AI-200 Practice Set 12: 47 Exam-Style Questions

Which approach lets an Azure Function trigger on a Service Bus queue without a connection string?

1. ✓ A A managed identity connection with the fully qualified namespace setting (correct answer)
2. B A SAS token in app settings
3. C A shared access key in code
4. D Anonymous access

Shortcut: The Service Bus trigger supports identity-based connections: set <Connection>__fullyQualifiedNamespace and grant the function's managed identity the Data Receiver role.

A Container Apps application needs to emit structured JSON logs readable in Log Analytics. What is the recommended approach?

1. A Write logs to a file and configure a log agent
2. ✓ B Write JSON to stdout; Container Apps routes stdout to Log Analytics automatically (correct answer)
3. C Use Serilog with a custom sink
4. D Configure a separate log forwarder container

Shortcut: Container Apps collects stdout/stderr from containers and forwards them to the associated Log Analytics workspace. Writing structured JSON to stdout enables KQL queries with | extend or | parse operators.

A Deployment's rolling update strategy has maxUnavailable: 0 and maxSurge: 1 with 3 replicas. What happens during an update?

1. A All 3 pods restart simultaneously
2. ✓ B One new pod is created before an old one is removed, repeated until complete (correct answer)
3. C 3 new pods start, then all old pods stop
4. D The update fails because maxUnavailable cannot be 0

Shortcut: maxUnavailable: 0 forbids dropping below the desired count, and maxSurge: 1 permits one extra pod. The controller therefore adds one, waits for readiness, removes one, and repeats.

An application reads far more than it writes, from three geographies. Which configuration reduces read latency at least cost?

1. A Multi-region writes in all three regions
2. ✓ B Single write region with read regions added in the other two (correct answer)
3. C Strong consistency across all regions
4. D Increase RU/s in the write region

Shortcut: Adding read regions replicates data for local reads without the cost and conflict-handling complexity of multi-region writes, which suits read-heavy workloads.

A security team requires that Event Grid only delivers events to endpoints within a virtual network. Which Event Grid feature enables this?

1. A IP firewall rules
2. ✓ B Private endpoints on Event Grid namespaces (Standard tier) (correct answer)
3. C NSG on the subscriber endpoint
4. D Azure Firewall policy

Shortcut: Event Grid namespaces (Standard tier) support private endpoints, restricting event delivery to VNet-connected endpoints. Custom topics support outbound-to-VNet delivery via private endpoint on the subscriber.

Which practice should be preferred when granting access to a team rather than individuals?

1. A Assign roles to each user directly
2. ✓ B Assign roles to an Entra ID group and manage membership (correct answer)
3. C Share one account
4. D Use a service principal for humans

Shortcut: Group-based assignment means joiners and leavers are handled by membership changes alone, reducing assignment sprawl and the risk of orphaned permissions.

Which AKS security feature uses confidential VM SKUs to protect VM memory with hardware-based TEE (Trusted Execution Environment)?

1. A Workload Identity
2. ✓ B Confidential computing node pools (DCsv3) (correct answer)
3. C Azure Defender for Containers
4. D Secure Boot with vTPM

Shortcut: AKS confidential computing node pools use DCsv3 Intel SGX VMs with hardware-encrypted memory (Trusted Execution Environment) for sensitive workloads.

An AI pipeline generates 1536-dimension embeddings. The PostgreSQL table will store 10 million rows. Which index type provides better query performance at scale?

1. A No index (exact search)
2. B IVFFlat with lists = 1000
3. ✓ C HNSW with m=16, ef_construction=64 (correct answer)
4. D B-tree on the vector column

Shortcut: HNSW provides better recall-speed trade-off than IVFFlat at large scale, especially for high-recall requirements. m=16 and ef_construction=64 are common starting parameters.

An Event Grid trigger on an Azure Function is not firing, though the subscription reports successful deliveries. Where should you look first?

1. ✓ A The function's own logs and any exceptions inside the handler (correct answer)
2. B The storage account firewall
3. C The Event Grid schema version
4. D The subscription filter

Shortcut: A successful delivery means Event Grid received a 2xx. If downstream work is not happening, the fault lies inside the function, so its invocation logs and exceptions are the place to start.

Which feature of Microsoft Entra ID (Azure AD) enables users to approve or deny pending access requests and review who has access to resources?

1. A PIM role activation
2. ✓ B Access Reviews (correct answer)
3. C Entitlement Management
4. D B2B guest access

Shortcut: Access Reviews enable periodic certification of role assignments, group memberships, and application access. Reviewers (managers, resource owners) approve or revoke access on a schedule.

Microsoft Defender for Containers integrates with ACR to scan images. When does scanning occur?

1. A Only when explicitly triggered
2. ✓ B On push and on import; also periodic re-scanning (correct answer)
3. C Only when pulled from a running AKS cluster
4. D Only on Premium SKU registries during push

Shortcut: Defender for Containers scans on push (via quarantine/webhook), on import, and periodically re-scans already-stored images for new CVEs.

Which statement about Flexible Server high availability with zone redundancy is correct?

1. A The standby serves read traffic
2. ✓ B The standby is a hot standby that is not readable and takes over on failure (correct answer)
3. C HA removes the need for backups
4. D HA requires a read replica

Shortcut: The zone-redundant standby is kept in sync and promoted automatically on failure, but it does not accept client connections. Read scale-out requires read replicas.

What is a throughput unit (TU) in Azure Event Hubs Standard tier?

1. A A measure of CPU capacity
2. ✓ B A capacity unit: 1 TU = 1 MB/s (or 1000 events/sec) ingress and 2 MB/s egress (correct answer)
3. C A pricing tier
4. D A partition count multiplier

Shortcut: One throughput unit allows ingress up to 1 MB/s or 1000 events/sec and egress up to 2 MB/s. Scale TUs to increase capacity. Premium uses Processing Units (PUs) with higher capacity per unit.

Which network control allows only a specific VNet subnet to reach the vault while keeping the public endpoint?

1. A Private endpoint
2. ✓ B A virtual network rule (service endpoint) in the vault firewall (correct answer)
3. C NSG on the vault
4. D Azure Firewall

Shortcut: KeyVault service endpoint enabled.

Which workload profile choice suits an app with sustained high CPU that must avoid noisy-neighbour effects?

1. A Consumption profile
2. ✓ B Dedicated workload profile (correct answer)
3. C Serverless GPU profile
4. D The default profile with higher maxReplicas

Shortcut: Dedicated workload profiles provide reserved compute for predictable performance and larger instance sizes. Consumption is shared and billed per use.

What is the Azure Cache for Redis Enterprise Flash tier's primary advantage over Enterprise RAM?

1. A Lower latency
2. ✓ B Lower cost for large datasets by using NVMe SSD for cold data alongside RAM for hot data (correct answer)
3. C Better persistence
4. D More shard count

Shortcut: Enterprise Flash extends memory capacity using NVMe SSDs. Hot data stays in RAM; cold data is stored on Flash. This enables large dataset sizes at significantly lower cost per GB.

Which tier provides resource isolation with a dedicated cluster for very high throughput?

1. A Basic
2. B Standard
3. ✓ C Premium or Dedicated (correct answer)
4. D All tiers

Shortcut: Premium offers resource isolation at namespace level; Dedicated provides a single-tenant cluster with the highest capacity and longest retention options.

An Azure Container Apps application needs to access Key Vault secrets securely. What is the recommended approach?

1. A Store the Key Vault access key in a Container Apps secret
2. ✓ B Use system-assigned managed identity on the Container App + Key Vault Secrets User role (correct answer)
3. C Use a service principal client secret stored in the environment variable
4. D Configure the Key Vault firewall to allow Container Apps IPs

Shortcut: Container Apps supports system-assigned managed identity. Assign it the Key Vault Secrets User role. The app authenticates to Key Vault using the identity without any stored credentials.

Which TWO statements about Container Apps revisions are correct?

1. ✓ A Multiple revisions can receive traffic simultaneously in multiple-revision mode (correct answer)
2. ✓ B Traffic can be split by percentage across revisions for canary releases (correct answer)
3. C A new revision always deletes the previous one
4. D Revisions are only available in the Dedicated plan
5. E Revision labels cannot be used to address a specific revision

Shortcut: Multiple-revision mode keeps several immutable revisions active and splits traffic by weight, which is what enables canary and blue-green releases. Revisions are not deleted automatically, are available on the Consumption plan, and labels give each revision a stable URL.

Which command pipeline reduces round-trip latency for 100 independent SET operations?

1. A Sending them individually and awaiting each reply
2. ✓ B Pipelining all 100 commands and reading replies together (correct answer)
3. C Using MULTI without EXEC
4. D Using KEYS first

Shortcut: Pipelining writes all commands to the socket before reading replies, collapsing 100 round trips into roughly one. MULTI adds transactional semantics but not the latency benefit by itself.

A team migrates an application using AMQP 1.0 protocol to Azure Service Bus. Which client protocol does Service Bus natively support?

1. A MQTT only
2. ✓ B AMQP 1.0 and HTTPS (correct answer)
3. C WebSockets only
4. D gRPC

Shortcut: 0 (primary protocol for lowest latency and highest throughput) and HTTPS (REST API, useful for firewalled environments). AMQP over WebSockets is also supported.

Which capability visualises curated, parameterised reports combining metrics, logs, and text?

1. ✓ A Workbooks (correct answer)
2. B Live Metrics
3. C Smart detection
4. D Activity log

Shortcut: Workbooks compose KQL queries, metric charts, parameters, and narrative into interactive, shareable documents, and are the standard for operational dashboards in Azure Monitor.

What is the maximum number of containers per Container Apps replica (sidecar pattern)?

1. A 1
2. B 2
3. ✓ C 10 (correct answer)
4. D No documented limit

Shortcut: Each Container Apps replica supports up to 10 containers (1 main + up to 9 sidecars), enabling patterns like DAPR sidecar, logging agents, and proxy containers.

Which tool can be used to migrate data from an on-premises MongoDB instance to Cosmos DB for MongoDB?

1. A Azure Data Factory
2. B Azure Database Migration Service (DMS)
3. C mongodump + mongorestore
4. ✓ D All of the above (correct answer)

Shortcut: Multiple tools work: ADF for pipeline-based migrations, DMS for online migration with minimal downtime, and native MongoDB tools (mongodump/mongorestore) for offline migrations.

How do you retry a failing activity function with exponential backoff in Durable Functions?

1. A Wrap the call in a try/catch loop
2. ✓ B Call it with a RetryOptions instance specifying first retry interval, backoff coefficient, and max attempts (correct answer)
3. C Configure retries in host.json only
4. D Use a Timer trigger

Shortcut: CallActivityWithRetryAsync accepts RetryOptions, and the Durable framework persists retry state so backoff survives host restarts.

What does the Application Insights dependency tracking automatically capture?

1. A Only HTTP calls configured in code
2. ✓ B SQL queries, HTTP/HTTPS calls, Azure Storage operations, Service Bus calls — without code changes (correct answer)
3. C Manual tracking only
4. D Database connection strings

Shortcut: ) including duration, success/failure, and target endpoint, without modifying application code.

A Logic App must trigger when an Azure resource group is deleted. Which Event Grid system topic or source type is appropriate?

1. A Microsoft.Storage system topic
2. ✓ B Microsoft.Resources system topic (Resource Groups) (correct answer)
3. C Microsoft.EventHub system topic
4. D Custom topic with manual publish

Shortcut: Resources is an Event Grid system topic source that fires events for Azure resource operations (create, update, delete) on subscriptions, resource groups, and management groups.

You need to copy an image between two ACR registries in different subscriptions without pulling it locally. Which command is appropriate?

1. A az acr build
2. ✓ B az acr import --source <src>.azurecr.io/app:v1 --registry <srcResourceId> (correct answer)
3. C docker tag followed by docker push
4. D az acr replication create

Shortcut: az acr import performs a server-side copy between registries, including across subscriptions and tenants when a source resource id or credentials are supplied. No local Docker daemon is used.

What does the ef_search parameter control in an HNSW vector index query?

1. A Index build thread count
2. ✓ B Number of candidates evaluated during search; higher = better recall but slower queries (correct answer)
3. C Maximum distance threshold
4. D Compression factor

Shortcut: ef_search=N controls the dynamic candidate list size during HNSW search. Higher values improve recall at the cost of query latency.

An AKS cluster uses Azure RBAC for Kubernetes. Which role grants cluster-wide admin access equivalent to cluster-admin ClusterRoleBinding?

1. A Azure Kubernetes Service Cluster User Role
2. B Azure Kubernetes Service Cluster Admin Role
3. ✓ C Azure Kubernetes Service RBAC Cluster Admin (correct answer)
4. D Owner on the AKS resource

Shortcut: Azure Kubernetes Service RBAC Cluster Admin grants ClusterRole cluster-admin equivalent access via Azure RBAC, enabling full control over all Kubernetes API objects in the cluster.

A message larger than 256 KB must be transferred. What is the standard approach on Standard tier?

1. A Split the message manually
2. ✓ B Use the claim-check pattern: store the payload in Blob Storage and send a reference (correct answer)
3. C Compress it to fit
4. D Enable partitioning

Shortcut: Standard tier caps messages at 256 KB. The claim-check pattern keeps the broker message small by carrying only a pointer to the payload in blob storage.

A team needs to run multiple isolated workload environments in one AKS cluster. Which Kubernetes feature provides namespace-level isolation?

1. A DaemonSets
2. ✓ B Namespaces with NetworkPolicy and ResourceQuota (correct answer)
3. C Node pools
4. D PodSecurityPolicy

Shortcut: Kubernetes namespaces combined with NetworkPolicy (network isolation) and ResourceQuota (CPU/memory limits) provide multi-tenant workload isolation within a cluster.

What does the RequestCharge header on a Cosmos DB response represent?

1. A Billing in currency
2. B The RU/s provisioned on the container
3. ✓ C The RUs consumed by that specific operation (correct answer)
4. D The number of documents scanned

Shortcut: RequestCharge reports the RU cost of the individual operation. Logging it is the standard way to find expensive queries and tune indexing or partitioning.

How can you audit which identity performed a privileged operation last week?

1. ✓ A Query the Azure Activity log for the operation and caller (correct answer)
2. B Check resource tags
3. C Look at Azure Advisor
4. D Inspect the resource's properties

Shortcut: The Activity log records management-plane operations with caller identity, timestamp, and outcome. Routing it to Log Analytics makes it queryable and retainable.

A team needs to run an Azure Function on a custom Docker container with specific OS dependencies. Which approach is supported?

1. A Custom containers are not supported in Azure Functions
2. ✓ B Deploy as a custom container image to a Premium or Dedicated plan function app (correct answer)
3. C Use a Consumption plan with layer caching
4. D Use Azure Container Instances trigger

Shortcut: Azure Functions supports custom Docker container images (FUNCTIONS_WORKER_RUNTIME set in image). Custom containers run on Premium or Dedicated plans. Consumption plan does not support custom containers.

Which AKS cost-optimization feature provides detailed cost breakdown by Kubernetes namespace and workload?

1. A Azure Cost Management + tags
2. ✓ B AKS Cost Analysis add-on (correct answer)
3. C Container Insights cost report
4. D Log Analytics pricing view

Shortcut: The AKS Cost Analysis add-on (az aks update --enable-cost-analysis) provides cost attribution at namespace and workload level in Azure Cost Management.

An application stores customer profiles in Cosmos DB NoSQL. Queries filter by both country (low cardinality, 50 values) and userId (high cardinality, millions). What is the best partition key?

1. A country
2. ✓ B userId (correct answer)
3. C country_userId (composite synthetic key)
4. D A random GUID

Shortcut: userId offers high cardinality ensuring even distribution. country alone creates hot partitions (only 50 partitions). A synthetic composite key is useful when queries need both fields together.

A team wants to use Key Vault to manage TLS certificates for an Azure Application Gateway. Which Key Vault object type should the certificate be stored as?

1. A Secret (PFX base64 encoded)
2. B Key (RSA)
3. ✓ C Certificate (native Key Vault cert with lifecycle management) (correct answer)
4. D Both Secret and Certificate

Shortcut: Store the certificate as a Key Vault Certificate object. Application Gateway can reference it directly via managed identity. Key Vault handles renewal; Application Gateway pulls the latest version automatically.

Which capability lets Event Grid deliver into a private endpoint-protected destination?

1. A Public delivery only
2. ✓ B Delivery with managed identity plus the trusted Azure services network exception (correct answer)
3. C SAS tokens
4. D VNet peering of the topic

Shortcut: Event Grid can authenticate with a managed identity, allowing the destination's firewall to permit trusted Azure services rather than opening it to the internet.

Which approach exposes an internal-only HTTP service to other resources in the VNet without a public IP?

1. ✓ A Service type LoadBalancer with the azure-load-balancer-internal annotation (correct answer)
2. B Service type NodePort
3. C Ingress with a public IP
4. D Service type ExternalName

Shortcut: io/azure-load-balancer-internal: "true" provisions an internal Azure Load Balancer reachable only from the VNet.

Which approach keeps embeddings synchronised when source text is updated?

1. ✓ A A trigger or application-side pipeline that recomputes the embedding on UPDATE (correct answer)
2. B A foreign key constraint
3. C A unique index on the vector column
4. D Setting the vector column to GENERATED

Shortcut: Embeddings are derived data. A trigger enqueuing a re-embed job, or explicit application logic on write, keeps the vector consistent with the text it represents.

Which practice most reduces blast radius if one application is compromised?

1. A One vault for the whole organisation
2. ✓ B Separate vaults per application and environment with scoped role assignments (correct answer)
3. C Sharing one identity across apps
4. D Disabling logging

Shortcut: Vault-per-application-per-environment means a compromised identity can reach only that vault's contents, and it simplifies both RBAC and throttling isolation.

What is the purpose of the Service Bus namespace?

1. A A single queue or topic entity
2. ✓ B A container for all Service Bus entities (queues, topics) with a shared endpoint, authentication, and network settings (correct answer)
3. C A subscription within a topic
4. D A message batch

Shortcut: A Service Bus namespace is the management container and scoping boundary. All queues, topics, and subscriptions live within a namespace. The namespace provides the FQDN endpoint.

Which az acr purge option removes manifests that are untagged and older than 7 days from the 'myapp' repository?

1. ✓ A az acr purge --filter 'myapp:.*' --ago 7d --untagged (correct answer)
2. B az acr image delete --age 7d
3. C az acr retention apply --days 7
4. D az acr purge --ago 7d

Shortcut: az acr purge with --filter, --ago, and --untagged removes untagged manifests older than the specified period from matching repositories.

A microservice communicates with others via Redis Pub/Sub. What is a key limitation of Redis Pub/Sub compared to Streams?

1. A Pub/Sub doesn't support multiple subscribers
2. ✓ B Messages are ephemeral — offline subscribers miss published messages (correct answer)
3. C Pub/Sub requires authentication
4. D Pub/Sub only supports string messages

Shortcut: Redis Pub/Sub is fire-and-forget. Messages published while a subscriber is offline are lost. Use Redis Streams for persistent, consumer-group-based reliable messaging.

A security team needs to alert when an Azure resource is deleted in a production subscription. Which alert type should they configure?

1. A Metric alert on DeleteResource metric
2. ✓ B Activity Log alert on 'Delete' operations in the resource group (correct answer)
3. C Application Insights event alert
4. D Scheduled log alert

Shortcut: Activity Log alerts trigger on Azure control plane events. *​/delete', filtered to the production resource group.

How should an Azure Function consuming Event Hubs be configured for high throughput?

1. A Set batchSize to 1
2. ✓ B Enable batching with a suitable maxBatchSize and process events in bulk (correct answer)
3. C Disable checkpointing
4. D Use a Timer trigger

Shortcut: The Event Hubs trigger can deliver arrays of events. Batch processing amortises per-invocation overhead and checkpointing, greatly increasing throughput.