AI-200 Practice Set 15: 47 Exam-Style Questions

An orchestration must pause for a human approval that may take days. Which TWO statements are correct?

1. ✓ A Use WaitForExternalEvent; the orchestration is dehydrated while waiting and costs no compute (correct answer)
2. ✓ B Pair the wait with a durable timer to enforce an approval deadline (correct answer)
3. C Use Thread.Sleep inside the orchestrator
4. D The orchestrator may call DateTime.Now to check the deadline
5. E Consumption plan functions cannot exceed 10 minutes, so this is impossible

Shortcut: WaitForExternalEvent unloads the orchestration until RaiseEventAsync arrives, so a multi-day wait costs nothing. A durable timer raced against the event enforces a timeout. Now break replay determinism, and the 10-minute cap applies to a single activity execution, not to the orchestration's wall-clock lifetime.

A build pipeline needs to push images to ACR using a service principal. Which permission should the service principal have?

1. A Owner
2. B Contributor
3. ✓ C AcrPush (correct answer)
4. D AcrPull

Shortcut: AcrPush grants push access (read + write tags/manifests) without broader Azure resource management rights. Always use least-privilege role assignments.

Which Azure Database for PostgreSQL tier provides the best cost/performance balance for development and test workloads?

1. ✓ A Burstable (correct answer)
2. B General Purpose
3. C Memory Optimized
4. D Hyperscale

Shortcut: ) provide variable CPU performance suitable for dev/test workloads that don't need continuous high CPU. They are significantly cheaper than General Purpose.

Which limitation applies to the number of role assignments per subscription?

1. A Unlimited
2. ✓ B There is a documented ceiling, so group-based assignment is recommended at scale (correct answer)
3. C Exactly 100
4. D Only 10

Shortcut: Azure enforces a limit on role assignments per subscription. Assigning to groups rather than individual principals is the standard way to stay well below it.

A team deploys Azure Functions using deployment slots for zero-downtime releases. Which plan supports deployment slots?

1. A Consumption plan (any number of slots)
2. ✓ B Premium and Dedicated plans only (correct answer)
3. C All plans with more than 1 instance
4. D Consumption plan with staging slot only

Shortcut: Deployment slots are supported on Premium and Dedicated (App Service) plans. Consumption plan does not support slots. Slots enable staging, testing, and swap-based zero-downtime deployments.

What is the effect of setting an ACR retention policy to 7 days?

1. A All tags older than 7 days are deleted
2. ✓ B Untagged manifests older than 7 days are deleted automatically (correct answer)
3. C The registry is deleted after 7 days of inactivity
4. D Soft-deleted items are purged after 7 days

Shortcut: The retention policy applies only to untagged manifests. Tagged images are unaffected; removing those requires az acr purge with explicit tag filters.

A Cosmos DB NoSQL container needs to efficiently run queries filtering on a property that is not the partition key. What indexing feature should be verified?

1. A Composite index on the property
2. B Spatial index
3. ✓ C The property must be included in the indexing policy (included paths) (correct answer)
4. D TTL index

Shortcut: By default, all properties are indexed (Consistent mode). If indexing policy has been customized to exclude paths, properties not indexed will cause full scans. Verify the property is in included paths.

Which Application Insights feature shows real-time metrics with sub-second latency for live application monitoring?

1. A Log Analytics near-real-time queries
2. ✓ B Live Metrics Stream (Live Metrics) (correct answer)
3. C Metrics Explorer
4. D Application Map

Shortcut: Live Metrics Stream shows real-time application telemetry (requests/sec, failure rate, CPU, dependencies) with <1 second latency. Ideal for monitoring deployments or incidents in real time.

In a request/reply pattern over Service Bus, which properties coordinate the response?

1. ✓ A ReplyTo and CorrelationId (correct answer)
2. B SessionId only
3. C MessageId only
4. D Label

Shortcut: The requester sets ReplyTo to its response queue and a CorrelationId; the responder echoes the CorrelationId so the requester can match the reply to the original request.

How are Container Apps environments billed in Consumption plan?

1. A Per environment per hour
2. ✓ B Per vCPU-second and GiB-second consumed by running replicas (correct answer)
3. C Per number of revisions
4. D Flat monthly fee

Shortcut: Consumption plan charges are based on actual vCPU-seconds and GiB-seconds consumed by active replicas, plus per-request charges. Idle apps (0 replicas) incur no compute cost.

Which tool setting prevents a bulk import job from exhausting throughput and throttling the production workload?

1. ✓ A Enable bulk execution and cap concurrency, or run against a separate container (correct answer)
2. B Switch to Strong consistency
3. C Disable indexing permanently
4. D Use Gateway mode

Shortcut: Bulk mode batches operations efficiently, but concurrency still needs bounding against available RU/s. Temporarily suspending indexing during import and re-enabling afterwards is a common companion tactic.

How should secrets be supplied to a container image build that needs a private package feed token?

1. A Copy the token into a layer with COPY
2. ✓ B Use a build-time secret mount so the value never persists in an image layer (correct answer)
3. C Set it as an ENV instruction
4. D Commit it to the repository

Shortcut: Anything written into a layer, including ENV and COPY, is recoverable from the image. Secret mounts expose the value only during that build step.

Which Event Grid feature allows you to transform events before delivery using JMESPath or JSONata expressions?

1. A Advanced filters
2. B Event filtering only
3. ✓ C Event Grid Namespace topics with event transformations (correct answer)
4. D Dead-letter enrichment

Shortcut: Event Grid Namespace topics support event transformations (input mapping) allowing payload reshaping, property renaming, and adding static values before delivery to subscribers.

Which resource setting protects a node from a single container consuming all available memory?

1. A resources.requests.memory
2. ✓ B resources.limits.memory (correct answer)
3. C PodDisruptionBudget
4. D PriorityClass

Shortcut: The memory limit is enforced by the kernel cgroup; exceeding it triggers an OOM kill of that container. The request only influences scheduling placement.

How does Azure Database for PostgreSQL Flexible Server handle automatic minor version upgrades?

1. A Minor versions are never upgraded automatically
2. ✓ B Minor version upgrades apply automatically during the maintenance window without user action (correct answer)
3. C Minor upgrades require a manual trigger from the portal
4. D Minor upgrades require creating a new server

Shortcut: Azure Database for PostgreSQL Flexible Server automatically applies minor version patches during the configured maintenance window, requiring no user action.

What information is captured in a Microsoft Entra ID sign-in log that is useful for security investigations?

1. A Resource creation events
2. ✓ B User sign-in details: IP address, location, app, status, MFA result, Conditional Access policy applied (correct answer)
3. C Azure resource modifications
4. D Key Vault access events

Shortcut: Entra ID Sign-in logs capture authentication attempts with IP, location, device, application, authentication method, success/failure, and which Conditional Access policies were evaluated/applied.

An event subscription must survive a regional outage of the handler. Which configuration helps most?

1. A Shorter TTL
2. ✓ B Dead-lettering to a geo-redundant storage account plus a replay process (correct answer)
3. C Disabling retries
4. D Batched delivery

Shortcut: Undeliverable events land in the dead-letter container. Storing that in GRS and building a replay mechanism means no event is lost during an extended handler outage.

What is the maximum number of partitions for an Event Hub in the Standard tier?

1. A 8
2. ✓ B 32 (correct answer)
3. C 50
4. D 100

Shortcut: Standard tier supports up to 32 partitions. Premium and Dedicated support up to 2000 partitions. Partition count cannot be decreased after creation.

An AKS cluster needs outbound internet traffic routed through a central Azure Firewall. What is required?

1. A Configure NSG on the node subnet
2. ✓ B Use a User-Defined Route (UDR) to route 0.0.0.0/0 to the firewall private IP (correct answer)
3. C Set outboundType to loadBalancer
4. D Enable public IP on each node

Shortcut: 0/0 to the Azure Firewall private IP forces all AKS egress through the firewall.

Which setting should be enabled to require encrypted client connections?

1. ✓ A require_secure_transport (SSL enforcement) set to ON (correct answer)
2. B log_connections
3. C ssl_ciphers only
4. D pgcrypto extension

Shortcut: Enforcing SSL/TLS rejects unencrypted connections at the server. The client must then supply sslmode=require or stricter.

A DevOps team uses Azure DevOps pipelines. How should Key Vault secrets be accessed in pipeline tasks?

1. A Hard-code secrets in pipeline YAML
2. ✓ B Use the Azure Key Vault task with a service connection; secrets are loaded as pipeline variables (correct answer)
3. C Check secrets into source control encrypted
4. D Store secrets in Azure DevOps variable groups without Key Vault

Shortcut: The Azure Key Vault pipeline task fetches secrets at runtime using a service connection (or managed identity for hosted agents) and makes them available as masked pipeline variables.

Which namespace-level feature supports failover to a paired region?

1. ✓ A Geo-disaster recovery with an alias (correct answer)
2. B Capture
3. C Auto-inflate
4. D Consumer groups

Shortcut: Geo-DR pairs a primary and secondary namespace behind a stable alias and replicates metadata. Note that event data itself is not replicated, only the entity configuration.

What happens when you try to pull a quarantined image from ACR?

1. A The pull succeeds normally
2. B The pull fails with a 404 error
3. ✓ C The pull is blocked with an access denied error until the image passes quarantine checks (correct answer)
4. D The image is automatically scanned and released

Shortcut: Quarantined images are blocked from pull operations. They must be explicitly approved (quarantine status updated) before they can be pulled.

Which Azure Cache for Redis feature sends notifications when keys expire or are modified?

1. A Event Grid integration
2. ✓ B Redis keyspace notifications (pub/sub channels) (correct answer)
3. C Azure Monitor alerts only
4. D Webhook on expiry

Shortcut: Redis keyspace notifications publish events to pub/sub channels when keys expire, are deleted, or modified. Subscribe to __keyevent@0__:expired to receive expiry notifications.

Which mechanism captures the state of variables at the moment an exception occurred in production .NET code?

1. ✓ A Snapshot Debugger (correct answer)
2. B Live Metrics
3. C Availability tests
4. D Workbooks

Shortcut: Snapshot Debugger collects a debug snapshot including local variables and the call stack when exceptions occur, without stopping the running application.

A Service Bus consumer calls ReceiveMessageAsync with a MaxWaitTime of 5 seconds but no message is available. What is returned?

1. A Exception is thrown
2. ✓ B null (no message available) (correct answer)
3. C An empty message
4. D The call blocks indefinitely

Shortcut: ReceiveMessageAsync returns null when no message arrives within MaxWaitTime. Applications should check for null before processing to handle empty queue scenarios gracefully.

Which metric best indicates that a Container App's HTTP scale rule threshold is set too high?

1. ✓ A Replica count stays at minReplicas while request latency climbs (correct answer)
2. B CPU usage is low
3. C Memory usage is stable
4. D Revision count increases

Shortcut: If concurrency per replica must exceed a high threshold before scaling triggers, queuing builds up and latency rises while the replica count remains flat. Lower the concurrentRequests target.

Which security control prevents a Redis instance from being reachable over the public internet?

1. A Requiring TLS
2. ✓ B A private endpoint with public network access disabled (correct answer)
3. C Setting a strong access key
4. D Enabling AOF

Shortcut: A private endpoint places the cache on a private IP inside the VNet; disabling public network access removes the public listener entirely. TLS and keys protect a still-reachable endpoint.

A team wants to visualize request dependency chains between microservices as a topology map. Which Application Insights feature provides this?

1. A Distributed tracing timeline
2. ✓ B Application Map (correct answer)
3. C Service Bus Monitor
4. D Event Grid topology view

Shortcut: Application Map displays a visual topology of service-to-service calls, showing request rates, failure rates, and response times between application components based on dependency tracking data.

A Cosmos DB-triggered function must not reprocess the entire container on first deployment. Which setting controls this?

1. ✓ A StartFromBeginning / start-from-time on the trigger (correct answer)
2. B maxItemsPerInvocation
3. C The lease container name
4. D The partition key

Shortcut: The Cosmos DB trigger reads the change feed. Configuring it to start from now rather than the beginning prevents an initial replay of all existing documents.

A team needs to fan-out a single domain event to 20 different microservices. What is the most efficient Event Grid approach?

1. A 20 separate custom topics, one per service
2. ✓ B One custom topic with 20 event subscriptions (one per service) (correct answer)
3. C Event Grid Domain with 20 domain topics
4. D Service Bus topic with 20 subscriptions is better

Shortcut: A single custom topic with 20 event subscriptions is the correct approach. Event Grid delivers the event to each subscription independently. Domains are for multi-tenant scenarios with isolated topic namespaces.

A Container App needs to call another app in the same environment without going through the public internet. What approach should you use?

1. A External FQDN of the target app
2. ✓ B Internal FQDN: <appname>.<envname>.svc.cluster.local or simply <appname> via DAPR service invocation (correct answer)
3. C Azure VNet peering
4. D Azure Service Bus for all cross-app communication

Shortcut: Apps in the same Container Apps Environment can communicate using the internal FQDN pattern, which routes within the environment's private network without traversing the internet.

Which Azure service provides a serverless way to execute logic in response to Cosmos DB change feed events without managing infrastructure?

1. A Azure Logic Apps
2. ✓ B Azure Functions with Cosmos DB trigger (correct answer)
3. C Azure Data Factory
4. D Azure Event Grid

Shortcut: Azure Functions with the Cosmos DB trigger listens to the change feed and invokes the function for each batch of changes. It manages checkpointing and parallel consumption automatically.

Which approach is correct for a CI/CD pipeline that must deploy to Azure without stored secrets?

1. A A service principal with a client secret in the pipeline
2. ✓ B Workload identity federation between the CI provider and an Entra ID application (correct answer)
3. C A shared user account
4. D A certificate committed to the repository

Shortcut: Federated credentials let the pipeline exchange its own OIDC token for an Azure token. No client secret is created, stored, or rotated.

Which condition causes a message to be dead-lettered even before any delivery attempt?

1. A MaxDeliveryCount exceeded
2. ✓ B TimeToLive expiry with dead-lettering on expiration enabled (correct answer)
3. C Lock renewal
4. D Duplicate detection

Shortcut: When EnableDeadLetteringOnMessageExpiration is set, a message whose TTL lapses while queued is moved to the dead-letter queue with reason TTLExpiredException.

Which identity should a Container App use to pull from a private ACR?

1. A The ACR admin account stored as a secret
2. ✓ B A user-assigned or system-assigned managed identity granted AcrPull (correct answer)
3. C A repository-scoped token in the container image
4. D The Container Apps environment identity only

Shortcut: Container Apps supports managed identity for registry authentication. Assign the identity AcrPull on the registry and reference it in the app's registry configuration, avoiding stored credentials.

Which approach reduces cost when running multiple test databases that each need their own schema but share infrastructure?

1. A One Flexible Server per database
2. ✓ B One Flexible Server with multiple databases (schemas) (correct answer)
3. C One database per resource group
4. D Use Azure SQL instead

Shortcut: A single Flexible Server instance can host multiple databases. Each database is isolated at the schema/role level. This shares compute and storage costs across multiple teams.

Which Azure networking feature inspects and filters traffic between subnets based on source/destination IP and port rules?

1. A Azure Firewall (L7 FQDN-based)
2. ✓ B Network Security Group (NSG) (correct answer)
3. C Web Application Firewall (WAF)
4. D Azure DDoS Protection

Shortcut: NSGs are L3/L4 stateful packet filters applied to subnets or NICs. They contain inbound/outbound security rules based on source/destination IP, port, and protocol. Azure Firewall provides L7 FQDN filtering.

Which Azure Functions trigger is appropriate for processing blob files uploaded to Azure Storage without using Event Grid?

1. A HTTP trigger with polling
2. ✓ B Blob Storage trigger (polling or Event Grid-based) (correct answer)
3. C Timer trigger with SDK listing
4. D Service Bus trigger with blob path

Shortcut: The Blob Storage trigger fires when a blob is added/modified. The modern Event Grid-based blob trigger (extension version 5+) is recommended for reduced latency vs. polling-based trigger.

Which Kubernetes liveness probe result causes a container to be restarted?

1. A Readiness probe failure
2. ✓ B Liveness probe failure (correct answer)
3. C Startup probe failure within initialDelaySeconds
4. D Exec probe returning exit code 0

Shortcut: Liveness probe failure causes Kubernetes to restart the container (per the pod's restartPolicy). Readiness probe failure removes the pod from Service endpoints without restarting it.

What is the effect of setting a container's indexing mode to 'none'?

1. A Only the partition key is indexed
2. ✓ B No index is maintained; queries require the partition key and a point read or full scan (correct answer)
3. C All properties are indexed lazily
4. D Writes fail

Shortcut: With indexing off, writes are cheapest but queries cannot use an index. This suits pure key-value access patterns using point reads by id and partition key.

Which statement about Managed HSM differs from standard Key Vault?

1. A It uses access policies
2. ✓ B It is a single-tenant, fully managed HSM pool with its own local RBAC and security domain (correct answer)
3. C It stores only secrets
4. D It is cheaper

Shortcut: Managed HSM provides dedicated, single-tenant HSM capacity with its own local RBAC model and a security domain that must be backed up at provisioning time.

Which statement about Event Grid ordering is correct?

1. A Events are delivered in the order they were published
2. ✓ B No ordering guarantee exists; handlers must use timestamps or version numbers if order matters (correct answer)
3. C Ordering is guaranteed per subject
4. D Ordering requires sessions

Shortcut: Event Grid makes no ordering promise. When order matters, either carry a sequence or version in the payload, or use Service Bus sessions or Event Hubs partitions instead.

An application is deployed with 3 replicas. A PodDisruptionBudget has minAvailable: 2. What is the maximum number of pods that can be voluntarily disrupted at once?

1. ✓ A 1 (correct answer)
2. B 2
3. C 3
4. D 0

Shortcut: With minAvailable: 2 and 3 replicas, at most 1 pod can be disrupted at a time (3 - 2 = 1). Voluntary disruptions (upgrades, drains) are blocked if they would violate this.

A Cosmos DB container has a 500 RU read cost for a specific document. Which action would most reduce the RU consumption for future reads?

1. A Use strong consistency
2. ✓ B Reduce document size by removing unused properties (correct answer)
3. C Increase provisioned throughput
4. D Add more regions

Shortcut: Read cost scales with document size. Removing unused properties or using projections to retrieve partial documents reduces data transferred and lowers RU consumption per read.

What is the behavior when an application tries to access a Key Vault secret that has been disabled?

1. A The previous version is returned
2. B Key Vault returns the disabled secret with a warning
3. ✓ C Key Vault returns 403 Forbidden (secret is disabled) (correct answer)
4. D An email notification is sent

Shortcut: Disabled secrets return HTTP 403 (Forbidden) — the secret exists but is not accessible. This is distinct from 404 (not found). Use disabling to prevent access without permanently deleting the secret.

Which Service Bus feature is required to implement fan-out messaging where 5 different services each receive a copy of every order message?

1. A 5 separate queues with forwarding
2. ✓ B One topic with 5 subscriptions (each with True filter) (correct answer)
3. C One queue with 5 competing consumers
4. D Event Hub with 5 consumer groups

Shortcut: A topic with 5 subscriptions (each with the default True filter) delivers a copy of every message to each subscription. Each subscription acts as an independent queue for its subscriber.