Practice set 6 of 16 · AI-200 Exam Preparation
This set features 48 realistic scenario questions covering Cosmos DB, AKS, Container Apps, aligned directly with the official Microsoft Azure AI Cloud Developer Associate (AI-200) syllabus.
Set 6 focuses on resilient AI data ingestion pipelines: Domain 1 (25%), Domain 2 (25%), Domain 3 (27%), and Domain 4 (23%).
An Azure Function using the Cosmos DB trigger receives a batch of changed documents. How many function invocations occur per batch?
Shortcut: The Cosmos DB trigger passes a batch of changed documents (IReadOnlyList<Document>) to a single function invocation. maxItemsPerInvocation controls the maximum batch size.
An AKS cluster must access Azure Key Vault secrets from pods without storing credentials. Which solution should you use?
Shortcut: The Secrets Store CSI Driver with the Azure Key Vault Provider mounts secrets, keys, and certificates from Key Vault as files in pods, using workload identity or managed identity.
An application is deployed on AKS and needs to call Azure Blob Storage. No credentials should be stored in the cluster. Which approach is recommended?
Shortcut: Workload Identity federates the pod's Kubernetes service account with an Azure managed identity via OIDC. The managed identity gets the required Storage RBAC role, eliminating all stored credentials.
Which extension must be allow-listed on the server parameter before CREATE EXTENSION vector will succeed?
Shortcut: Flexible Server restricts extensions. extensions server parameter before it can be created in a database.
A dead-letter destination is configured but no events appear in it after failures. What is a common cause?
Shortcut: Dead-lettering requires the Event Grid managed identity (or the configured identity) to have Storage Blob Data Contributor on the destination container; otherwise the write silently fails.
Which ACR SKU is required for private endpoint support?
Shortcut: Private endpoints (Private Link) require the Premium SKU in ACR.
How do you eliminate public network access to a vault while still allowing an AKS workload to reach it?
Shortcut: A private endpoint gives the vault a private IP. net for clients to use it rather than the public endpoint.
A Service Bus namespace requires all connections to use private endpoints only. Which SKU is required?
Shortcut: Private endpoint support requires Premium tier. With Premium, you can disable public network access and allow only VNet/private endpoint connections.
Which scale rule type should you use for an app receiving bursty HTTP traffic that must cap at 20 replicas?
Shortcut: The built-in HTTP rule scales on concurrent requests per replica, which tracks bursty traffic far more responsively than CPU. maxReplicas enforces the ceiling.
How do you implement envelope encryption for a database column using Key Vault?
Shortcut: Envelope encryption: generate a DEK locally, encrypt the DEK with a Key Vault key (KEK), store encrypted DEK. For encryption, decrypt DEK using Key Vault, then use DEK locally. Minimizes Key Vault calls.
An application needs to publish messages and have multiple consumer groups receive them independently without losing messages. Which Redis structure supports this?
Shortcut: Redis Streams support persistent, ordered, consumer-group-based messaging similar to Kafka. Unlike Pub/Sub (ephemeral), Streams persist messages and support multiple independent consumer groups.
A consumer is throttled and lagging. Metrics show high incoming bytes and throttled requests. What is the correct first remedy?
Shortcut: Throttling means the ingress/egress allowance of the provisioned throughput units is exhausted. Adding consumer groups does not add capacity; more TUs do.
Which Container Apps job type runs on a cron schedule?
Shortcut: , every night at midnight for database backups). Manual jobs run on demand; event-driven jobs trigger on KEDA scalers.
What must be configured to send Azure resource platform logs into Log Analytics?
Shortcut: Diagnostic settings route resource logs and metrics to a Log Analytics workspace, storage account, or Event Hub. Without one, resource logs are not retained.
A team publishes events to an Event Grid custom topic using a managed identity. Which authentication approach is used?
Shortcut: Event Grid custom topics support AAD token authentication using managed identity. Grant the identity the EventGrid Data Sender role on the topic for least-privilege access.
An image built for linux/amd64 fails to run on an ARM-based Container App. What is the correct fix in ACR Tasks?
Shortcut: Architecture is baked into the image. ACR Tasks can build per-platform images and combine them into a manifest list, so a single tag resolves to the right architecture at pull time.
A Log Analytics workspace retains data for 30 days by default. What is the maximum configurable retention for a workspace?
Shortcut: Log Analytics supports up to 2 years of hot (interactive) retention and up to 12 years total with the archive tier (lower cost, slower query). Default is 30 days.
What does the FLAT vector index algorithm offer compared with HNSW?
Shortcut: FLAT performs a brute-force comparison, giving exact results but scaling linearly with dataset size. HNSW is approximate but far faster at scale.
What is the default maximum execution duration for a function on the Consumption plan?
Shortcut: functionTimeout defaults to 5 minutes on Consumption with a hard ceiling of 10. Longer work requires Premium or Dedicated, or decomposition via Durable Functions.
What is the purpose of a Pod Disruption Budget (PDB) in AKS?
Shortcut: PDBs prevent too many pods from being unavailable simultaneously during voluntary disruptions (upgrades, node drains). They specify minAvailable or maxUnavailable constraints.
What does deny assignment in Azure RBAC do?
Shortcut: Deny assignments take precedence over role assignments. They block specific actions on resources regardless of what roles a user has. Azure Blueprints use deny assignments to enforce protected configurations.
What happens to a message when a consumer calls Abandon() on a Service Bus message?
Shortcut: Abandon releases the lock and increments DeliveryCount. The message returns to the active queue, available for another consumer. After MaxDeliveryCount is exceeded, it goes to DLQ.
Which ingress controller option in AKS uses Azure Application Gateway as the ingress and integrates with Azure WAF?
Shortcut: AGIC is an AKS add-on that programs Azure Application Gateway from Kubernetes Ingress resources, providing native L7 load balancing with WAF capabilities.
A custom role must allow restarting VMs but nothing else. Which definition element lists the permitted operations?
Shortcut: Compute/virtualMachines/restart/action. notActions subtracts from actions; dataActions covers data-plane operations.
Which RBAC role allows an application to receive and complete messages but not send them?
Shortcut: Data Receiver grants receive and settle permissions only. Data Sender grants send only; Data Owner grants both plus management, which violates least privilege for a consumer.
A team needs to read-scale a write-heavy PostgreSQL database by routing SELECT queries to replicas. Which feature enables this?
Shortcut: Read replicas are asynchronous copies that can serve read workloads. Applications route read queries to replica endpoints, offloading the primary for writes.
Which AKS feature automatically adds nodes when pods cannot be scheduled due to resource pressure?
Shortcut: The Cluster Autoscaler watches for unschedulable pods and grows the node pool, then removes underutilised nodes. HPA scales pod replicas; KEDA scales on external event sources.
What does the Key Vault diagnostic log category 'AuditEvent' capture?
Shortcut: AuditEvent logs capture every data plane operation performed on Key Vault, including who accessed or modified a secret/key/cert, from which IP, and whether it succeeded.
An Azure Stream Analytics job reads from Event Hubs. How should the consumer authentication be configured?
Shortcut: Stream Analytics supports managed identity authentication to Event Hubs, eliminating stored SAS connection strings. Grant the Stream Analytics identity the Event Hubs Data Receiver role.
What does az acr build do that docker build does not?
Shortcut: az acr build offloads the Docker build to ACR's cloud infrastructure. No local Docker installation is required.
Which capability lets AKS pods consume Key Vault secrets as mounted files?
Shortcut: The CSI driver mounts secrets as a volume and can optionally sync them into Kubernetes Secrets, authenticating with workload identity or a user-assigned identity.
Which resource lets applications publish their own events into Event Grid?
Shortcut: A custom topic exposes an endpoint that applications post events to. System topics are emitted by Azure services; partner topics come from third-party SaaS publishers.
What is a Cosmos DB analytical store and which feature does it enable?
Shortcut: Analytical store (enabled via Azure Synapse Link) automatically syncs data to a column-oriented store, enabling analytical queries via Synapse Analytics without RU cost or impacting the transactional workload.
Two Container Apps in the same environment need service-to-service calls with mTLS and retries without embedding that logic in code. Which feature helps?
Shortcut: Enabling Dapr provides service invocation with automatic mTLS, retries, and service discovery by app id, removing that plumbing from application code.
Application Insights distributed tracing links requests across multiple microservices. Which property enables correlation?
Shortcut: Distributed tracing uses W3C TraceContext (traceparent header). Application Insights assigns Operation_Id to trace all telemetry items (requests, dependencies, exceptions) across services in a single operation.
Which Azure Functions feature allows accessing Azure Key Vault secrets in app settings without code changes?
Shortcut: ) directly in App Settings. The runtime resolves the secret automatically using the function's managed identity.
What workload profile type in Container Apps provides dedicated compute resources that are always running?
Shortcut: Dedicated workload profiles provide dedicated nodes for Container Apps workloads, unlike Consumption which is serverless and shares infrastructure.
Which instrumentation approach is recommended for new applications to remain vendor-neutral?
Shortcut: OpenTelemetry is the strategic standard. The Azure Monitor OpenTelemetry distro exports traces, metrics, and logs to Application Insights while keeping the instrumentation portable.
Which protocol does Event Hubs support that allows Kafka clients to connect without code changes?
Shortcut: Event Hubs exposes a Kafka-compatible endpoint on Standard tier and above, so existing Kafka producers and consumers can point at Event Hubs by changing configuration only.
A query with ORDER BY on two properties fails asking for a composite index. Why?
Shortcut: The default policy creates range indexes per path, which serve single-property ordering. Multi-property ORDER BY requires an explicitly defined composite index in the matching order and direction.
Which statement about ACR geo-replication is correct?
Shortcut: Geo-replication (Premium only) presents one login server. Azure Traffic Manager routes pulls to the nearest replica. Pushes go to the home region and replicate outward.
Which Azure Policy effect prevents non-compliant resources from being created?
Shortcut: Deny effect blocks the resource deployment/modification request if it doesn't comply with the policy. Audit only logs non-compliance. AuditIfNotExists audits resources missing dependent resources.
What does Event Grid's retry policy with exponential backoff mean for event delivery?
Shortcut: Event Grid uses exponential backoff for retries, increasing the interval between attempts. This prevents overwhelming a struggling endpoint. Events are retried for up to 24 hours by default.
Which partition key best fits the described read and write pattern for the product container?
Shortcut: Point reads and vector lookups are per product, and /productId has cardinality of 4 million with even distribution. /region creates three enormous partitions and a hot one; a date key makes today's partition hot for every write; a fixed value is a single logical partition capped at 20 GB.
Which TWO changes most directly reduce RU consumption for this workload?
Shortcut: Indexing a 1536-element array on every write is a large and pointless RU cost, since the vector is searched by the vector index, not the property index. With 95% of traffic hitting 2,000 products, the integrated cache serves repeats at 0 RU. Raising throughput increases cost; strong consistency doubles read RU; a second write region adds cost and conflict risk.
Search must survive the loss of a region. Which configuration meets the requirement at the lowest risk?
Shortcut: Read replicas in additional regions with automatic failover keep the storefront serving during a regional outage, while a single write region avoids write-write conflicts entirely. Zone redundancy protects against a datacentre failure, not a regional one, and backup restore is far too slow for a revenue-critical path.
Which consistency level suits the storefront's read path?
Shortcut: Session consistency gives read-your-own-writes within a session at roughly the cost of eventual, which is the right default for a catalogue where a merchandiser must see their own edit but a shopper tolerates brief staleness. Strong forbids the multi-region read replicas this design depends on.
The ingestion pipeline must react to catalogue changes without polling. Which TWO facts about the change feed apply?
Shortcut: The change feed is ordered within a logical partition, and separate lease containers let independent consumers read the whole feed at their own pace. Deletes are not emitted unless modelled as soft deletes with a TTL, and no cross-partition ordering guarantee exists.