AI-200 Practice Set 9: 47 Exam-Style Questions

Which Premium-tier feature helps isolate a noisy tenant's throughput from others?

1. ✓ A Dedicated messaging units with resource isolation (correct answer)
2. B Duplicate detection
3. C Sessions
4. D Dead-lettering

Shortcut: Premium allocates dedicated messaging units per namespace, giving predictable throughput and latency that is not affected by other tenants on shared infrastructure.

During a rolling update, users see 502 errors briefly. Which probe configuration most directly prevents traffic reaching a pod before it is ready?

1. A livenessProbe
2. ✓ B readinessProbe (correct answer)
3. C startupProbe
4. D No probe; increase replicas

Shortcut: The readiness probe controls Service endpoint membership. Until it passes, the pod receives no traffic. Liveness restarts unhealthy containers; startup guards slow initialisation.

Which maintenance operation reclaims space from dead tuples without an exclusive table lock?

1. A VACUUM FULL
2. ✓ B Autovacuum / plain VACUUM (correct answer)
3. C REINDEX
4. D CLUSTER

Shortcut: Plain VACUUM marks dead tuple space reusable while allowing concurrent reads and writes. VACUUM FULL rewrites the table and takes an ACCESS EXCLUSIVE lock.

An Azure Policy initiative is a collection of:

1. A RBAC roles
2. ✓ B Multiple policy definitions grouped for a common governance goal (correct answer)
3. C Management group configurations
4. D Conditional Access policies

Shortcut: A policy initiative (policy set definition) groups multiple policy definitions and assigns them together. , the Azure Security Benchmark initiative contains 200+ policies).

A function app uses managed identity to write to Azure Blob Storage. Which environment variable must be set in the function app settings to use managed identity with the blob trigger/bindings?

1. A AzureWebJobsStorage with connection string
2. ✓ B AzureWebJobsStorage__ with identity-based connection (serviceUri + credential) (correct answer)
3. C AZURE_CLIENT_ID
4. D WEBSITE_RUN_FROM_PACKAGE

Shortcut: net) and AzureWebJobsStorage__credential = managedidentity to avoid connection strings.

Which Kubernetes resource type is appropriate for stateful workloads like databases that require stable network identities and persistent storage?

1. A Deployment
2. B ReplicaSet
3. C DaemonSet
4. ✓ D StatefulSet (correct answer)

Shortcut: StatefulSets provide stable, unique pod names (pod-0, pod-1), stable DNS, and ordered deployment/scaling. Each pod gets its own PersistentVolumeClaim.

Which Redis command is used to check if a specific key exists and retrieve its value in a single round trip?

1. A EXISTS + GET (two commands)
2. ✓ B GET (returns nil if missing) (correct answer)
3. C GETEX
4. D MGET

Shortcut: GET returns the value if the key exists, or nil if it doesn't. This replaces the pattern of EXISTS + GET (two round trips) in a single command.

How can you retrieve a specific historical version of a secret?

1. A Versions are not retained
2. ✓ B Reference the versioned secret identifier including the version GUID (correct answer)
3. C Restore from backup
4. D Use soft delete

Shortcut: Each update creates a new version. net/secrets/name/<version> addresses a specific one; omitting the version returns the current.

Which field uniquely identifies an event for deduplication?

1. A subject
2. ✓ B id (correct answer)
3. C eventTime
4. D topic

Shortcut: The id field is unique per event from a given source. Handlers should track processed ids to remain idempotent under at-least-once delivery.

You need to trigger an ACR task on every push to a GitHub repository. Which trigger type do you configure?

1. A Base image update trigger
2. B Scheduled trigger
3. ✓ C Source code trigger (correct answer)
4. D Manual trigger

Shortcut: ).

Why is the KEYS command discouraged in production?

1. A It requires admin privileges
2. ✓ B It blocks the single-threaded server while scanning the entire keyspace (correct answer)
3. C It returns only 10 results
4. D It is deprecated

Shortcut: Redis executes commands on one thread. KEYS scans every key, stalling all other traffic. SCAN iterates incrementally with a cursor and should be used instead.

Which permission is required to create a new Key Vault and set its access policies using the Azure Management plane (ARM)?

1. A Key Vault Secrets Officer
2. B Key Vault Administrator (data plane)
3. ✓ C Contributor or Owner on the resource group (management plane) (correct answer)
4. D Key Vault Contributor (management plane)

Shortcut: Creating a Key Vault and managing its ARM properties requires Contributor or higher on the resource group/subscription. Data plane access (secrets, keys) requires separate Key Vault roles or access policies.

An application needs to send 1000 messages to Service Bus in a batch. What is the maximum allowed batch size?

1. A 64 KB total
2. ✓ B 256 KB total (Standard) or 100 MB total (Premium) per batch (correct answer)
3. C 10 messages per batch only
4. D No batch limit

Shortcut: Service Bus supports sending message batches. Total batch size must not exceed the maximum message size for the namespace (256 KB Standard, 100 MB Premium). Individual messages within the batch count toward the total.

Which statement about revision suffixes is correct?

1. ✓ A They are optional and must be unique within the app (correct answer)
2. B They are auto-generated and cannot be set
3. C They determine the traffic weight
4. D They must match the image tag

Shortcut: A revision suffix produces a readable, unique revision name such as myapp--v2. If omitted, Container Apps generates one. It has no bearing on traffic weighting.

A Cosmos DB container has 10,000 RU/s provisioned. A bulk write of 1 million documents is required. What happens if the operation exceeds the RU/s limit?

1. A Documents are silently dropped
2. ✓ B Cosmos DB throws a 429 (Too Many Requests) error; the SDK retries after the Retry-After header interval (correct answer)
3. C The container autoscales to handle the burst
4. D Writes queue indefinitely

Shortcut: Exceeding provisioned throughput results in HTTP 429 errors with a Retry-After header. The Cosmos DB SDK handles retries automatically. Use bulk operations with retries for large imports.

Which Azure Monitor capability provides Prometheus-compatible metric collection for AKS at scale?

1. ✓ A Azure Monitor managed service for Prometheus (correct answer)
2. B Application Insights profiler
3. C Activity log
4. D Change Analysis

Shortcut: Managed Prometheus scrapes cluster metrics into an Azure Monitor workspace, queried with PromQL and typically visualised through Azure Managed Grafana.

Which RBAC role lets an application send events but not read them?

1. A Azure Event Hubs Data Owner
2. ✓ B Azure Event Hubs Data Sender (correct answer)
3. C Azure Event Hubs Data Receiver
4. D Reader

Shortcut: Data Sender grants send permission only. Data Receiver grants receive; Data Owner grants both and should be avoided for application identities.

A container liveness probe fails. What action does Container Apps take?

1. A Traffic is removed from the replica
2. B The revision is deactivated
3. ✓ C The container is restarted (correct answer)
4. D An alert is triggered but nothing happens

Shortcut: Failed liveness probes cause the container to be restarted (similar to Kubernetes behaviour). Readiness probe failures remove the replica from load balancing.

What is the maximum storage size per Azure Database for PostgreSQL Flexible Server instance?

1. A 128 GB
2. B 512 GB
3. ✓ C 32 TB (correct answer)
4. D 64 TB

Shortcut: Flexible Server supports up to 32 TB of storage. Storage can be scaled up online without downtime.

An Azure Function app needs to track custom business metrics (e.g., orders processed). Which Application Insights API should be used?

1. A TrackRequest()
2. ✓ B TrackEvent() and/or TrackMetric() (correct answer)
3. C TrackException()
4. D TrackDependency()

Shortcut: , 'OrderProcessed') with custom properties. , processing_time_ms). Both appear in the customEvents / customMetrics tables.

Which TWO are true of Event Grid delivery?

1. ✓ A Delivery is at-least-once, so handlers must be idempotent (correct answer)
2. ✓ B Undeliverable events can be preserved by configuring a dead-letter container (correct answer)
3. C Events are delivered in publication order
4. D Exactly-once delivery is guaranteed
5. E Retries continue indefinitely until the handler succeeds

Shortcut: Retries can produce duplicates, so handlers should deduplicate on the event id. Dead-lettering to storage preserves events that exhaust retries. Event Grid makes no ordering promise, and retries are bounded by the event time-to-live, after which the event is dropped unless dead-lettered.

You must encrypt registry content with a key you control and rotate yourself. What is required?

1. ✓ A Premium SKU, a customer-managed key in Key Vault, and a user-assigned managed identity (correct answer)
2. B Standard SKU with Content Trust enabled
3. C Any SKU with soft delete enabled
4. D Premium SKU with geo-replication

Shortcut: Customer-managed key encryption requires Premium, a Key Vault key with soft delete and purge protection, and a user-assigned identity granted wrap/unwrap permissions. It must be configured at registry creation.

A logical partition is approaching the 20 GB storage limit. What is the correct remedy?

1. A Increase provisioned RU/s
2. ✓ B Re-model with a more granular or synthetic partition key and migrate the data (correct answer)
3. C Enable autoscale
4. D Add a read region

Shortcut: The 20 GB logical partition ceiling is fixed. The only fix is choosing a higher-cardinality key, often a synthetic composite such as tenantId-yyyyMM, and migrating into a new container.

Which Azure service acts as an Event Grid Partner topic, enabling Salesforce or Auth0 to publish events directly into Azure?

1. A Azure API Management
2. ✓ B Event Grid Partner topics (third-party SaaS events) (correct answer)
3. C Azure Logic Apps
4. D Azure Service Bus relay

Shortcut: ) to publish events directly into a customer's Azure subscription as native Event Grid events.

A team needs to audit which role assignments have been made in a subscription over the last 30 days. Where would you find this information?

1. A Azure Active Directory audit logs
2. ✓ B Azure Monitor Activity Log (category: Administrative, operation: Microsoft.Authorization/roleAssignments/write) (correct answer)
3. C Key Vault audit events
4. D Log Analytics custom tables

Shortcut: Authorization/roleAssignments/write operations. Query AzureActivity table in Log Analytics or view in the portal Activity Log.

An AKS cluster must run ML inference workloads requiring NVIDIA GPUs. Which step is required?

1. A Enable GPU flag on any node pool
2. ✓ B Use node pools with GPU VM SKUs (NC/ND/NV) and install nvidia-device-plugin DaemonSet (correct answer)
3. C GPUs are automatically detected and configured
4. D Use ACI burst for GPU workloads

Shortcut: GPU workloads require node pools using GPU VM SKUs. AKS can automatically install the NVIDIA device plugin when using a GPU node pool with the appropriate SKU.

A blob-triggered function occasionally misses new blobs on the Consumption plan. Which alternative is more reliable at scale?

1. A Increase the polling interval
2. ✓ B Use Event Grid-based blob triggers (correct answer)
3. C Add more instances
4. D Switch to a Timer trigger

Shortcut: The classic blob trigger polls and scans logs, which can delay or miss events at scale. The Event Grid blob trigger is push-based and near-instant.

Which Cosmos DB indexing mode indexes all properties by default and supports all query patterns?

1. A Lazy
2. B None
3. ✓ C Consistent (correct answer)
4. D Spatial

Shortcut: Consistent indexing mode (default) keeps the index in sync with writes and supports all query patterns. Lazy indexing is asynchronous and may miss recently inserted documents in queries.

Which control prevents accidental deletion of a production resource group regardless of RBAC?

1. ✓ A A CanNotDelete resource lock (correct answer)
2. B Reader role
3. C A tag
4. D Azure Advisor

Shortcut: Resource locks apply to all principals including Owners. CanNotDelete blocks deletion while permitting modification; ReadOnly blocks both.

Which OIDC feature must be enabled on AKS to support Workload Identity?

1. A AAD integration
2. ✓ B OIDC Issuer endpoint (--enable-oidc-issuer) (correct answer)
3. C Service Principal authentication
4. D Managed Identity endpoint

Shortcut: Workload Identity requires the OIDC issuer to be enabled on the AKS cluster (--enable-oidc-issuer). This exposes the cluster's OIDC discovery endpoint for token federation.

Which Service Bus RBAC role should be assigned to a service that only needs to receive and complete messages?

1. A Azure Service Bus Data Owner
2. B Azure Service Bus Data Sender
3. ✓ C Azure Service Bus Data Receiver (correct answer)
4. D Contributor

Shortcut: Azure Service Bus Data Receiver grants receive, peek, and complete permissions. Data Sender allows only send. Use least-privilege: assign only the role needed by the service.

Which Flexible Server capability lets you restore the database to an arbitrary moment within the retention window?

1. A Geo-redundant backup
2. ✓ B Point-in-time restore (correct answer)
3. C Read replica promotion
4. D Zone-redundant HA

Shortcut: Point-in-time restore replays write-ahead logs to a chosen timestamp within the configured backup retention period, creating a new server.

A .NET application must read 50 different secrets from Key Vault at startup. What caching strategy reduces calls?

1. A Fetch all 50 secrets on every request
2. B Use the SecretClient with built-in caching; fetch once at startup and cache in memory with TTL
3. C Store secrets in a local file at deployment
4. ✓ D Use Azure App Configuration with Key Vault references for cached reads (correct answer)

Shortcut: Azure App Configuration with Key Vault references caches resolved secrets and refreshes them on a configurable interval, reducing Key Vault call volume significantly compared to direct fetching on each request.

Which command safely removes a node from service for maintenance while respecting PodDisruptionBudgets?

1. A kubectl delete node <node>
2. ✓ B kubectl drain <node> --ignore-daemonsets (correct answer)
3. C kubectl cordon <node> only
4. D kubectl taint node <node> maintenance=true:NoSchedule

Shortcut: drain cordons the node and evicts pods through the eviction API, which honours PodDisruptionBudgets. cordon alone stops new scheduling but leaves running pods in place.

A long-running handler exceeds the lock duration and the message is redelivered. What is the correct fix?

1. A Set LockDuration to 30 minutes
2. ✓ B Periodically call RenewMessageLockAsync while processing (correct answer)
3. C Switch to receive-and-delete
4. D Disable dead-lettering

Shortcut: LockDuration is capped at 5 minutes. Renewing the lock during processing (or offloading the work and completing quickly) is the supported approach.

Azure Cache for Redis supports geo-replication. What is the primary use case for passive geo-replication in Standard/Premium?

1. A Active write in all regions
2. ✓ B Read access in a secondary region with data replicated from primary (correct answer)
3. C Real-time bidirectional sync
4. D Cross-region failover with zero data loss

Shortcut: Passive geo-replication replicates data from a primary cache to one or more secondary caches in different regions. Secondary caches are read-only; writes go to the primary.

Which logging configuration records every secret read for audit purposes?

1. ✓ A Enable AuditEvent diagnostic logs to Log Analytics (correct answer)
2. B Enable Application Insights
3. C Turn on soft delete
4. D Enable purge protection

Shortcut: The AuditEvent category captures data-plane operations including who accessed which object and when. Routing it to Log Analytics makes it queryable with KQL and alertable.

Which command lists all tags for a repository named 'myapp' in the 'myregistry' ACR instance?

1. ✓ A az acr repository show-tags --name myregistry --repository myapp (correct answer)
2. B az acr list --name myregistry
3. C docker image ls myregistry.azurecr.io/myapp
4. D az acr image list --repository myapp

Shortcut: az acr repository show-tags lists all tags in a given repository within a registry.

Which Kafka concept does Event Hubs consumer group map to?

1. A Kafka topic
2. ✓ B Kafka consumer group (correct answer)
3. C Kafka partition
4. D Kafka broker

Shortcut: Event Hubs consumer groups map directly to Kafka consumer groups. The Event Hubs Kafka endpoint is wire-compatible with Kafka, allowing Kafka applications to use Event Hubs without code changes.

Which persistence option in Azure Managed Redis provides the smallest data-loss window?

1. A RDB snapshots every 60 minutes
2. ✓ B AOF (append-only file) persistence (correct answer)
3. C No persistence
4. D Export to blob storage weekly

Shortcut: AOF logs each write operation, so recovery loses at most the last second or so. RDB snapshots lose everything written since the previous snapshot.

A team configures a Metric Alert with Dynamic Thresholds. What does this provide over static thresholds?

1. A Faster alerting
2. ✓ B ML-based threshold that adapts to metric's historical pattern, reducing false positives from seasonal variation (correct answer)
3. C Real-time alerting
4. D Multiple threshold sensitivity levels only

Shortcut: Dynamic Thresholds use machine learning to establish expected baselines from historical data. Alerts fire only when the metric deviates beyond the learned pattern, reducing noise from predictable daily/weekly cycles.

An app must pull from a private ACR. Which approach avoids storing registry credentials?

1. A Store the ACR admin password as a Container Apps secret
2. ✓ B Assign the app a managed identity with AcrPull and reference it in the registry configuration (correct answer)
3. C Make the registry public
4. D Copy the image into the environment

Shortcut: Container Apps can authenticate to ACR with a system- or user-assigned managed identity granted AcrPull, eliminating stored registry credentials.

Which Event Grid feature reduces cost when a handler only cares about 1% of a high-volume event stream?

1. A Increasing retry limits
2. ✓ B Server-side filtering on the subscription (correct answer)
3. C Batching
4. D Dead-lettering

Shortcut: Filters are applied before delivery, so unmatched events are never sent and never billed as deliveries or handler invocations.

A query uses ORDER BY embedding <-> query_vec LIMIT 10. The table has 1M rows but no vector index. What is the query behaviour?

1. A Uses B-tree index automatically
2. B Returns an error (no vector index)
3. ✓ C Performs a full sequential scan computing distance for all rows (correct answer)
4. D Uses approximate search with default parameters

Shortcut: Without a vector index, pgvector performs an exact k-NN search via full sequential scan. This provides perfect recall but is slow on large tables. Add IVFFlat or HNSW index for performance.

What distinguishes a metric alert from a log alert in terms of latency and cost?

1. A Log alerts are faster and cheaper
2. ✓ B Metric alerts evaluate pre-aggregated data with lower latency and cost; log alerts are more flexible but slower (correct answer)
3. C They are identical
4. D Metric alerts cannot use dimensions

Shortcut: Platform metrics are pre-aggregated, so metric alerts evaluate in near real time at low cost. Log alerts run queries on a schedule, adding latency and query cost in exchange for expressiveness.

DAPR pub/sub is configured with Azure Service Bus as the message broker. Which DAPR component type is this?

1. A State store
2. ✓ B Pub/sub broker (correct answer)
3. C Input binding
4. D Secret store

Shortcut: DAPR pub/sub components define the message broker. Azure Service Bus, Event Hubs, RabbitMQ, and Redis Streams are examples of supported pub/sub brokers.

Which Durable Functions storage provider is recommended for production workloads requiring high throughput and geo-redundancy?

1. A Azure Table Storage (default)
2. B Azure SQL (MSSQL provider)
3. C Azure Storage with LRS
4. ✓ D Netherite provider (Event Hubs-backed) (correct answer)

Shortcut: The Netherite storage provider uses Event Hubs for state storage, offering significantly higher throughput for Durable Functions compared to the default Azure Storage table provider.