Practice set 5 of 16 · AI-200 Exam Preparation
This set features 48 realistic scenario questions covering AKS, Cosmos DB, Container Registry, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 5 tests deep infrastructure orchestration across Domain 1 (Containers: 25%), Domain 2 (AI Data: 25%), Domain 3 (Serverless: 27%), and Domain 4 (Security: 23%).
Which setting automatically increases throughput units during traffic spikes on the Standard tier?
Shortcut: Auto-inflate raises throughput units up to a configured maximum as load grows. It does not scale back down automatically, so the ceiling should be set deliberately.
What does the max-surge setting control during an AKS node pool upgrade?
Shortcut: , 33%) controls how many extra nodes are added during upgrade, allowing new nodes to be provisioned and workloads migrated before old nodes are decommissioned.
How should an application authenticate to Azure Managed Redis without an access key?
Shortcut: Azure Cache/Managed Redis supports Entra ID authentication. The client acquires a token with its managed identity and uses it in the AUTH exchange, removing static keys.
Which feature streams live telemetry with roughly one-second latency and no sampling, for use during a deployment?
Shortcut: Live Metrics Stream shows request rates, failures, and performance in near real time without ingestion delay, which is why it is used to watch a release as it rolls out.
A consumer needs to inspect a Service Bus message without removing it from the queue. Which operation should it use?
Shortcut: PeekMessage (or PeekMessagesAsync) reads messages without locking or removing them. The message stays in the queue and is still available to other consumers.
Which ACR feature holds newly pushed images for security scanning before they can be pulled?
Shortcut: Quarantine policy puts images into a quarantined state after push. , Microsoft Defender) can it be pulled.
An AI application needs full-text search AND vector similarity in the same query. Which PostgreSQL feature enables hybrid search combining both?
Shortcut: Hybrid search combines pg full-text search (tsvector/tsrank) and pgvector similarity (cosine/L2) in a single query, using Reciprocal Rank Fusion (RRF) or weighted scoring to merge results.
Which RBAC role should be assigned to an application that only needs to read secrets from Key Vault?
Shortcut: Key Vault Secrets User grants Get and List operations on secrets only — least-privilege for read-only access. Key Vault Secrets Officer adds set/delete. Administrator has full control.
Which binding direction writes the function's result into Cosmos DB?
Shortcut: Output bindings write data out of the function. Input bindings fetch data in; the trigger binding is what causes the invocation.
A vulnerability scan must complete before an image becomes pullable. Which ACR feature gates this?
Shortcut: With quarantine enabled, a pushed image is invisible to normal pulls until a scanner marks it as passed. Only identities with the quarantine reader role can pull it in the interim.
An Azure Function must process every document inserted into Cosmos DB. Which trigger is most appropriate?
Shortcut: The Cosmos DB trigger uses the change feed to invoke the function on every new/updated document. It handles checkpointing and parallel processing automatically.
An application must read blobs from a storage account using its managed identity. Which role is correct?
Shortcut: Data-plane access to blob contents requires a data role. Reader and Contributor are management-plane roles that grant no ability to read blob data.
Which Durable Functions pattern runs multiple activities in parallel and waits for all to complete before continuing?
Shortcut: WhenAll (fan-in). This efficiently processes independent work items concurrently.
How do you perform a zero-downtime blue-green deployment in Container Apps?
Shortcut: In multiple revision mode, deploy the new revision with 0% traffic. After validation, shift traffic (0% old → 100% new) using traffic weights. Then deactivate the old revision.
A container stores chat history that should be removed automatically after 30 days. What is the correct configuration?
Shortcut: Setting DefaultTimeToLive on the container expires documents automatically using leftover RUs. Per-document ttl can override it. This is far cheaper than issuing explicit deletes.
An application uses OpenTelemetry. Which Azure Monitor feature ingests OTLP-format telemetry natively?
Shortcut: Azure Monitor now supports OpenTelemetry natively. The Azure Monitor OpenTelemetry Distro (or direct OTLP ingest endpoint) allows apps using OpenTelemetry SDK to send traces, metrics, and logs to Application Insights.
Which setting controls how long a consumer holds an exclusive lock before the message becomes visible again?
Shortcut: LockDuration (up to 5 minutes) is the peek-lock window. Long-running handlers should renew the lock rather than rely on a large fixed duration.
An HPA is configured on CPU but never scales up, even under load. Which prerequisite is most likely missing?
Shortcut: HPA computes utilisation as a percentage of the CPU request. Without resource requests, or without metrics-server supplying metrics, utilisation cannot be calculated and scaling never triggers.
Which authentication method is recommended for Azure Database for PostgreSQL Flexible Server in production?
Shortcut: Entra ID authentication allows Azure managed identities and service principals to authenticate without passwords. Assign the identity the right PostgreSQL role to grant access.
Which TWO settings must be enabled on a vault before its key can be used as a customer-managed key?
Shortcut: Services that encrypt data with a CMK require both, because purging the key would render the encrypted data permanently unrecoverable. Azure therefore refuses to accept a key from a vault where that is still possible.
An organization publishes events from 50 different IoT tenants, each needing isolated event subscriptions. Which Event Grid concept efficiently manages this multi-tenant scenario?
Shortcut: Event Grid Domains provide a single management endpoint with auto-created topics per domain topic name. This enables efficient multi-tenant event publishing without managing hundreds of separate topics.
An AKS cluster uses Azure Monitor Container Insights. Where are logs and metrics stored?
Shortcut: Container Insights stores stdout/stderr logs and performance metrics in a Log Analytics Workspace. You query them using KQL.
How should an application authenticate to Flexible Server without storing a password?
Shortcut: Entra ID authentication lets the app acquire an access token with its managed identity and present it as the password, removing stored credentials entirely.
Which schema should new implementations prefer for interoperability?
Shortcut: 0 is a CNCF standard supported natively by Event Grid, making producers and consumers portable across systems.
An application caches a secret in memory. What is the risk after a rotation?
Shortcut: Caching is necessary for latency and throttling reasons, but the cache must expire or respond to rotation events, otherwise the app keeps presenting a revoked credential.
Which component enables event-driven autoscaling of pods in AKS based on external event sources like Azure Service Bus queue length?
Shortcut: ), scaling pods to zero when idle.
Azure Cache for Redis Premium tier supports clustering. What does Redis clustering provide?
Shortcut: Redis clustering splits the keyspace across multiple shards (nodes), enabling horizontal scaling of both memory and throughput beyond a single instance's limits.
What does a partition in Event Hubs represent?
Shortcut: Each partition is an ordered, immutable log. Events with the same partition key go to the same partition, guaranteeing ordering for that key. Different partitions are processed independently and in parallel.
A team uses Conditional Access policies. Which action can a Conditional Access policy take?
Shortcut: Conditional Access evaluates conditions (user identity, location, device compliance, sign-in risk, application) and enforces controls (require MFA, block access, require compliant device).
What happens to in-flight HTTP requests when a revision is deactivated during a traffic shift?
Shortcut: Container Apps stops routing new requests to the deactivating revision and allows existing requests to complete within the termination grace period before the replica is removed.
Which data structure best fits a leaderboard requiring ranked retrieval by score?
Shortcut: Sorted sets maintain members ordered by score, supporting ZRANGE, ZREVRANK, and range queries in logarithmic time, which is exactly the leaderboard access pattern.
After creation, which property of an event hub generally cannot be reduced?
Shortcut: Partition count is fixed at creation for Standard tier and cannot be decreased. Premium and Dedicated allow increases, but planning for peak parallelism up front is important.
A Key Vault certificate is configured with auto-renewal. Which certificate authority types support integrated auto-renewal in Key Vault?
Shortcut: Key Vault integrates with DigiCert and GlobalSign for automated certificate renewal. Self-signed certs also auto-renew. For other CAs, use the CSR-based manual workflow.
A team needs to automatically delete container images not pulled in the last 30 days. Which ACR feature should they use?
Shortcut: az acr purge run as an ACR Task on a schedule removes untagged manifests and tags older than a specified period. The retention policy controls untagged manifests.
A Cosmos DB item must expire automatically after 24 hours. Which feature implements this?
Shortcut: TTL (Time To Live) can be set at the container level (default) or overridden per item. Cosmos DB automatically deletes expired items, consuming background RUs.
Which Service Bus feature enables a queue or topic to be replicated across two Azure regions for disaster recovery, with failover supported by metadata replication?
Shortcut: Geo-disaster recovery (alias pairing) replicates namespace metadata across paired namespaces. On failover, the alias is remapped to the secondary. Messages are NOT replicated — only the namespace entity configuration.
Which KQL operator joins request telemetry to exception telemetry on the shared operation identifier?
Shortcut: join correlates two tables on a key. Joining requests and exceptions on operation_Id attributes each failure to the request that produced it.
Your team needs to give a partner pull access to exactly one repository in a shared registry. What is the least-privilege mechanism?
Shortcut: Repository-scoped tokens grant permissions on individual repositories, which registry-level AcrPull cannot. The admin account is registry-wide and shared, so it violates least privilege.
What does enabling connection pooling with PgBouncer on Flexible Server provide?
Shortcut: , serverless functions).
How should a function authenticate to Azure Storage without a connection string?
Shortcut: Identity-based connections replace connection strings. Setting the serviceUri app setting and assigning roles such as Storage Blob Data Contributor removes the secret entirely.
Which Azure Monitor feature enables running multi-step HTTP tests with request chaining and response body validation?
Shortcut: Multi-step web tests (classic web tests or custom TrackAvailability() calls) execute sequences of HTTP requests, validating response content, headers, and status codes across multiple pages or APIs.
An app needs to access Azure Blob Storage without storing a connection string. Which feature enables this?
Shortcut: ) without storing credentials. Assign the appropriate RBAC role to the identity.
Which indexing change most reduces write RU charges on a write-heavy container where only two fields are ever filtered?
Shortcut: By default every property is indexed, and each indexed path adds write cost. Excluding unused paths (or including only the queried ones) directly lowers write RU charges.
Which event schema format does Event Grid natively support alongside its own schema for interoperability with CNCF standards?
Shortcut: 0 CNCF standard. CloudEvents enables portability across cloud providers and event systems.
Which feature provides time-bound, approval-gated elevation to a privileged role?
Shortcut: PIM makes roles eligible rather than permanently active, requiring just-in-time activation with optional MFA, approval, and justification, all of which is audited.
You need to block all ingress traffic to pods in a namespace except from pods labelled app=frontend. Which resource do you use?
Shortcut: NetworkPolicy operates on pod labels inside the cluster and requires a supporting network plugin such as Azure NPM or Calico. NSGs work at subnet level and cannot express pod-to-pod identity.
Which Cosmos DB consistency level is recommended for a user session to always see their own writes without strong consistency overhead?
Shortcut: Session consistency is the most widely used level. It guarantees monotonic reads, monotonic writes, and read-your-own-writes within a single session (client), at low latency.
A message must be delivered at a specific future time. Which capability supports this natively?
Shortcut: Service Bus supports scheduled messages that remain invisible until the specified enqueue time, and they can be cancelled by sequence number before firing.