AI-200 Practice Set 2: 48 Exam-Style Questions

A function suffers unacceptable cold-start latency and needs VNet integration. Which plan is appropriate?

1. A Consumption
2. ✓ B Premium (Elastic Premium) (correct answer)
3. C Dedicated with Always On off
4. D Any plan

Shortcut: Premium provides pre-warmed instances that eliminate cold starts, plus VNet integration and unbounded execution duration, while still scaling elastically.

An application needs to scale from 2 to 50 pod replicas based on CPU utilization. Which Kubernetes resource should you configure?

1. A Cluster Autoscaler
2. ✓ B Horizontal Pod Autoscaler (HPA) (correct answer)
3. C Vertical Pod Autoscaler (VPA)
4. D DaemonSet

Shortcut: HPA scales pod replicas horizontally based on observed metrics (CPU, memory, custom metrics). VPA adjusts resource requests/limits on existing pods.

What is the correct FT.SEARCH syntax for the 5 nearest neighbours of a query vector?

1. ✓ A '*=>[KNN 5 @vec $BLOB AS score]' with PARAMS BLOB <bytes> and DIALECT 2 (correct answer)
2. B '@vec:[5]'
3. C 'KNN 5 vec'
4. D 'FT.KNN idx 5'

Shortcut: KNN queries use the =>[KNN k @field $param] syntax, require the vector passed as a binary parameter via PARAMS, and need DIALECT 2 or higher.

Which Key Vault permission model provides fine-grained access control using Azure RBAC roles instead of vault-level access policies?

1. A Vault access policies
2. ✓ B Azure RBAC (Key Vault Secrets User, Key Vault Reader, etc.) (correct answer)
3. C SAS token access
4. D Shared access signature

Shortcut: RBAC permission model enables precise role assignments at resource, vault, or individual secret/key/certificate level. Recommended over vault access policies for better auditability and least-privilege.

An Azure Function must maintain a persistent TCP connection to Service Bus with guaranteed scale-out and no cold starts. Which hosting plan should you use?

1. A Consumption
2. ✓ B Premium (Elastic Premium) (correct answer)
3. C Dedicated (Basic tier)
4. D Container Apps Consumption

Shortcut: Premium Plan (EP1/EP2/EP3) provides pre-warmed instances (no cold start), VNet integration, unlimited execution duration, and persistent connections, while still scaling elastically.

Which AKS network plugin assigns each pod a real VNet IP address from a subnet, supporting advanced network policies?

1. A kubenet
2. ✓ B Azure CNI (correct answer)
3. C Azure CNI Overlay
4. D Flannel

Shortcut: Azure CNI allocates VNet IPs directly to pods. This enables pods to be routable within the VNet, required for features like AKS network policies and some load balancer configurations. It consumes more IPs than kubenet.

What is the pgvector index type that offers better recall at query time compared to IVFFlat, at the cost of longer build time?

1. A B-tree
2. B GIN
3. C IVFFlat
4. ✓ D HNSW (correct answer)

Shortcut: HNSW (Hierarchical Navigable Small World) provides better recall and faster query performance than IVFFlat at the cost of more memory and longer index build time.

Two virtual machines must share one identity and its role assignments. Which approach fits?

1. A System-assigned identity on each VM
2. ✓ B A single user-assigned managed identity attached to both (correct answer)
3. C A shared service principal secret
4. D A shared user account

Shortcut: User-assigned identities can be attached to multiple resources, so the role assignments are configured once and reused, which also simplifies pre-provisioning permissions.

Which guarantee requires the Sessions feature to be enabled on a queue?

1. A At-least-once delivery
2. ✓ B Ordered processing of related messages by a single consumer (correct answer)
3. C Duplicate detection
4. D Dead-lettering

Shortcut: Sessions bind all messages sharing a SessionId to one consumer with an exclusive lock, providing FIFO ordering within that session. Without sessions, concurrent consumers break ordering.

You want 10% of traffic on a new revision and 90% on the current one. What must be configured?

1. A Revision mode Single with a deployment slot
2. ✓ B Revision mode Multiple with traffic weights on the two revisions (correct answer)
3. C Two separate Container Apps behind Front Door
4. D An ingress annotation

Shortcut: Traffic splitting requires revision mode Multiple so both revisions stay active. Weights are then assigned per revision name or label in the ingress traffic block.

What is the difference between provisioned throughput and serverless in Cosmos DB?

1. A Provisioned supports multiple APIs; serverless only supports NoSQL
2. ✓ B Provisioned reserves RU/s continuously; serverless charges per-RU consumed with no reserved capacity (correct answer)
3. C Serverless is cheaper for all workloads
4. D Provisioned is single-region only

Shortcut: Provisioned throughput (manual or autoscale) reserves a set RU/s continuously. Serverless billing is purely per-RU consumed with no minimum, ideal for development and sporadic workloads.

What is the difference between Azure Monitor Metrics and Logs?

1. A Metrics are more detailed than Logs
2. ✓ B Metrics are numeric time-series data (numeric measurements); Logs are structured records stored in Log Analytics (correct answer)
3. C Logs are always real-time; Metrics are delayed 24 hours
4. D They are identical

Shortcut: , CPU%, request count) with 93-day retention in the metrics database. Logs are structured records in Log Analytics, queryable with KQL, with configurable retention.

Which Event Grid handler type allows serverless HTTP-triggered processing of events?

1. A Service Bus Queue
2. B Azure Storage Queue
3. ✓ C Azure Functions (correct answer)
4. D Event Hubs

Shortcut: Azure Functions with an Event Grid trigger is the most common serverless event handler pattern, enabling code to execute in response to events with no infrastructure management.

Which command imports an image from Docker Hub into ACR without requiring a local Docker daemon?

1. A az acr build
2. ✓ B az acr import (correct answer)
3. C docker pull && az acr push
4. D az acr run

Shortcut: az acr import transfers an image directly from a source registry to ACR server-side, with no local Docker installation needed.

A multi-tenant app filters nearly every query by tenantId. Which partition key choice minimises RU cost?

1. A /id
2. ✓ B /tenantId (correct answer)
3. C /createdDate
4. D A synthetic key of /type-/region

Shortcut: Partitioning by tenantId makes those filtered queries single-partition, which is the cheapest access pattern. /id would spread a tenant's documents across every partition, forcing fan-out.

Which feature allows recovery of a deleted secret within a retention window?

1. A Purge protection
2. ✓ B Soft delete (correct answer)
3. C Versioning
4. D Backup

Shortcut: Soft delete keeps deleted objects recoverable for the retention period. Purge protection additionally blocks permanent deletion before that period elapses.

An event delivery fails repeatedly. What is Event Grid's default behaviour?

1. A It drops the event immediately
2. ✓ B It retries with exponential backoff for up to 24 hours, then discards unless a dead-letter destination is configured (correct answer)
3. C It queues indefinitely
4. D It disables the subscription

Shortcut: Event Grid retries on a backoff schedule bounded by the event time-to-live (24 hours by default). Configuring a dead-letter storage container preserves undeliverable events.

An ACR Task must authenticate to Azure Key Vault to retrieve a build secret. What is the recommended identity configuration?

1. A Store the Key Vault credential as a task environment variable
2. ✓ B Assign a managed identity to the ACR Task and grant it Key Vault access (correct answer)
3. C Use the ACR admin account credentials
4. D Embed a service principal secret in the Dockerfile

Shortcut: ACR Tasks support system- or user-assigned managed identities. Grant that identity 'Key Vault Secrets User' and reference the secret at build time, so no credential is ever stored in the task or image.

An AI application stores document embeddings in Azure Database for PostgreSQL Flexible Server. Which SQL query finds the 5 most similar documents to a given embedding using cosine distance?

1. A SELECT * FROM docs ORDER BY embedding <-> $1 LIMIT 5
2. ✓ B SELECT * FROM docs ORDER BY embedding <=> $1 LIMIT 5 (correct answer)
3. C SELECT * FROM docs ORDER BY embedding <#> $1 LIMIT 5
4. D SELECT TOP 5 * FROM docs WHERE cosine(embedding, $1) > 0.8

Shortcut: The <=> operator in pgvector computes cosine distance. <-> is Euclidean (L2), <#> is inner product (negative dot product). ORDER BY ASC finds nearest neighbours.

What is the scope hierarchy in Azure RBAC, from broadest to narrowest?

1. A Resource → Resource Group → Subscription → Management Group
2. ✓ B Management Group → Subscription → Resource Group → Resource (correct answer)
3. C Subscription → Management Group → Resource Group → Resource
4. D Resource Group → Subscription → Resource → Management Group

Shortcut: RBAC assignments propagate down the hierarchy. A role assigned at Management Group scope applies to all subscriptions, resource groups, and resources beneath it.

Which Event Hubs feature allows multiple independent consumers to each read the full event stream from the beginning?

1. A Competing consumers
2. ✓ B Consumer groups (correct answer)
3. C Partition keys
4. D Capture

Shortcut: Consumer groups provide an independent view of the event stream. Multiple consumer groups can each read all events from all partitions at their own pace, offset, and starting position.

An app needs to receive traffic from the public internet. Which ingress type should you configure?

1. A Internal
2. ✓ B External (correct answer)
3. C TCP
4. D None

Shortcut: External ingress exposes the app on a public FQDN accessible from the internet. Internal ingress restricts access to within the Container Apps Environment's VNet.

Which HNSW build parameter most directly increases recall at the cost of longer index build time?

1. A lists
2. ✓ B m and ef_construction (correct answer)
3. C nprobe
4. D maintenance_work_mem

Shortcut: m controls graph connectivity and ef_construction the candidate list size during build. Raising both improves recall and build time. lists and nprobe belong to IVFFlat.

How do you ensure all events for a given device are processed in order?

1. A Use a single partition for the whole hub
2. ✓ B Set the partition key to the device id so those events land in the same partition (correct answer)
3. C Enable sessions
4. D Use Event Grid instead

Shortcut: Event Hubs hashes the partition key to select a partition. A stable key such as device id guarantees co-location and therefore ordering for that device.

An application needs to retrieve a Key Vault secret without storing credentials in code. Which approach is recommended?

1. A Hard-code the vault URI and secret name with SAS
2. ✓ B Use managed identity to authenticate; assign Key Vault Secrets User role (correct answer)
3. C Store credentials in environment variables
4. D Use a certificate thumbprint stored on disk

Shortcut: Managed identity (system or user-assigned) authenticates to Key Vault without credentials. Assign the identity the Key Vault Secrets User role (RBAC) or add it to the vault's access policy.

A pod is stuck in Pending. 'kubectl describe pod' shows 'Insufficient cpu'. What is the correct first action?

1. A Restart the kubelet
2. ✓ B Lower the pod's CPU request, or scale the node pool / enable the cluster autoscaler (correct answer)
3. C Delete and recreate the deployment
4. D Increase the pod's CPU limit

Shortcut: Pending with Insufficient cpu means no node can satisfy the pod's CPU request. Either the request is oversized relative to node capacity, or the cluster needs more nodes. Raising the limit makes it worse.

What is the recommended Azure Cache for Redis tier for a production application requiring 99.9% SLA with automatic failover?

1. A Basic
2. ✓ B Standard (correct answer)
3. C Premium
4. D Enterprise Flash

Shortcut: 9% SLA. Basic is single-node with no SLA. Premium adds clustering, VNet, persistence.

Which Service Bus tier supports message sizes up to 100 MB and advanced features like geo-disaster recovery?

1. A Basic
2. B Standard
3. ✓ C Premium (correct answer)
4. D Enterprise

Shortcut: Premium tier supports up to 100 MB messages (vs 256 KB for Standard), dedicated compute, VNet integration, private endpoints, and geo-disaster recovery (paired namespaces).

An outbound call to a third-party API is failing intermittently. Which table records it?

1. A requests
2. ✓ B dependencies (correct answer)
3. C traces
4. D exceptions

Shortcut: Inbound calls to your service land in requests; outbound calls your service makes land in dependencies, with target, duration, resultCode, and success.

An AKS cluster must implement network policies to restrict pod-to-pod communication. Which two network policy options are natively supported?

1. A Calico and Cilium
2. ✓ B Azure Network Policy and Calico (correct answer)
3. C Azure Network Policy and Flannel
4. D NSG and Calico

Shortcut: AKS supports Azure Network Policy (built-in, requires Azure CNI) and Calico (open-source, works with both Azure CNI and kubenet).

Semantic caching for an LLM must return a cached answer for paraphrased prompts. What is the core mechanism?

1. A Hash the prompt string and use GET
2. ✓ B Embed the prompt, KNN search cached embeddings, and return the hit if distance is below a threshold (correct answer)
3. C Store prompts in a Redis List and scan
4. D Use SETEX with a short TTL

Shortcut: Exact-match hashing misses paraphrases. Semantic caching embeds the prompt, finds the nearest cached vector, and reuses the stored response when similarity exceeds the configured threshold.

Which NCRONTAB expression runs a timer function every day at 02:30 UTC?

1. ✓ A 0 30 2 * * * (correct answer)
2. B 30 2 * * *
3. C 0 2 30 * * *
4. D * 30 2 * * *

Shortcut: Azure Functions NCRONTAB has six fields: second minute hour day month day-of-week. '0 30 2 * * *' is second 0, minute 30, hour 2, every day.

A team sets an Azure Monitor alert on CPU > 80% for 5 consecutive minutes. Which alert type is this?

1. A Log alert
2. ✓ B Metric alert (static threshold) (correct answer)
3. C Activity log alert
4. D Smart detection alert

Shortcut: Metric alerts evaluate numeric metric values against a static or dynamic threshold. They are near-real-time (evaluated every 1 minute by default). Log alerts query Log Analytics on a schedule.

What is the correct format for an ACR login server URL?

1. A myregistry.azure.com
2. ✓ B myregistry.azurecr.io (correct answer)
3. C myregistry.containers.azure.net
4. D myregistry.acr.azure.io

Shortcut: io.

A team needs Cosmos DB to automatically scale throughput between 400 and 4000 RU/s based on load. Which mode should they use?

1. A Manual provisioned throughput
2. B Serverless
3. ✓ C Autoscale provisioned throughput (correct answer)
4. D Shared database throughput

Shortcut: , 400–4000 RU/s). You pay only for the peak RU/s reached per hour.

An application publishes custom business events. Which Event Grid topic type should you create?

1. A System topic
2. ✓ B Custom topic (correct answer)
3. C Partner topic
4. D Domain topic

Shortcut: Custom topics accept events from any publisher via the topic endpoint URL and access key. 0 schema.

A role is assigned Reader at the subscription and Contributor at the resource group. What are the effective permissions on a resource in that group?

1. A Reader only
2. ✓ B Contributor, because RBAC allow permissions are additive and inherited (correct answer)
3. C Access denied
4. D Owner

Shortcut: Azure RBAC allow assignments accumulate across inherited scopes. The union grants Contributor on resources within that group, while Reader still applies elsewhere in the subscription.

Which statement about a Container Apps environment is correct?

1. ✓ A It is a shared boundary providing the VNet and Log Analytics workspace for its apps (correct answer)
2. B Each app inside gets an isolated VNet
3. C It is a managed Kubernetes cluster you can access with kubectl
4. D It supports only one container app

Shortcut: The environment is the security and networking boundary. Apps within it share the VNet and Log Analytics workspace and can address each other by app name over the internal network.

How do you enable the pgvector extension in Azure Database for PostgreSQL Flexible Server?

1. A It is enabled by default
2. ✓ B CREATE EXTENSION vector; (correct answer)
3. C Install via apt-get on the server
4. D Enable in Azure portal under Extensions blade

Shortcut: Run CREATE EXTENSION vector; as a superuser in the target database. On Azure Database for PostgreSQL Flexible Server, this is supported natively without server-level changes.

Which feature prevents the same logical message being processed twice when a publisher retries?

1. A Sessions
2. ✓ B Duplicate detection using MessageId within a time window (correct answer)
3. C Dead-lettering
4. D Auto-forwarding

Shortcut: With RequiresDuplicateDetection enabled, the broker discards any message whose MessageId it has already seen inside the configured detection window.

What is a managed identity in Azure?

1. A A service account with a username and password stored in Azure AD
2. ✓ B An Azure AD identity automatically managed by Azure for use by Azure services, with no credential management required (correct answer)
3. C A shared access signature token
4. D A certificate-based identity

Shortcut: Managed identities are automatically created and managed by Azure. They provide an identity for Azure resources (VMs, Function Apps, AKS) to authenticate to Azure services without stored credentials.

A Container App is receiving no HTTP traffic. To eliminate idle costs, how should you configure minimum replicas?

1. A Set min replicas to 1
2. ✓ B Set min replicas to 0 (scale to zero) (correct answer)
3. C Use spot VMs
4. D Set max replicas to 0

Shortcut: Setting minReplicas: 0 allows the app to scale to zero when idle. This eliminates compute costs during periods of no traffic (Consumption plan).

Which TWO are required before running a vector search query in Cosmos DB for NoSQL?

1. ✓ A Enable the vector search capability on the account (correct answer)
2. ✓ B Declare a vector index and the vector embedding policy on the container (correct answer)
3. C Set consistency to strong
4. D Enable multi-region writes
5. E Disable the change feed

Shortcut: The account-level capability must be enabled, and the container needs both an embedding policy (path, data type, dimensions, distance function) and a matching vector index. Consistency, write regions, and the change feed are unrelated to vector query support.

What is the maximum execution timeout for a Consumption plan Azure Function?

1. A 1 minute
2. B 5 minutes
3. ✓ C 10 minutes (correct answer)
4. D Unlimited

Shortcut: Consumption Plan functions have a maximum execution timeout of 10 minutes (default 5 minutes, configurable up to 10). Premium and Dedicated plans support unlimited execution duration.

What does enabling purge protection prevent?

1. A Reading secrets
2. ✓ B Permanently purging a soft-deleted vault or object before the retention period expires (correct answer)
3. C Creating new secrets
4. D Rotating keys

Shortcut: Purge protection makes soft-deleted objects irreversibly retained until the window elapses, defeating an attacker who deletes then purges to destroy evidence or data.

Your registry is Premium with public network access disabled. An AKS cluster in a peered VNet cannot pull images. What is the most likely missing piece?

1. A The registry needs geo-replication enabled
2. ✓ B A private endpoint plus a private DNS zone linked to the AKS VNet (correct answer)
3. C The AcrPush role on the kubelet identity
4. D Content Trust must be disabled

Shortcut: With public access off, pulls must traverse a private endpoint. io private DNS zone linked, otherwise the login server still resolves to the public IP and the pull fails.

Your workload experiences 429 responses during traffic spikes but average RU consumption is low. Which change addresses this most directly?

1. A Switch to Strong consistency
2. ✓ B Enable autoscale throughput on the container (correct answer)
3. C Add a composite index
4. D Increase the TTL

Shortcut: Autoscale raises provisioned RU/s up to 10x the baseline automatically during bursts and scales back down, which suits spiky traffic far better than fixed provisioning.

Which delivery guarantee does Event Grid provide?

1. A Exactly-once
2. ✓ B At-least-once, so handlers must be idempotent (correct answer)
3. C At-most-once
4. D Ordered delivery

Shortcut: Retries can produce duplicate deliveries, and ordering is not guaranteed. Handlers should deduplicate on the event id and be safe to run more than once.