AI-200 Practice Set 13: 47 Exam-Style Questions

What is the event delivery SLA for Azure Event Grid?

1. A 99.99% for all event types
2. B 99.99% SLA for system topics; 99.9% for custom topics
3. ✓ C 99.9% for successfully accepted events (correct answer)
4. D No SLA; best-effort delivery

Shortcut: 9% availability SLA for event delivery. For events that are accepted by Event Grid (return HTTP 200), it guarantees at-least-once delivery within the retry window.

How do you pin all traffic to the newest revision automatically after each deployment?

1. ✓ A Set revision mode Single (correct answer)
2. B Use revision mode Multiple with a 'latest' label
3. C Manually update weights each time
4. D Disable ingress

Shortcut: In Single revision mode, activating a new revision automatically deactivates the previous one and sends all traffic to the newest, which is the simplest continuous-deployment pattern.

For a session store, which combination provides automatic idle expiry?

1. ✓ A SET with EX and refreshing the TTL on each access (correct answer)
2. B PERSIST after each write
3. C LPUSH with LTRIM
4. D ZADD with the expiry as score

Shortcut: Setting a TTL and re-issuing EXPIRE on access implements a sliding idle timeout, so sessions expire only after a period of inactivity.

How do you attribute telemetry to a specific microservice in a shared Application Insights resource?

1. A client_IP
2. ✓ B cloud_RoleName (correct answer)
3. C operation_Id
4. D session_Id

Shortcut: cloud_RoleName identifies the emitting component and drives the Application Map. Setting it per service is essential when several services share one resource.

Which storage resource does the Functions runtime require for triggers, leases, and Durable state?

1. A A Cosmos DB account
2. ✓ B An Azure Storage account referenced by AzureWebJobsStorage (correct answer)
3. C A Redis cache
4. D A SQL database

Shortcut: The runtime uses the storage account for timer leases, blob trigger receipts, and Durable task hubs. Losing or misconfiguring it breaks triggering entirely.

A team needs to gradually shift 20% of traffic to a new revision for canary testing. How is this configured?

1. A DNS-based traffic splitting
2. ✓ B Revision traffic weights (20% new, 80% old) in multiple revision mode (correct answer)
3. C A/B testing via Azure Front Door
4. D Azure Traffic Manager weighted routing

Shortcut: , revision-v2: 20, revision-v1: 80). Container Apps routes the specified percentage to each revision.

A team uses pg_cron to schedule a nightly job that refreshes materialized views and re-embeds changed documents. Which extension provides cron scheduling in PostgreSQL?

1. A pg_agent
2. B pgcron
3. ✓ C pg_cron (correct answer)
4. D pg_scheduler

Shortcut: pg_cron is a cron-based job scheduler for PostgreSQL that runs scheduled SQL commands inside the database. It is supported on Azure Database for PostgreSQL Flexible Server.

Which Service Bus feature allows forwarding messages from a dead-letter queue to another queue automatically?

1. ✓ A Auto-forwarding (correct answer)
2. B DLQ subscription
3. C Rule action FORWARD
4. D Service Bus bridge

Shortcut: Auto-forwarding (ForwardTo/ForwardDeadLetteredMessagesTo properties) automatically redirects messages from one entity to another, enabling dead-letter queue processing pipelines.

Your organisation requires that only images signed by the release pipeline can be deployed to AKS. Which combination enforces this end to end?

1. A ACR Content Trust alone
2. ✓ B ACR Content Trust plus an Azure Policy or admission controller that rejects unsigned images (correct answer)
3. C Repository-scoped tokens plus quarantine
4. D Private endpoints plus RBAC

Shortcut: Content Trust handles signing and verification at the registry, but the cluster must also refuse unsigned images. An admission controller such as Azure Policy for Kubernetes or Ratify provides that enforcement at deploy time.

Which Cosmos DB vector search metric computes the angle between two vectors and is most commonly used for embedding similarity?

1. A Euclidean distance (L2)
2. B Dot product
3. ✓ C Cosine similarity (correct answer)
4. D Manhattan distance

Shortcut: Cosine similarity measures the cosine of the angle between two vectors, normalized to ignore magnitude. It is the standard metric for semantic similarity between text embeddings from models like Ada.

Which metric best signals that consumers cannot keep pace with producers?

1. ✓ A Active message count growing steadily (correct answer)
2. B Server errors
3. C Successful requests
4. D Namespace CPU

Shortcut: A continuously rising active message count means arrival rate exceeds completion rate. It is the primary scaling signal for KEDA or autoscaling rules.

An application requires the same pod to handle both incoming HTTP and TCP traffic. Which Kubernetes Service type exposes multiple ports?

1. A ClusterIP
2. B NodePort
3. ✓ C LoadBalancer (correct answer)
4. D ExternalName

Shortcut: LoadBalancer services can expose multiple ports. ports array. Each port gets its own rule on the Azure Load Balancer.

A DevOps engineer needs to read but not modify Kubernetes objects in a specific namespace of an AKS cluster using Azure RBAC. Which role is appropriate?

1. A Azure Kubernetes Service RBAC Cluster Admin
2. B Azure Kubernetes Service RBAC Admin
3. ✓ C Azure Kubernetes Service RBAC Reader (correct answer)
4. D Contributor

Shortcut: Azure Kubernetes Service RBAC Reader grants read-only access to Kubernetes objects within the assigned scope (can be limited to a specific namespace), without the ability to modify resources.

Which change most reduces the RU cost of a query that currently reports a high number of retrieved documents but returns few?

1. ✓ A Add a filter on the partition key, and index the filtered properties (correct answer)
2. B Switch to Eventual consistency
3. C Increase page size
4. D Enable TTL

Shortcut: A large gap between retrieved and output document count indicates a scan. Filtering on the partition key and ensuring filter paths are indexed converts it into a targeted index seek.

An application uses the Event Processor Host (EPH) SDK to consume events. What does EPH provide that a basic EventHubConsumerClient does not?

1. A Higher throughput
2. ✓ B Partition ownership coordination, checkpointing, and load balancing across multiple processor instances (correct answer)
3. C Support for consumer groups
4. D Avro deserialization

Shortcut: Event Processor Host (now EventProcessorClient) coordinates partition ownership across multiple instances, enabling parallel processing. It persists checkpoints so processing resumes after restarts.

What is the ACR admin account primarily used for?

1. A Production CI/CD pipelines
2. ✓ B Quick testing and development scenarios where managed identity is unavailable (correct answer)
3. C Geo-replication management
4. D Webhook configuration

Shortcut: The admin account (username/password) is disabled by default and intended only for quick dev/test. For production, use managed identity or service principals.

How should you configure Azure Cache for Redis to ensure data is encrypted at rest?

1. A Enable TDE manually
2. ✓ B Encryption at rest is enabled by default for all tiers (correct answer)
3. C Configure CMK in Premium tier only
4. D Use Redis AUTH for encryption

Shortcut: Azure Cache for Redis encrypts data at rest by default using platform-managed keys. Enterprise tier also supports customer-managed keys (CMK) via Azure Key Vault.

What is the maximum practical event size Event Grid accepts?

1. ✓ A 64 KB free, up to 1 MB billed in 64 KB increments (correct answer)
2. B 256 KB
3. C 1 GB
4. D No limit

Shortcut: Events up to 1 MB are supported, billed per 64 KB unit. Large payloads should use the claim-check pattern with a blob reference instead.

You need per-pod outbound identity so that different workloads present different identities to Azure services. Which feature satisfies this?

1. A Kubelet managed identity
2. ✓ B Workload Identity with one federated credential per ServiceAccount (correct answer)
3. C A shared service principal
4. D Node pool user-assigned identity

Shortcut: The kubelet identity is shared by every pod on the node. Workload Identity binds a distinct Azure AD identity to each ServiceAccount, giving per-workload identity and auditability.

What is the purpose of the Query Store feature in Flexible Server?

1. A To cache query results
2. ✓ B To persist query runtime statistics and plans for performance analysis (correct answer)
3. C To replicate queries to a replica
4. D To encrypt queries

Shortcut: Query Store captures per-query runtime statistics and wait events into the azure_sys database, which is the primary tool for identifying regressions and top resource consumers.

A production function must retry failed executions up to 5 times with exponential backoff. How is this configured?

1. A In the function code with try/catch
2. ✓ B In host.json under retry policy (fixedDelay or exponentialBackoff) (correct answer)
3. C In the trigger binding definition
4. D Via Azure Monitor alerts

Shortcut: json (retryPolicy section) or via [FixedDelayRetry]/[ExponentialBackoffRetry] attributes, handling retries outside the function code.

Which condition can be attached to a role assignment for finer control, such as restricting access to blobs with a specific tag?

1. ✓ A Azure ABAC condition expressions (correct answer)
2. B A NSG rule
3. C A deny assignment
4. D A resource lock

Shortcut: Attribute-based access control adds condition expressions to eligible data-plane role assignments, allowing rules based on resource attributes such as blob index tags.

Which Container Apps feature allows binding to Azure managed services (Cosmos DB, Service Bus) with automatic connection string injection?

1. A Managed identity
2. ✓ B Service binding (preview) (correct answer)
3. C DAPR component
4. D Environment variable manual configuration

Shortcut: Service bindings (in preview) automatically inject connection strings and endpoint information for bound Azure services into the container app's environment.

Which failure mode results from checkpointing after every single event?

1. A Data loss
2. ✓ B Significant throughput reduction due to storage write overhead (correct answer)
3. C Duplicate events
4. D Partition rebalancing

Shortcut: Each checkpoint is a blob write. Checkpointing per event makes storage the bottleneck; checkpointing per batch or on an interval is the standard compromise.

A Flexible Server instance must be accessible from on-premises via a private connection without internet exposure. Which network feature achieves this?

1. A Service endpoint on the subnet
2. ✓ B Private endpoint with Azure Private DNS Zone (correct answer)
3. C VPN Gateway with public endpoint
4. D ExpressRoute with public peering

Shortcut: A private endpoint creates a private IP for the Flexible Server in your VNet. Combined with Azure Private DNS zones, on-premises resources can resolve and connect to the private IP via ExpressRoute or VPN.

A KEDA Service Bus scaler is configured but the app never scales. Which cause is most likely?

1. A The queue has too many messages
2. ✓ B The scaler's connection secret or managed identity lacks permission to read queue metadata (correct answer)
3. C maxReplicas is set too high
4. D Ingress is set to internal

Shortcut: KEDA must query the queue's message count. If the connection string secret is wrong or the identity lacks Service Bus Data Receiver / Manage rights, the metric reads zero and no scaling occurs.

A team uses Event Grid to notify downstream services when AI model inference results are ready. Which architectural pattern does this implement?

1. A Request-response (synchronous)
2. ✓ B Event-driven microservices (async notification) (correct answer)
3. C Batch processing
4. D CQRS write side only

Shortcut: Publishing an event when results are ready decouples the inference service from consumers. Multiple downstream services can subscribe independently, implementing event-driven microservices architecture.

Which TWO practices prevent a cache stampede when a popular key expires?

1. ✓ A Add a small random jitter to each key's TTL (correct answer)
2. ✓ B Recompute the value behind a short-lived lock so only one caller rebuilds it (correct answer)
3. C Set all TTLs to the same value for predictability
4. D Disable eviction
5. E Use the KEYS command to pre-warm

Shortcut: Identical TTLs cause many keys to expire together and every caller to rebuild at once. Jitter spreads the expiries, and a rebuild lock ensures a single caller recomputes while the others wait or serve stale. KEYS is O(N) and blocks the server, making the incident worse.

What is the Key Vault network default when you first create a vault?

1. A Private endpoint only
2. ✓ B All networks (public internet access enabled) (correct answer)
3. C VNet-only access
4. D Disabled

Shortcut: By default, new Key Vaults allow access from all networks (public internet). Best practice: restrict to specific VNets or private endpoints immediately after creation for production vaults.

Which AKS Backup solution integrates with Azure Backup to protect persistent volumes and cluster configuration?

1. A Velero self-managed
2. ✓ B Azure Backup for AKS (native) (correct answer)
3. C etcd backup via kubectl
4. D Azure Site Recovery

Shortcut: Azure Backup for AKS is a native solution supporting snapshot-based backup of AKS workloads including PVCs, Kubernetes objects, and namespace configurations.

Which approach lets a function read a Key Vault secret without SDK code?

1. ✓ A A Key Vault reference in app settings using @Microsoft.KeyVault(SecretUri=...) (correct answer)
2. B Hardcoding the value
3. C A SAS token
4. D An input binding to Key Vault

Shortcut: App settings support Key Vault references resolved by the platform using the app's managed identity, so the secret surfaces as an ordinary environment variable.

Which statement about Redis clustering is accurate for multi-key operations?

1. A Any keys can be used in one transaction
2. ✓ B Multi-key operations require the keys to hash to the same slot, achieved with hash tags {} (correct answer)
3. C Clustering removes all multi-key limits
4. D Transactions are unsupported in clustered mode

Shortcut: In cluster mode, keys must reside in the same hash slot for multi-key commands. Wrapping a common substring in braces, such as user:{123}:profile, forces co-location.

What does the Kubernetes imagePullPolicy: Always ensure?

1. ✓ A The image is pulled from the registry every time the pod starts, regardless of local cache (correct answer)
2. B The image is pulled only if not present locally
3. C The image is never pulled from the registry
4. D The image must be pre-staged on each node

Shortcut: imagePullPolicy: Always forces Kubernetes to contact the registry on every pod start, ensuring the latest image is always used. Useful when using mutable tags like :latest.

A financial application sends a high-value transaction message to Service Bus and needs confirmation that it was received. Which pattern should be implemented?

1. A Receive-delete mode
2. ✓ B Request-reply with ReplyTo and CorrelationId (correct answer)
3. C Scheduled message
4. D Peek and abandon

Shortcut: Request-reply sets the ReplyTo property to a reply queue and CorrelationId for correlation. The receiver sends a confirmation message to the ReplyTo queue with the matching CorrelationId.

What is the role of the container vector policy in Cosmos DB?

1. A Configures network access for the container
2. ✓ B Defines the vector property path, dimensions, distance metric, and index type for vector search (correct answer)
3. C Controls TTL for vector items
4. D Sets throughput for vector index operations

Shortcut: The vector policy (set at container creation) specifies which property contains the vector, its dimension count, the distance metric (cosine/dot/Euclidean), and the index type (flat or DiskANN).

Which SKU limitation would force an upgrade from Standard to Premium for a registry serving a global workload?

1. A Webhook support
2. ✓ B Geo-replication and private endpoints (correct answer)
3. C Docker Content Trust
4. D ACR Tasks

Shortcut: Geo-replication, private endpoints, customer-managed keys, and content trust are Premium features. Webhooks and ACR Tasks are available on lower SKUs.

What distinguishes a correlation filter from a SQL filter on a subscription?

1. A Correlation filters support arbitrary expressions
2. ✓ B Correlation filters match exact property values and are more efficient than SQL expression evaluation (correct answer)
3. C SQL filters are cheaper
4. D They are identical

Shortcut: Correlation filters perform indexed equality matching on system and user properties, which the broker evaluates faster than parsing and executing a SQL expression.

Which PowerShell cmdlet retrieves a secret value from Key Vault as plain text?

1. ✓ A Get-AzKeyVaultSecret -VaultName -Name | Select-Object -ExpandProperty SecretValue | ConvertFrom-SecureString -AsPlainText (correct answer)
2. B Get-AzKeyVaultSecretValue
3. C Get-Secret
4. D az keyvault secret show --query value

Shortcut: Get-AzKeyVaultSecret returns the secret as a PSKeyVaultSecret with SecretValue as a SecureString. Password for plain text.

What Cosmos DB feature enables sharing throughput across multiple containers in the same database?

1. A Container-level provisioning
2. ✓ B Database-level shared throughput (correct answer)
3. C Autoscale
4. D Serverless

Shortcut: Database-level throughput shares provisioned RU/s across all containers in the database. Individual containers can optionally have dedicated throughput overriding the shared pool.

How do you enable zone redundancy for an ACR registry?

1. A It is enabled automatically on all Premium registries
2. ✓ B Using az acr create --zone-redundancy Enabled (Premium SKU only) (correct answer)
3. C Via the Azure portal network tab
4. D By enabling geo-replication to a second zone

Shortcut: Zone redundancy must be explicitly enabled at creation time with --zone-redundancy Enabled and requires Premium SKU. It cannot be added after creation.

Which pricing model does Azure Service Bus use?

1. A Per message size
2. ✓ B Per operation (message sent or received) plus data transfer (correct answer)
3. C Per hour per namespace
4. D Per connection

Shortcut: Service Bus bills per messaging operation (send, receive, management) and data transfer. Premium tier adds per messaging unit (MU) capacity billing. Message size affects batch limits, not per-message pricing directly.