AI-200 Practice Set 8: 47 Exam-Style Questions

Which Event Grid output binding enables an Azure Function to publish events to an Event Grid topic?

1. ✓ A EventGrid output binding (correct answer)
2. B HTTP client call inside function
3. C Service Bus output binding
4. D Storage Queue output binding

Shortcut: The Azure Functions Event Grid output binding (or EventGridPublisherClient in-process) allows functions to publish events to Event Grid topics without manual HTTP client code.

You need persistent shared storage across replicas of a Container App. What do you configure?

1. A An emptyDir volume
2. ✓ B An Azure Files storage mount defined at the environment and referenced by the app (correct answer)
3. C An Azure Disk attached to each replica
4. D Ephemeral container storage

Shortcut: Azure Files storage is defined on the environment and mounted into apps as a volume. It supports concurrent access from multiple replicas, unlike a disk.

What is the purpose of the lists parameter in a pgvector IVFFlat index?

1. A Number of index pages to cache
2. ✓ B Number of inverted file lists (clusters) created during indexing, balancing build time and query accuracy (correct answer)
3. C Maximum number of rows in the index
4. D Index compression level

Shortcut: lists determines how many clusters the IVFFlat index builds. More lists = faster queries (fewer vectors checked per list) but requires more memory. Recommended: sqrt(rows) to rows/1000.

A team uses Microsoft Defender for Cloud. Which feature provides a prioritized list of security recommendations for Azure resources?

1. ✓ A Secure Score with recommendations (correct answer)
2. B Azure Advisor
3. C Azure Security Benchmark
4. D Azure Monitor alerts

Shortcut: Defender for Cloud's Secure Score measures the security posture. The recommendations view provides prioritized, actionable security improvements with direct remediation links.

Which storage resource does the Event Processor client require for coordination?

1. A A Cosmos DB container
2. ✓ B A blob container for checkpoints and partition ownership leases (correct answer)
3. C A Service Bus queue
4. D A Redis cache

Shortcut: The processor uses blob storage to store per-partition checkpoints and ownership leases, which is how load balancing across processor instances is achieved.

Which AKS upgrade path is correct when the current version is 1.27 and you want to reach 1.29?

1. A 1.27 → 1.29 directly
2. ✓ B 1.27 → 1.28 → 1.29 (correct answer)
3. C 1.27 → 1.30 → 1.29
4. D Upgrade is not supported across minor versions

Shortcut: Kubernetes only supports upgrading one minor version at a time. 29.

With multi-region writes enabled and last-writer-wins configured, what determines the surviving document on a conflict?

1. A The document with the largest size
2. ✓ B The highest value of the configured conflict resolution path, by default _ts (correct answer)
3. C The region with the lowest latency
4. D The first write received

Shortcut: Last-writer-wins compares the conflict resolution path, which defaults to the _ts timestamp. You can nominate a custom numeric path instead, or use a stored procedure for custom resolution.

An alert fires repeatedly for the same ongoing incident. Which mechanism suppresses the noise?

1. A Deleting the alert rule
2. ✓ B An alert processing rule with suppression, or tuning the auto-mitigate and frequency settings (correct answer)
3. C Reducing retention
4. D Disabling the action group permanently

Shortcut: Alert processing rules can suppress notifications during maintenance windows or group related alerts, without removing the underlying detection.

A Service Bus message must carry binary payload (e.g., a serialized Protobuf object). How is this stored?

1. A Only string messages are supported
2. B As Base64-encoded JSON property
3. ✓ C In the message Body as a byte array (BinaryData) (correct answer)
4. D As a Base64 string in the message label

Shortcut: Service Bus message bodies are opaque byte arrays (BinaryData/Stream). Applications serialize objects (JSON, Protobuf, Avro) and write the bytes to the body. The ContentType property indicates the format.

Which ACR feature recovers a tag or manifest after accidental deletion?

1. A Geo-replication
2. B Retention policy
3. ✓ C Soft delete (correct answer)
4. D Content Trust

Shortcut: Soft delete (Premium) moves deleted tags/manifests to a recycle bin for a configurable retention period before permanent deletion.

A session store uses Redis. Each session should expire 30 minutes after the last user activity. Which TTL approach implements this?

1. A Set TTL once at creation
2. ✓ B Use EXPIRE key 1800 on every read/write to reset the idle timeout (correct answer)
3. C Use a sorted set with timestamps
4. D Use keyspace notifications to detect access

Shortcut: Resetting the TTL (EXPIRE key 1800) on every access implements a sliding expiration. If no activity occurs for 30 minutes, the key naturally expires and the session ends.

What does the Key Vault enable-purge-protection setting prevent?

1. A Secret versioning
2. ✓ B Permanent deletion of the vault or its objects during the soft-delete retention period, by anyone including admins (correct answer)
3. C Network access from the internet
4. D Vault replication

Shortcut: Purge protection prevents soft-deleted objects (and the vault itself) from being permanently purged before the retention period expires. This is mandatory for regulatory compliance scenarios.

Which trigger should be used when an HTTP endpoint must respond immediately but the work takes minutes?

1. A A synchronous HTTP trigger doing all the work
2. ✓ B An HTTP trigger that starts a Durable orchestration and returns a 202 with a status URL (correct answer)
3. C A Timer trigger
4. D A Blob trigger

Shortcut: The async HTTP API pattern returns 202 Accepted with statusQueryGetUri immediately, letting the client poll while the orchestration runs in the background.

Which command produces the immutable reference you should pin in a production manifest?

1. A az acr repository show-tags
2. ✓ B az acr repository show-manifests --query '[].digest' (correct answer)
3. C az acr build --image myapp:latest
4. D az acr login

Shortcut: show-manifests returns the sha256 digest for each manifest. Referencing myapp@sha256:<digest> guarantees the exact image bits, immune to tag reassignment.

A pgvector query over 2 million rows is slow. Which TWO changes are appropriate?

1. ✓ A Create an HNSW index on the embedding column (correct answer)
2. ✓ B Ensure the query's distance operator matches the index's operator class (correct answer)
3. C Raise work_mem to 8 GB
4. D Drop the primary key
5. E Convert the embedding column to text

Shortcut: HNSW gives high recall with fast lookups at scale. Crucially, the index is only used when the query operator matches the operator class it was built with — an index built for cosine distance is ignored by an L2 query, which silently falls back to a sequential scan.

Which endpoint does a managed identity use to obtain a token from inside an Azure resource?

1. A login.microsoftonline.com directly with a secret
2. ✓ B The Instance Metadata Service / IDENTITY_ENDPOINT local endpoint (correct answer)
3. C An on-premises STS
4. D graph.microsoft.com

Shortcut: The platform exposes a local token endpoint reachable only from within the resource. The SDK calls it, and Azure attests the identity without any client secret.

What is the purpose of the host.json file in Azure Functions?

1. A Defines connection strings
2. ✓ B Global configuration for the Functions runtime (logging, retry, concurrency, trigger behaviour) (correct answer)
3. C Lists installed NuGet packages
4. D Contains deployment configuration

Shortcut: , Service Bus maxConcurrentCalls, batch size).

An app runs an HTTP service and must scale based on the number of concurrent requests. Which scaling metric should you use?

1. A CPU utilization
2. B Memory pressure
3. ✓ C HTTP concurrent requests per replica (correct answer)
4. D Custom KEDA queue length

Shortcut: Container Apps natively supports HTTP scaling based on concurrent requests per replica. Set the rule to maintain a target number of requests per replica and it scales up/down accordingly.

What does 'EXPLAIN ANALYZE' reveal that 'EXPLAIN' alone does not?

1. A The estimated row count
2. ✓ B Actual execution times and row counts from really running the query (correct answer)
3. C The index definitions
4. D The lock modes taken

Shortcut: EXPLAIN shows the planner's estimates; EXPLAIN ANALYZE executes the statement and reports real timings and row counts, exposing bad estimates and missing indexes.

What does Application Insights Profiler do?

1. A Profiles Kusto query execution plans
2. ✓ B Captures CPU flame graphs of live application code execution, identifying performance hotspots (correct answer)
3. C Monitors database query performance
4. D Provides security vulnerability scanning

Shortcut: Application Insights Profiler (Diagnostic Profiler) periodically captures CPU sampling traces of live code execution. The output is a flame graph showing which code paths consume the most CPU time.

Which receive mode risks message loss if the consumer crashes mid-processing?

1. A Peek-lock
2. ✓ B Receive-and-delete (correct answer)
3. C Session receive
4. D Transactional receive

Shortcut: Receive-and-delete removes the message as soon as it is delivered. A crash before processing completes loses it permanently, so it suits only tolerant, high-throughput scenarios.

You want Prometheus-style scraping of AKS workloads without running your own Prometheus server. Which Azure service do you enable?

1. ✓ A Azure Monitor managed service for Prometheus (correct answer)
2. B Log Analytics agent only
3. C Application Insights profiler
4. D Azure Advisor

Shortcut: Azure Monitor managed Prometheus scrapes cluster and pod metrics into a managed workspace, queryable with PromQL and visualised in Azure Managed Grafana, with no server to operate.

What does a Request Unit (RU) represent in Cosmos DB?

1. A CPU seconds consumed
2. ✓ B A normalized unit of compute cost for a database operation (e.g., 1 RU = 1 KB document read) (correct answer)
3. C Network bandwidth in MB
4. D Memory allocation in MB

Shortcut: 1 RU is the cost of reading a 1 KB document. Writes, queries, and stored procedure calls consume varying RUs based on complexity, document size, and indexing.

A webhook endpoint returns 429 (Too Many Requests) for Event Grid event delivery. How does Event Grid respond?

1. A Drops the event immediately
2. ✓ B Treats 429 as a retry-able error and uses exponential backoff (correct answer)
3. C Routes the event to DLQ immediately
4. D Cancels the subscription

Shortcut: Event Grid treats 4xx errors (except 400, 413) and 5xx errors as delivery failures requiring retry. 429 triggers retry with exponential backoff, respecting the Retry-After header if present.

Which Azure service is better suited than Key Vault for non-secret application configuration and feature flags?

1. ✓ A Azure App Configuration (correct answer)
2. B Azure Storage
3. C Azure Monitor
4. D Azure Policy

Shortcut: App Configuration is designed for configuration data and feature flags with labels, snapshots, and change notification. Key Vault is optimised for secrets and is more expensive per read.

Which AKS feature enables Istio as a managed add-on, removing the need to install and manage the Istio control plane manually?

1. A Open Service Mesh (OSM)
2. ✓ B Istio-based service mesh add-on (correct answer)
3. C Linkerd add-on
4. D Consul connect

Shortcut: AKS offers the Istio-based service mesh as a managed add-on (az aks mesh enable), handling upgrades and configuration of the Istio control plane.

An Event Grid subscription must not overwhelm a downstream API limited to 10 requests per second. What is the appropriate design?

1. A Deliver directly and rely on retries
2. ✓ B Deliver into a Service Bus queue and have a rate-limited consumer drain it (correct answer)
3. C Reduce the event TTL
4. D Use more subscriptions

Shortcut: Event Grid has no built-in throttling toward the destination. Buffering into a queue decouples the burst-prone event source from the rate-limited consumer.

Which Redis feature provides an append-only, replayable event log with consumer groups?

1. A Pub/Sub
2. ✓ B Streams (XADD / XREADGROUP) (correct answer)
3. C Lists
4. D Keyspace notifications

Shortcut: Streams persist entries and support consumer groups with acknowledgement and pending-entry tracking. Pub/Sub is fire-and-forget with no persistence or redelivery.

What does a service principal represent in Azure AD (Entra ID)?

1. A A physical device identity
2. ✓ B A local application instance identity in a tenant (the 'agent' of an application registration) (correct answer)
3. C A user account for automated tasks
4. D A managed identity for Azure services

Shortcut: A service principal is the tenant-specific identity for an application or managed identity. The application registration defines the app globally; the service principal is the local instance in the tenant with permissions and consents.

What is the Azure CNI Overlay mode advantage over standard Azure CNI?

1. ✓ A Uses less VNet IP addresses by assigning pod IPs from an overlay network (correct answer)
2. B Supports ReadWriteMany storage
3. C Enables faster node provisioning
4. D Supports larger VM SKUs

Shortcut: Azure CNI Overlay assigns pod IPs from a private overlay network (not the VNet address space), drastically reducing VNet IP consumption while retaining Azure CNI advantages.

What is the default event retention period in Event Hubs Standard tier?

1. A 1 hour
2. B 1 day
3. ✓ C 7 days (correct answer)
4. D 90 days

Shortcut: Event Hubs Standard supports 1–7 days of event retention. Premium supports up to 90 days. Dedicated supports up to 90 days.

Which Flexible Server major version upgrade approach is supported by Azure?

1. A In-place upgrade using pg_upgrade automatically
2. ✓ B In-place major version upgrade via Azure portal/CLI (no data movement) (correct answer)
3. C Export/import only
4. D Only via read replica promotion

Shortcut: , v14 → v16) with minimal downtime. The process uses pg_upgrade internally.

An application uses the Azure Key Vault client library. Which method retrieves the latest version of a secret by name?

1. A GetSecretAsync(secretName, version)
2. ✓ B GetSecretAsync(secretName) — no version parameter returns latest (correct answer)
3. C ListPropertiesOfSecretVersionsAsync(secretName)[0]
4. D GetLatestSecretAsync(secretName)

Shortcut: GetSecretAsync(secretName) without a version parameter returns the latest enabled version of the secret. Specifying a version returns that specific version.

A revision fails to start and the app shows no logs in Log Analytics. Which diagnostic surface should you check first?

1. ✓ A The revision's system logs and the container's provisioning state (correct answer)
2. B Application Insights live metrics
3. C The environment's NSG flow logs
4. D Azure Advisor

Shortcut: System logs record image pull failures, probe failures, and startup errors that occur before application logging begins. The revision's provisioning state names the failure reason.

Which scenario favours Event Hubs over Service Bus?

1. A Ordered transactional order processing with dead-lettering
2. ✓ B High-volume telemetry ingestion with replay and multiple independent consumers (correct answer)
3. C Request/reply messaging
4. D Scheduled message delivery

Shortcut: Event Hubs is built for millions of events per second with retention and replay. Service Bus suits lower-volume messaging needing transactions, sessions, and dead-lettering.

Which Cosmos DB API provides wire compatibility with Apache Cassandra, allowing migration without code changes?

1. A Cosmos DB for NoSQL
2. B Cosmos DB for MongoDB
3. ✓ C Cosmos DB for Cassandra (correct answer)
4. D Cosmos DB for Gremlin

Shortcut: Cosmos DB for Cassandra provides CQL wire protocol compatibility, allowing existing Cassandra applications to connect and work with minimal or no code changes.

Which table stores custom measurements emitted by application code via TrackMetric?

1. A performanceCounters
2. ✓ B customMetrics (correct answer)
3. C traces
4. D customEvents

Shortcut: customMetrics holds application-defined numeric measurements. customEvents holds named business events; performanceCounters holds host-level counters.

What is the purpose of ACR scoped tokens?

1. A To enable geo-replication across registries
2. ✓ B To grant repository-level access without registry-wide permissions (correct answer)
3. C To schedule automated build tasks
4. D To configure webhook notifications

Shortcut: , pull from myapp/*, push to myapp/backend) without granting full AcrPull or AcrPush registry-wide.

What does the Service Bus message TimeToLive (TTL) property control?

1. A Time the message stays locked
2. ✓ B Time before an unprocessed message expires and moves to DLQ (if DL on expiry is enabled) (correct answer)
3. C Maximum processing time allowed
4. D Lock renewal interval

Shortcut: TTL controls how long a message stays in the queue. After TTL, the message is expired and (if dead-lettering on expiry is enabled) moved to the DLQ.

Which SDK connectivity mode generally gives the lowest latency for a .NET application in the same region?

1. A Gateway mode over HTTPS
2. ✓ B Direct mode over TCP (correct answer)
3. C REST API calls
4. D ODBC

Shortcut: Direct mode connects straight to the replica nodes over TCP, avoiding the gateway hop. Gateway mode is simpler through restrictive firewalls but adds latency.

Which Azure Monitor feature detects anomalous user behaviour patterns and potential security threats in application logs?

1. A Smart Detection
2. ✓ B Microsoft Sentinel (SIEM) (correct answer)
3. C Failure Anomalies detector
4. D Log Analytics security solution

Shortcut: Microsoft Sentinel is Azure's SIEM/SOAR. It ingests logs from many sources (including Log Analytics/Application Insights) and applies ML and analytics rules to detect security threats.

A developer reports 'unauthorized: authentication required' when pulling, three hours after running az acr login. What is happening?

1. A The registry firewall blocked their IP
2. ✓ B The ACR access token has expired and they must re-authenticate (correct answer)
3. C Content Trust rejected the image
4. D The repository was deleted

Shortcut: Tokens issued by az acr login are valid for roughly three hours. For long-running automation, use a service principal or managed identity instead of an interactive login.

Which statement about Durable Entities is correct?

1. A They are stateless
2. ✓ B They encapsulate addressable, durable state that can be signalled and read (correct answer)
3. C They only work with HTTP triggers
4. D They replace activity functions

Shortcut: Durable Entities are addressable objects with persisted state, supporting operations signalled by orchestrators or clients. They suit counters, aggregates, and per-device state.

An application uses Azure AD tokens to authenticate to Flexible Server. What must be configured on the server?

1. A Enable password authentication only
2. ✓ B Enable Microsoft Entra authentication and assign the client identity a PostgreSQL role (correct answer)
3. C Configure SSL certificates
4. D Enable Public Key Infrastructure (PKI)

Shortcut: Enable Entra authentication in Flexible Server settings. Create a PostgreSQL role matching the managed identity or service principal, then grant it the appropriate database permissions.

A role assignment was removed but the application still succeeds. What explains this?

1. A RBAC never revokes
2. ✓ B The previously issued access token remains valid until it expires (correct answer)
3. C The role was reassigned automatically
4. D Deny assignments apply

Shortcut: Tokens are bearer credentials valid until expiry, typically up to an hour. Revocation takes effect on the next token acquisition, which is why continuous access evaluation exists for some scenarios.

Which Container Apps environment type is required to integrate with an existing Azure Virtual Network?

1. A Consumption-only environment
2. B Workload profile environment
3. ✓ C Both support VNet integration (correct answer)
4. D Neither; VNet is not supported

Shortcut: Both Consumption-only and Workload profile environments support VNet integration. With VNet integration, you can route traffic to internal resources and expose apps on internal-only endpoints.

What is the maximum event size for a single Event Grid event?

1. ✓ A 64 KB (correct answer)
2. B 1 MB
3. C 256 KB
4. D 512 KB

Shortcut: Individual Event Grid events are limited to 64 KB. , Blob Storage) and include a reference URL in the event payload (claim-check pattern).