AI-200 Practice Set 1: 48 Exam-Style Questions

Which Azure Service Bus entity type supports publish-subscribe messaging with multiple independent subscribers?

1. A Queue
2. ✓ B Topic with subscriptions (correct answer)
3. C Relay
4. D Event Hub

Shortcut: Service Bus Topics allow multiple subscriptions, each receiving a copy of every message matching its filter. This enables fan-out (pub/sub) patterns where each subscriber processes messages independently.

An AKS cluster must run kube-system pods including CoreDNS and the metrics server. Which node pool type is required for this?

1. A User node pool
2. ✓ B System node pool (correct answer)
3. C Spot node pool
4. D GPU node pool

Shortcut: Every AKS cluster must have at least one system node pool. System node pools host kube-system pods (CoreDNS, metrics-server, tunnel-front) and cannot be deleted while the cluster exists.

Which Cosmos DB consistency level provides the strongest guarantee, always reading the latest committed write?

1. A Session
2. B Bounded staleness
3. ✓ C Strong (correct answer)
4. D Consistent prefix

Shortcut: Strong consistency guarantees linearizability — every read returns the most recent committed write globally. It comes at a latency cost and is only available in single-region or multi-region with a single write region.

Which Key Vault object type stores application passwords, connection strings, and API keys?

1. A Key
2. B Certificate
3. ✓ C Secret (correct answer)
4. D Token

Shortcut: Secrets store arbitrary text values (passwords, connection strings, API keys). Keys store cryptographic keys (RSA, EC) for encryption/signing. 509 certs with auto-renewal.

When you create an Event Grid subscription pointing at a custom webhook, what must the endpoint do before events flow?

1. A Return HTTP 200 to any request
2. ✓ B Complete the subscription validation handshake by echoing the validationCode or calling the validationUrl (correct answer)
3. C Present a client certificate
4. D Register a SAS token

Shortcut: Event Grid posts a SubscriptionValidationEvent. The endpoint must echo validationCode synchronously, or fetch validationUrl asynchronously, proving ownership before deliveries begin.

Your CI pipeline pushes an image tagged 'v2.1' to ACR. A deployment that references 'myapp:v2.1' by tag pulls a different image than the one just built. What is the most likely explanation?

1. A Tags are immutable, so the deployment cached an old digest
2. ✓ B Another pipeline reassigned the same tag to a different manifest (correct answer)
3. C ACR geo-replication has not finished syncing
4. D The image was quarantined by policy

Shortcut: Tags in ACR are mutable pointers to a manifest digest. If two pipelines push the same tag, the later push moves the tag. ) or enable tag immutability via a repository lock to prevent this.

You store 1536-dimension embeddings in Cosmos DB NoSQL and need the 5 nearest neighbours to a query vector. Which query shape is correct?

1. ✓ A SELECT TOP 5 c.id FROM c ORDER BY VectorDistance(c.embedding, @q) (correct answer)
2. B SELECT TOP 5 c.id FROM c WHERE ARRAY_CONTAINS(c.embedding, @q)
3. C SELECT TOP 5 c.id FROM c ORDER BY c.embedding
4. D SELECT TOP 5 c.id FROM c WHERE ST_DISTANCE(c.embedding, @q) < 1

Shortcut: VectorDistance() computes similarity between a stored vector and a query vector. Combining it with ORDER BY and TOP performs the k-nearest-neighbour search; the container must also have a vector index defined.

An App Service using a Key Vault reference cannot resolve a secret. Which cause is most likely?

1. A The secret name contains a hyphen
2. ✓ B The app's managed identity lacks Get permission on secrets (access policy or Key Vault Secrets User role) (correct answer)
3. C Key Vault references are unsupported in App Service
4. D The secret is too long

Shortcut: Key Vault references resolve using the app's managed identity. Without Get on secrets, via either an access policy or the Key Vault Secrets User RBAC role, resolution fails and the setting stays unresolved.

What is the primary purpose of Azure Event Grid?

1. A High-throughput data streaming
2. ✓ B Reactive event routing — delivering discrete events from sources to handlers with built-in retry (correct answer)
3. C Message queuing with guaranteed delivery
4. D Batch data processing

Shortcut: , blob created, resource state changed). It delivers to multiple endpoints with retry, not for high-throughput stream ingestion (use Event Hubs for that).

Which ACR SKU is required to enable geo-replication?

1. A Basic
2. B Standard
3. ✓ C Premium (correct answer)
4. D All SKUs support geo-replication

Shortcut: Geo-replication is Premium-only. It replicates a single registry to multiple Azure regions, enabling low-latency pulls and improved availability.

Which Azure Database for PostgreSQL deployment option provides the highest availability with up to 99.99% SLA using standby nodes?

1. A Single Server
2. ✓ B Flexible Server with zone-redundant high availability (correct answer)
3. C Flexible Server with same-zone HA
4. D Citus (Hyperscale)

Shortcut: Flexible Server with zone-redundant HA deploys a standby in a different availability zone. 99% SLA.

Which Azure Monitor data type captures structured operation records like requests, dependencies, exceptions, and custom events from applications?

1. A Metrics
2. B Logs (Log Analytics)
3. C Traces (distributed tracing)
4. ✓ D Application Insights telemetry (correct answer)

Shortcut: Application Insights collects telemetry including requests, dependencies, exceptions, page views, custom events, and performance counters, all stored as structured records in the underlying Log Analytics workspace.

What determines the maximum number of concurrent consumers that can process in parallel within one consumer group?

1. A The throughput unit count
2. ✓ B The partition count (correct answer)
3. C The retention period
4. D The namespace tier

Shortcut: Each partition is owned by at most one active reader per consumer group. Parallelism therefore has an upper bound equal to the partition count.

A pod must read a secret from Key Vault with no credentials stored anywhere in the cluster. Which combination is correct?

1. A A Kubernetes Secret populated by an init container using a service principal
2. ✓ B Workload Identity: a Kubernetes ServiceAccount federated to an Azure AD managed identity (correct answer)
3. C The kubelet managed identity referenced directly by the pod
4. D An imagePullSecret with Key Vault credentials

Shortcut: Workload Identity projects a signed service account token into the pod, which Azure AD exchanges for an access token via a federated credential. No secret material is stored in the cluster.

Which pgvector operator matches an HNSW index built with vector_cosine_ops?

1. A <->
2. ✓ B <=> (correct answer)
3. C <#>
4. D @>

Shortcut: The index operator class must match the query operator. vector_cosine_ops serves <=> (cosine distance); vector_l2_ops serves <->; vector_ip_ops serves <#>. A mismatch causes a sequential scan.

Which KQL query returns the 10 slowest endpoints by average duration over the last hour?

1. ✓ A requests | where timestamp > ago(1h) | summarize avg(duration) by name | top 10 by avg_duration desc (correct answer)
2. B traces | take 10
3. C requests | order by duration | take 10
4. D dependencies | summarize count() by name

Shortcut: summarize aggregates by endpoint name and top orders the aggregate. Ordering raw rows without aggregating would return the ten slowest individual requests, not the slowest endpoints.

Which Azure Functions hosting plan provides the lowest cost for infrequent, short-duration workloads?

1. A Premium Plan
2. B Dedicated (App Service) Plan
3. ✓ C Consumption Plan (correct answer)
4. D Kubernetes-based plan

Shortcut: Consumption Plan charges only for execution time and number of invocations, with a generous free grant. When idle, you pay nothing. Best for sporadic workloads.

Which Container Apps component provides the logical isolation boundary, shared networking, and DAPR configuration for a group of apps?

1. A Revision
2. B Replica
3. ✓ C Environment (correct answer)
4. D Resource group

Shortcut: A Container Apps Environment is the isolation boundary. All apps within an environment share the same VNet, logging configuration, and DAPR settings.

Which Azure Cache for Redis tier provides enterprise-grade features like active geo-replication and RDB+AOF persistence?

1. A Basic
2. B Standard
3. C Premium
4. ✓ D Enterprise (correct answer)

Shortcut: Enterprise tier (powered by Redis Enterprise) supports active geo-replication, multiple persistence options (RDB+AOF), and higher throughput than the OSS-cluster-based Premium tier.

Which Azure RBAC role provides full access to all Azure resources including the ability to assign roles?

1. A Contributor
2. ✓ B Owner (correct answer)
3. C User Access Administrator
4. D Privileged Identity Management admin

Shortcut: Owner has full access to all resources and can grant access to others (assign roles). Contributor can manage resources but cannot assign roles. User Access Administrator can only manage access, not resources.

Which hosting plan scales to zero and bills only for execution time and memory?

1. A Dedicated (App Service) plan
2. ✓ B Consumption plan (correct answer)
3. C Premium plan
4. D Container Apps plan with minReplicas 1

Shortcut: Consumption scales to zero when idle and bills on GB-seconds plus executions. Premium keeps pre-warmed instances to remove cold starts; Dedicated bills for the plan regardless of use.

A Container App processes Service Bus messages and must cost nothing while the queue is empty. Which configuration achieves scale-to-zero?

1. A An HTTP scale rule with minReplicas 1
2. ✓ B A KEDA Service Bus queue scale rule with minReplicas 0 (correct answer)
3. C A CPU scale rule with minReplicas 0
4. D Manual scaling set to 0

Shortcut: Only event-driven KEDA scalers can wake an app from zero. CPU and memory rules require a running replica to report metrics, so they cannot scale from zero.

Which Redis command creates a vector index supporting KNN search over a HASH field?

1. ✓ A FT.CREATE idx ON HASH SCHEMA vec VECTOR HNSW 6 TYPE FLOAT32 DIM 1536 DISTANCE_METRIC COSINE (correct answer)
2. B SET idx vector
3. C ZADD idx 0 vec
4. D JSON.SET idx $ vec

Shortcut: CREATE with a VECTOR field defines the algorithm (HNSW or FLAT) plus TYPE, DIM, and DISTANCE_METRIC. The attribute count must match the number of parameters supplied.

What is the primary use case for Azure Event Hubs compared to Service Bus?

1. A Point-to-point messaging with guaranteed order
2. ✓ B High-throughput data stream ingestion (millions of events/sec) with retention for replay (correct answer)
3. C Pub/sub with multiple independent subscribers
4. D Request-reply messaging patterns

Shortcut: Event Hubs is designed for high-throughput telemetry and log streaming. It retains events for up to 90 days (Standard/Premium) for replay. Service Bus is for transactional messaging patterns.

Which identity type is tied to the lifecycle of a single Azure resource and is deleted with it?

1. A User-assigned managed identity
2. ✓ B System-assigned managed identity (correct answer)
3. C Service principal from an app registration
4. D Group

Shortcut: A system-assigned identity is created with the resource and deleted alongside it. A user-assigned identity is a standalone resource that can be shared and survives independently.

Which AKS autoscaler automatically adds or removes nodes based on pending pod scheduling pressure?

1. A Horizontal Pod Autoscaler (HPA)
2. B Vertical Pod Autoscaler (VPA)
3. ✓ C Cluster Autoscaler (correct answer)
4. D KEDA

Shortcut: The Cluster Autoscaler adjusts the number of nodes in a node pool. When pods cannot be scheduled due to insufficient resources, it adds nodes. It removes underutilized nodes to save cost.

A multi-region Cosmos DB account must allow writes in every region. Which feature enables this?

1. A Session consistency
2. B Geo-redundancy
3. ✓ C Multi-region writes (multi-master) (correct answer)
4. D Active geo-replication

Shortcut: Multi-region writes (formerly multi-master) allows writes in any configured region. Conflicts are resolved using a configurable conflict resolution policy (Last Write Wins or custom).

A message handler throws an exception. With peek-lock, what happens next?

1. A The message is deleted
2. ✓ B The lock expires or is abandoned, the message is redelivered, and after maxDeliveryCount it is dead-lettered (correct answer)
3. C The queue is disabled
4. D The message moves to a retry queue you must create

Shortcut: Peek-lock keeps the message invisible until completed. On failure the lock lapses and delivery is retried; once DeliveryCount exceeds MaxDeliveryCount the broker moves it to the dead-letter sub-queue.

A Key Vault secret is accidentally deleted. Which Key Vault feature allows recovery within 90 days?

1. A Backup and restore
2. B Geo-replication
3. ✓ C Soft delete + Purge protection (correct answer)
4. D Access policy rollback

Shortcut: Soft delete retains deleted objects for 7–90 days (configurable), allowing recovery. Purge protection prevents permanent deletion during the retention period, even by admins.

A team needs to rebuild container images automatically whenever a public base image (e.g. node:20) is updated in Docker Hub. Which ACR Tasks trigger type handles this?

1. A Scheduled trigger
2. B Source code commit trigger
3. ✓ C Base image update trigger (correct answer)
4. D Webhook trigger

Shortcut: The base image update trigger in ACR Tasks monitors the base image in a registry and automatically queues a rebuild when it is updated.

Which PostgreSQL extension enables vector similarity search for AI embedding storage and retrieval?

1. A pg_trgm
2. B pgcrypto
3. ✓ C pgvector (correct answer)
4. D PostGIS

Shortcut: pgvector adds a vector data type and index types (IVFFlat, HNSW) to PostgreSQL, enabling efficient approximate nearest neighbour search over high-dimensional embeddings.

A message processing system must guarantee that a message is not lost if the consumer crashes after receiving but before processing. Which Service Bus feature handles this?

1. A Dead-letter queue
2. B At-most-once delivery
3. ✓ C Peek-lock (at-least-once delivery) (correct answer)
4. D FIFO ordering

Shortcut: PeekLock) locks the message without removing it. The consumer must explicitly complete it after processing. If the consumer crashes, the lock expires and the message is available again.

A team wants to query Azure Monitor logs using SQL-like syntax. Which query language is used?

1. A SQL
2. ✓ B KQL (Kusto Query Language) (correct answer)
3. C LINQ
4. D SPL (Splunk)

Shortcut: Kusto Query Language (KQL) is used for all Azure Monitor log queries (Log Analytics, Application Insights, Microsoft Sentinel). KQL is declarative, read-only, and optimised for time-series log analysis.

You must guarantee that a specific tag can never be overwritten or deleted once published. Which ACR capability enforces this?

1. A Content Trust
2. B Repository-scoped tokens
3. ✓ C Tag locking via az acr repository update --write-enabled false (correct answer)
4. D Retention policy

Shortcut: Setting write-enabled/delete-enabled to false on a tag or repository makes it immutable. Content Trust proves authorship but does not prevent overwriting; retention policies delete rather than protect.

Which vector index type in Cosmos DB NoSQL is designed for high recall on very large vector collections?

1. A flat
2. B quantizedFlat
3. ✓ C diskANN (correct answer)
4. D range

Shortcut: DiskANN is a graph-based index optimised for large-scale approximate nearest-neighbour search with high recall and low latency. flat is exact but scans everything; quantizedFlat compresses for smaller sets.

Which endpoint types skip the validation handshake entirely?

1. A Any HTTPS endpoint
2. ✓ B Azure services such as Functions with the Event Grid trigger, Storage Queues, and Event Hubs (correct answer)
3. C Only Logic Apps
4. D None

Shortcut: Trusted Azure service destinations are pre-validated by the platform. The handshake exists to prevent Event Grid being used to flood arbitrary third-party endpoints.

Which permission model should be chosen for a new vault to align with Azure-wide role management?

1. A Vault access policies
2. ✓ B Azure RBAC (correct answer)
3. C Shared access signatures
4. D Classic administrators

Shortcut: Azure RBAC is the recommended model. It provides granular built-in roles, inheritance from management group down, PIM support, and unified auditing with the rest of Azure.

Which TWO measures make a production image reference tamper-evident?

1. ✓ A Deploy by digest rather than by tag (correct answer)
2. ✓ B Sign images with Notation and enforce verification with a Ratify policy (correct answer)
3. C Enable the ACR soft delete policy
4. D Use latest for the newest build
5. E Enable admin user on the registry

Shortcut: A digest pins the exact content, and signature verification proves the image came from your pipeline. Soft delete aids recovery but says nothing about authenticity; latest is mutable; the admin user is a shared credential and weakens security.

An application needs Redis to survive a full server restart without data loss. Which persistence option persists all write operations to disk in real time?

1. A RDB (snapshot)
2. ✓ B AOF (Append-Only File) (correct answer)
3. C No persistence
4. D Replication only

Shortcut: AOF persistence logs every write operation to disk. On restart, Redis replays the AOF file to reconstruct the dataset. It provides better durability than RDB but uses more disk I/O.

A team needs to react to events from multiple Azure services (Blob Storage, Resource Manager, Cosmos DB). Which Event Grid topic type supports built-in system events?

1. A Custom topic
2. ✓ B System topic (correct answer)
3. C Domain
4. D Partner topic

Shortcut: System topics are created by Azure services and expose built-in event types. , Azure Blob Storage) requires no custom publisher configuration.

A service principal needs to deploy resources to a resource group but must not create role assignments. Which role should be assigned?

1. A Owner
2. ✓ B Contributor (correct answer)
3. C Reader
4. D User Access Administrator

Shortcut: Contributor grants full resource management (create, update, delete) but cannot manage access (no role assignments). This follows least-privilege — deploy permissions without access management.

What is a Container Apps revision?

1. A A container image version tag
2. ✓ B An immutable snapshot of a container app version; traffic can be split between revisions (correct answer)
3. C A deployment slot
4. D A Kubernetes pod

Shortcut: Revisions are immutable snapshots created whenever you change app configuration (image, env vars, scale rules). You can route traffic between multiple revisions.

A similarity query over 2 million rows runs as a sequential scan despite an HNSW index existing. What is the most likely cause?

1. ✓ A The query uses a different distance operator than the index operator class (correct answer)
2. B HNSW does not support large tables
3. C The table needs VACUUM FULL
4. D work_mem is too high

Shortcut: pgvector indexes are operator-class specific. Querying with <-> against an index built for cosine cannot use that index, so the planner falls back to a full scan.

Which guarantee does Event Hubs provide about event ordering?

1. A Global ordering across the event hub
2. ✓ B Ordering within a partition only (correct answer)
3. C No ordering at all
4. D Ordering per consumer group

Shortcut: Events append to a partition log in arrival order and are read in that order. Across partitions there is no ordering, so related events must share a partition key.

Which field correlates telemetry across services in a distributed trace?

1. A session_Id
2. ✓ B operation_Id (correct answer)
3. C client_IP
4. D cloud_RoleInstance

Shortcut: operation_Id is the Application Insights representation of the W3C trace id and is shared by every span in one end-to-end operation. operation_ParentId links the hierarchy.

Your deployment shows CrashLoopBackOff. Which command reveals why the previous container instance terminated?

1. A kubectl logs <pod>
2. ✓ B kubectl logs <pod> --previous (correct answer)
3. C kubectl get pod <pod> -o wide
4. D kubectl top pod <pod>

Shortcut: By the time you investigate, the failed container has been replaced. --previous returns the log stream of the last terminated instance, which contains the actual failure.

How is throughput provisioned in Cosmos DB?

1. A By VM SKU selected at account creation
2. ✓ B In Request Units per second (RU/s) (correct answer)
3. C By storage tier (Standard/Premium)
4. D By connection pool size

Shortcut: Cosmos DB throughput is measured in Request Units per second (RU/s). Each operation (read, write, query) consumes a number of RUs. You provision RU/s at the database or container level.

A message fails processing 10 times in a row. Where does Service Bus automatically move it?

1. A Back to the main queue indefinitely
2. ✓ B To the dead-letter queue (DLQ) (correct answer)
3. C It is silently deleted
4. D To an archive topic

Shortcut: Service Bus automatically moves messages to the dead-letter queue after the maximum delivery count (default 10) is exceeded. Applications can then inspect and reprocess DLQ messages.