cache is undersized?

1. ✓ A A high eviction rate combined with a falling hit ratio (correct answer)
2. B High CPU
3. C Connected client count
4. D Network bandwidth

Shortcut: Evictions mean Redis is discarding data to stay within maxmemory. When that coincides with a declining hit ratio, the working set exceeds the allocated memory.

Which identity should a multi-container application use so that each container has distinct vault permissions?

1. A One shared system-assigned identity
2. ✓ B Separate user-assigned managed identities with individually scoped role assignments (correct answer)
3. C The subscription service principal
4. D A shared client secret

Shortcut: User-assigned identities can be created per workload and granted only the objects each needs, preserving least privilege and clear audit attribution.

A Function must return an HTTP response immediately but continue processing asynchronously. Which Durable Functions pattern implements this?

1. A Monitor pattern
2. ✓ B Async HTTP API (202 Accepted + status polling endpoint) (correct answer)
3. C Function chaining
4. D Fan-out/fan-in

Shortcut: The Async HTTP API pattern starts an orchestration and immediately returns 202 Accepted with a status URL. The client polls the status endpoint until the orchestration completes.

How do you run a container directly in ACR for a one-off task without provisioning separate compute?

1. A az acr build
2. ✓ B az acr run (correct answer)
3. C az container create
4. D az acr task run

Shortcut: az acr run executes a container directly on ACR's cloud build infrastructure using the acb runner, useful for one-off tasks without separate compute.

Which Cosmos DB feature is used to run atomic multi-document transactions within a single logical partition?

1. A Batch API with isolation
2. ✓ B Stored procedures with transactional batches (correct answer)
3. C Change feed with optimistic concurrency
4. D Multi-region write with conflict resolution

Shortcut: Stored procedures in Cosmos DB execute within a transaction scoped to a single logical partition. The transactional batch API also enables atomic multi-document operations within one partition.

What is the maximum number of custom RBAC role definitions per Azure AD tenant?

1. A 100
2. B 1,000
3. ✓ C 5,000 (correct answer)
4. D Unlimited

Shortcut: Azure allows up to 5,000 custom role definitions per Azure AD tenant. This is generally sufficient; use role inheritance and wildcards in actions to minimize the number of custom roles needed.

What is the correct way to share an HttpClient across function invocations?

1. A Create a new HttpClient per invocation
2. ✓ B Use a static/singleton HttpClient or IHttpClientFactory (correct answer)
3. C Use a using block per call
4. D Store it in the function context

Shortcut: Creating a client per invocation exhausts sockets under load. A static instance or IHttpClientFactory reuses connections correctly across invocations on the same instance.

An AKS deployment shows ImagePullBackOff with 'unauthorized'. The cluster uses a system-assigned kubelet identity. What is the fastest correct remedy?

1. A Create an imagePullSecret from the ACR admin credentials
2. ✓ B Run az aks update --attach-acr <registry> to grant AcrPull to the kubelet identity (correct answer)
3. C Assign Contributor on the registry to the cluster identity
4. D Set imagePullPolicy to IfNotPresent

Shortcut: --attach-acr creates an AcrPull role assignment for the kubelet identity. Admin credentials work but reintroduce a shared secret; Contributor is excessive; imagePullPolicy does not affect authentication.

A Flexible Server instance should only accept TLS 1.2 or higher. Where is this configured?

1. A Application connection string only
2. ✓ B Server parameter ssl_min_protocol_version (correct answer)
3. C Azure Firewall TLS policy
4. D NSG rule

Shortcut: The ssl_min_protocol_version server parameter controls the minimum TLS version. 3 to reject older connections.

A daily cap is configured on a workspace. What happens once it is reached?

1. A Older data is deleted
2. ✓ B Ingestion stops for the rest of the day, creating gaps in telemetry (correct answer)
3. C Costs are refunded
4. D Queries are blocked

Shortcut: The daily cap protects budget by halting ingestion, but any telemetry produced afterwards is lost permanently. Alerting on approaching the cap is essential.

A team needs to process real-time streaming events with SQL-based transformations and output results to Power BI. Which Azure service integrates directly with Event Hubs as input?

1. A Azure Data Factory
2. ✓ B Azure Stream Analytics (correct answer)
3. C Azure Databricks only
4. D Logic Apps

Shortcut: Azure Stream Analytics natively integrates with Event Hubs as a streaming input, supports SQL-like queries for real-time transformations, and can output to Power BI, Cosmos DB, Azure SQL, and more.

Which ingress protocol setting allows a Container App to accept raw TCP traffic (e.g., for a gRPC server)?

1. A HTTP/2
2. B HTTP
3. ✓ C TCP (with transport layer only) (correct answer)
4. D gRPC (exposed directly)

Shortcut: Container Apps ingress supports TCP mode for non-HTTP protocols. This passes TCP traffic directly to the container without HTTP-level routing or session affinity.

Which operation is guaranteed atomic in Cosmos DB NoSQL?

1. ✓ A A transactional batch across documents sharing one partition key (correct answer)
2. B A cross-partition bulk write
3. C A change feed read
4. D A cross-container update

Shortcut: Transactional batch (and stored procedures) provide ACID semantics only within a single logical partition. Cosmos DB offers no cross-partition or cross-container transactions.

How should multi-region Key Vault deployments be architected for high availability?

1. A One vault, geo-replication enabled
2. ✓ B One primary vault per region (Key Vault replicates within a region's paired region automatically) (correct answer)
3. C Manual replication between vaults
4. D Azure Front Door in front of one vault

Shortcut: Key Vault automatically replicates within its region's pair. For multi-region HA, deploy separate vaults per region. Apps should have fallback logic to try the secondary region's vault if the primary is unavailable.

What does enabling partitioning on a Service Bus queue achieve?

1. A Guaranteed global ordering
2. ✓ B Higher throughput and availability by spreading the entity across multiple message brokers (correct answer)
3. C Automatic dead-lettering
4. D Lower cost

Shortcut: Partitioned entities distribute messages across brokers, increasing throughput and resilience. The trade-off is that ordering is only guaranteed within a partition key or session.

What is the practical consequence of enabling Azure AD integration with Azure RBAC for Kubernetes authorisation?

1. A Kubernetes RBAC objects are ignored entirely
2. ✓ B Access is granted through Azure role assignments instead of managing RoleBindings in-cluster (correct answer)
3. C Only the admin kubeconfig can be used
4. D Pods gain automatic Key Vault access

Shortcut: With Azure RBAC for Kubernetes, authorisation decisions are made from Azure role assignments scoped to the cluster or namespace, centralising access control in Azure AD rather than in-cluster manifests.

An application using Azure Cache for Redis is experiencing high CPU usage. Which Redis operation is most likely causing this?

1. A Simple GET/SET operations
2. ✓ B KEYS * pattern scan on a large keyspace (correct answer)
3. C PING health check
4. D TTL retrieval

Shortcut: KEYS * blocks the Redis server while scanning all keys, O(N) where N = total keys. Use SCAN with a cursor for non-blocking iteration on large keyspaces.

An Azure Function processes messages from a Service Bus queue. The function fails with an exception. What happens to the message?

1. A The message is deleted
2. ✓ B The function marks it as abandoned, incrementing DeliveryCount; after MaxDeliveryCount, it goes to DLQ (correct answer)
3. C The message stays locked forever
4. D The function retries immediately 3 times then deletes

Shortcut: The Service Bus trigger uses PeekLock. On function failure, the SDK abandons the message (releases the lock, increments DeliveryCount). After MaxDeliveryCount is reached, it moves to DLQ.

Which built-in role allows assigning roles to others without granting full resource management?

1. A Owner
2. ✓ B User Access Administrator (correct answer)
3. C Contributor
4. D Reader

Shortcut: User Access Administrator grants only access management permissions. It is the least-privilege option for delegating role assignment without Owner-level resource control.

An AKS cluster uses Azure Managed Prometheus. Where is the scraped metrics data stored?

1. A Log Analytics Workspace
2. ✓ B Azure Monitor workspace (backed by Azure Data Explorer) (correct answer)
3. C InfluxDB on AKS
4. D Azure Storage Account

Shortcut: Azure Managed Prometheus stores metrics in an Azure Monitor workspace. You can query them via the Prometheus query endpoint or visualize in Azure Managed Grafana.

Which Azure service emits system topic events for blob creation and deletion?

1. ✓ A Azure Storage (correct answer)
2. B Azure Monitor
3. C Azure Policy
4. D Azure Advisor

Shortcut: BlobCreated and BlobDeleted events through a system topic, commonly used to trigger ingestion pipelines.

An HNSW index build on 5 million vectors is extremely slow. Which server parameter most improves build time?

1. A work_mem
2. ✓ B maintenance_work_mem (correct answer)
3. C max_connections
4. D effective_cache_size

Shortcut: Index construction uses maintenance_work_mem. Raising it (and max_parallel_maintenance_workers) lets more of the graph be built in memory, substantially reducing build time.

Which Azure Monitor feature enables querying across multiple Log Analytics workspaces in a single KQL query?

1. ✓ A Cross-workspace query using workspace() function (correct answer)
2. B Azure Data Factory cross-workspace
3. C Log Analytics multi-cluster query
4. D Azure Resource Graph only

Shortcut: requests. This enables aggregated views across multiple teams' workspaces.

What does the Kubernetes cordon command do to a node?

1. A Deletes the node
2. ✓ B Marks the node as unschedulable for new pods without evicting existing ones (correct answer)
3. C Upgrades the node OS image
4. D Drains all pods and terminates the node

Shortcut: kubectl cordon marks a node as unschedulable. Existing pods continue running; new pods will not be scheduled to that node. Use drain to also evict existing pods.

Which Event Grid delivery mode, introduced in the Namespace topics tier, allows clients to pull events at their own pace without a push endpoint?

1. A Webhook delivery only
2. ✓ B Pull delivery (client polls endpoint for events) (correct answer)
3. C Queue-based delivery
4. D SSE (Server-Sent Events)

Shortcut: Event Grid Namespace topics support pull delivery where clients poll for events using the ReceiveEvents API. This removes the need for a publicly accessible webhook endpoint.

A Cosmos DB item was read with an ETag. How do you implement optimistic concurrency control?

1. A Use a stored procedure
2. ✓ B Use If-Match header with the ETag on the update request (correct answer)
3. C Use partition key locking
4. D Use transaction batch with read-first

Shortcut: Cosmos DB supports optimistic concurrency via ETags. Include the If-Match header with the item's ETag on updates; if the item was modified since, Cosmos DB returns 412 Precondition Failed.

What happens to a Key Vault reference in App Service when the referenced secret is disabled?

1. A The previous value continues to work indefinitely
2. ✓ B Resolution fails and the setting becomes unresolved, typically breaking the dependent feature (correct answer)
3. C The app is deleted
4. D The secret is re-enabled automatically

Shortcut: Disabling a secret makes it unreadable. The reference cannot resolve on the next refresh, so the app setting is empty and dependent functionality fails.

You need to restrict inbound traffic to a specific set of client IP ranges. Where is this configured?

1. A A Network Security Group on the environment subnet
2. ✓ B IP restrictions in the Container App's ingress configuration (correct answer)
3. C A Kubernetes NetworkPolicy
4. D Azure Firewall only

Shortcut: Container Apps ingress supports allow/deny IP restriction rules evaluated at the ingress layer, which is the supported mechanism for source IP filtering.

Which metric is the primary indicator of consumer lag?

1. A Incoming messages
2. ✓ B The difference between the last enqueued sequence number and the checkpointed offset per partition (correct answer)
3. C Throttled requests
4. D Active connections

Shortcut: Lag is measured per partition as the gap between the newest event and the consumer's checkpoint. It is the key signal for scaling consumers or investigating slow handlers.

What does a hybrid query in RediSearch allow?

1. ✓ A Combining a filter expression with a KNN vector search in one command (correct answer)
2. B Querying two indexes at once
3. C Joining two Redis databases
4. D Mixing RDB and AOF

Shortcut: A pre-filter such as '(@category:{docs})=>[KNN 5 @vec $B]' restricts candidates by tag or numeric criteria before the vector search, improving both relevance and speed.

An application registers in Azure AD to call Microsoft Graph. What type of permissions should it request for background service-to-service calls (no user context)?

1. A Delegated permissions (user context)
2. ✓ B Application permissions (app-only, with admin consent) (correct answer)
3. C Personal access tokens
4. D Azure AD B2C scope

Shortcut: Application permissions (app roles) are granted with admin consent and allow the app to act as itself without a signed-in user. Delegated permissions require a user context (access token on behalf of user).

When an image is pushed to a geo-replicated ACR registry, what happens?

1. A The image must be manually synced to each replica
2. B Replication is triggered by a webhook
3. ✓ C The image automatically replicates to all configured replica regions (correct answer)
4. D Only the primary region receives the image initially

Shortcut: Geo-replication in ACR automatically pushes images to all replica regions when you push to any regional endpoint.

Which property makes a Service Bus topic subscription receive only messages with a specific CorrelationId?

1. A SQL filter on CorrelationId
2. ✓ B Correlation filter (faster, optimized for CorrelationId matching) (correct answer)
3. C Topic action filter
4. D Message routing rule

Shortcut: ) without SQL parsing overhead. They are faster than SQL filters for property equality matching.

Which pgvector distance metric is equivalent to maximizing inner product (used with unit-normalized embeddings)?

1. A <-> (Euclidean)
2. B <=> (Cosine)
3. ✓ C <#> (Negative inner product) (correct answer)
4. D <@> (L1)

Shortcut: <#> returns negative inner product. Sorting ASC by <#> finds vectors with maximum dot product. For unit-normalized embeddings, inner product and cosine similarity are equivalent.

A secret in Key Vault has multiple versions. Which version does an application retrieve when accessing the secret by name without specifying a version?

1. A The oldest version
2. B The first version
3. ✓ C The latest enabled version (correct answer)
4. D A random version

Shortcut: Accessing a secret by name without a version always returns the latest enabled version. Disabled versions are skipped. This enables secret rotation without application configuration changes.

Which ACR webhook event fires when an image is pushed, allowing a downstream deployment to be triggered?

1. A chart_push
2. ✓ B push (correct answer)
3. C delete
4. D quarantine

Shortcut: The 'push' event fires on image push and posts a JSON payload containing the repository and tag to the configured endpoint, which is the standard hook for continuous deployment.

Which authorisation level makes an HTTP-triggered function callable without any key?

1. A function
2. B admin
3. ✓ C anonymous (correct answer)
4. D system

Shortcut: anonymous requires no key. function and admin require a function or master key respectively; production endpoints normally sit behind Entra ID or API Management instead.

What is the Cosmos DB free tier limit?

1. A 400 RU/s and 5 GB forever
2. ✓ B 1000 RU/s and 25 GB per account forever (correct answer)
3. C 5 RU/s and 1 GB per account
4. D Unlimited RUs for 12 months

Shortcut: Cosmos DB free tier provides 1000 RU/s and 25 GB of storage per account forever, limited to one free-tier account per Azure subscription.

Which KQL clause would you add to find failed requests only?

1. ✓ A | where success == false (correct answer)
2. B | where duration > 0
3. C | take 100
4. D | project name

Shortcut: The requests table carries a boolean success column derived from the result code. Filtering on it isolates failures for further analysis.

An app deployed to Container Apps is receiving health alerts from Azure Monitor. Where can you see real-time log output without querying Log Analytics?

1. A Azure Monitor workbooks
2. ✓ B Container Apps log streaming in the Azure portal or CLI (correct answer)
3. C Container Insights dashboard
4. D Event Grid subscription

Shortcut: Container Apps provides real-time log streaming (az containerapp logs show --follow) and the Azure portal log stream view, for immediate debugging without Log Analytics ingestion delay.

Which Azure Functions scaling feature enables event-driven scaling based on external event sources like Kafka, Azure Cache for Redis, and custom metrics in any hosting plan?

1. A HPA in AKS
2. ✓ B KEDA (Kubernetes Event-Driven Autoscaling) (correct answer)
3. C Consumption plan auto-scale
4. D Premium plan burst scaling

Shortcut: When running on AKS or Container Apps, KEDA drives function scaling based on external event sources. In Premium plan, the built-in scale controller uses similar KEDA scalers.