AI-200 Practice Set 14: 47 Exam-Style Questions

Which design decouples an event producer from a variable number of consumers with no producer change?

1. A Point-to-point HTTP calls
2. ✓ B Publishing to a topic and letting each consumer create its own subscription with filters (correct answer)
3. C A shared database table
4. D Direct queue writes

Shortcut: Topic-based publish/subscribe means adding a consumer is purely a subscription operation. The publisher has no knowledge of, and needs no change for, the consumer set.

Which statement about Bounded Staleness is accurate?

1. ✓ A Reads may lag writes by a configured number of versions or time interval (correct answer)
2. B It is identical to Eventual consistency
3. C It guarantees zero lag
4. D It is only available in single-region accounts

Shortcut: Bounded Staleness lets you bound lag by K versions or T seconds, giving a predictable staleness ceiling that is stronger than Session but cheaper than Strong.

Which AKS upgrade concept lets you validate a new Kubernetes version on a subset of nodes before committing?

1. ✓ A Blue-green node pools: add a new pool on the target version and migrate workloads (correct answer)
2. B In-place control plane upgrade only
3. C Deleting and recreating the cluster
4. D Enabling the cluster autoscaler

Shortcut: Creating a second node pool on the new version and cordoning/draining the old one gives a reversible, incremental migration path with a clear rollback.

What is required before a Key Vault key can be used as a customer-managed key for another Azure service?

1. ✓ A The vault must have soft delete and purge protection enabled (correct answer)
2. B The key must be exportable
3. C The vault must be in Standard tier
4. D Public access must be enabled

Shortcut: Services depending on a CMK require soft delete and purge protection so the key cannot be destroyed, which would render the encrypted data permanently unrecoverable.

How do you configure Event Grid to only deliver events where the event subject starts with '/documents/'?

1. A Advanced filter: subject begins with /documents/
2. ✓ B Subject filter: subjectBeginsWith: '/documents/' (correct answer)
3. C Event type filter
4. D Topic filter

Shortcut: Event Grid subscription subject filters support subjectBeginsWith and subjectEndsWith for efficient prefix/suffix matching. This is faster than advanced filters for subject-based routing.

What does the pgvector HALFVEC type provide compared to VECTOR?

1. A Support for binary quantized vectors
2. ✓ B Half-precision (16-bit float) storage, halving memory use for embeddings (correct answer)
3. C Integer quantization
4. D Sparse vector support

Shortcut: HALFVEC stores embeddings as 16-bit floats (FP16) instead of 32-bit, halving storage and memory requirements with minimal impact on similarity search quality.

What is the purpose of the --ingress-transport flag when set to 'http2' in Container Apps?

1. A Forces HTTP/1.1 upgrade
2. ✓ B Enables gRPC and HTTP/2 traffic end-to-end between ingress and the container (correct answer)
3. C Configures TLS version
4. D Sets the load balancer protocol

Shortcut: Setting --ingress-transport http2 enables HTTP/2 end-to-end, required for gRPC servers. 1.

What is the Azure Monitor Metrics Explorer used for?

1. A Writing KQL queries against Log Analytics
2. ✓ B Visualizing and charting Azure Monitor platform and custom metrics in near-real-time (correct answer)
3. C Creating alert rules only
4. D Managing diagnostic settings

Shortcut: Metrics Explorer in the Azure portal provides interactive charting of Azure Monitor metrics with time range selection, dimension splitting, aggregation options, and chart pinning to dashboards.

What does Event Hubs Capture write when no events arrive during a window?

1. ✓ A Nothing, unless emit-empty-files is enabled (correct answer)
2. B An error file
3. C A duplicate of the last batch
4. D It disables capture

Shortcut: By default Capture skips empty windows. The option to emit empty files exists for pipelines that require a file per interval as a heartbeat.

Which pgvector type reduces storage by half while retaining approximate similarity quality?

1. A vector
2. ✓ B halfvec (correct answer)
3. C sparsevec
4. D bit

Shortcut: halfvec stores 16-bit floats instead of 32-bit, halving storage and index memory with minimal recall loss for most embedding models.

Which statement about Container Apps and VNet integration is accurate?

1. A The VNet is chosen per app
2. ✓ B The VNet is configured on the environment and shared by all apps within it (correct answer)
3. C VNet integration requires the Dedicated plan only
4. D Apps cannot reach private endpoints

Shortcut: VNet infrastructure subnet is set when the environment is created and applies to every app in it. Individual apps cannot select a different VNet.

An availability requirement states that an endpoint must be probed from multiple regions every 5 minutes. Which feature provides this?

1. ✓ A Standard availability tests (URL ping / multi-step) (correct answer)
2. B Live Metrics
3. C Profiler
4. D Snapshot Debugger

Shortcut: Availability tests run synthetic probes from selected Azure regions on a schedule and can alert when a configured number of locations report failure.

What is the purpose of the Durable Functions entity (Entity Functions)?

1. A Replaces orchestrator functions
2. ✓ B Implements stateful, actor-like objects that handle operations and maintain state durably (correct answer)
3. C Provides fan-out to multiple activities
4. D Acts as a service bus consumer

Shortcut: Entity functions (virtual actors) maintain durable state and handle operations (methods) sent to them. State is persisted between invocations without managing storage explicitly.

Which Redis module available in the Enterprise tier supports real-time search and secondary indexing (e.g., full-text search on JSON fields)?

1. A RedisJSON only
2. ✓ B RediSearch (part of Redis Stack) (correct answer)
3. C RedisGraph
4. D RedisTimeSeries

Shortcut: RediSearch (included in Redis Stack / Enterprise) provides secondary indexing, full-text search, aggregations, and vector similarity search on Redis Hash and JSON data.

An AKS node pool needs to be dedicated to GPU workloads only. How do you prevent CPU workloads from being scheduled there?

1. A Set node pool as system type
2. ✓ B Apply a taint (gpu=true:NoSchedule) and add matching tolerations to GPU pod specs (correct answer)
3. C Use a NetworkPolicy
4. D Set maxPods to 1

Shortcut: Tainting the GPU node pool with NoSchedule prevents non-GPU pods (which lack the toleration) from being scheduled there. GPU pods must have the matching toleration.

Which Microsoft Defender for Cloud plan provides runtime threat protection for AKS by analysing Kubernetes audit logs for suspicious activity?

1. A Defender for Servers
2. ✓ B Defender for Containers (AKS protection) (correct answer)
3. C Defender for App Service
4. D Defender for APIs

Shortcut: , privileged container creation, role escalation, crypto mining indicators), and generates security alerts.

What causes the 'Singleton lock' behaviour needed to ensure a timer function runs on only one instance?

1. ✓ A A blob lease acquired by the runtime (correct answer)
2. B A Service Bus session
3. C A database row lock
4. D Nothing; timers run on all instances

Shortcut: The timer trigger acquires a blob lease in the AzureWebJobsStorage account, guaranteeing a single instance executes each scheduled occurrence.

Which approach stores vectors so that both the embedding and its metadata are retrievable in one query?

1. ✓ A Store the vector in a HASH alongside metadata fields and index both (correct answer)
2. B Store vectors in a separate database
3. C Use Pub/Sub to join data
4. D Store metadata in a List

Shortcut: SEARCH return metadata with the nearest-neighbour results in one call.

Which ACR network feature allows restricting pull/push access to specific Azure virtual network subnets?

1. A Private endpoint only
2. ✓ B Service endpoint rules or private endpoint (Premium SKU) (correct answer)
3. C Network Security Group (NSG) attached to ACR
4. D DNS private zone

Shortcut: ACR Premium supports both service endpoint-based virtual network rules and private endpoints to restrict registry access to specific VNet subnets.

What is the correct sequence when creating a system-assigned identity for a Function App that needs Key Vault access?

1. A Assign the role first, then enable the identity
2. ✓ B Enable the identity, obtain its principal id, then create the role assignment (correct answer)
3. C Create a service principal manually
4. D Copy an existing identity

Shortcut: The identity must exist before it can be granted anything. Enabling it produces a principal id, which is then used as the target of the role assignment.

How does the partition key in Event Hubs determine message routing?

1. ✓ A Messages with the same partition key go to the same partition, preserving order for that key (correct answer)
2. B Messages are round-robined across partitions ignoring partition key
3. C Partition key maps to a specific throughput unit
4. D Partition key determines the consumer group

Shortcut: Event Hubs hashes the partition key and routes all events with the same key to the same partition. , all events from device-123 go to partition 5).

A Cosmos DB account with bounded staleness consistency is configured with 5 seconds staleness. What is guaranteed?

1. A Reads always see the latest write
2. ✓ B Reads may be at most 5 seconds (or K operations) behind the leader (correct answer)
3. C Each session sees its own writes
4. D There are no consistency guarantees

Shortcut: Bounded staleness guarantees reads are at most K versions or T time behind the most recent write. It's stronger than session or eventual, suitable for apps that can tolerate brief staleness.

A multi-step ACR Task must build an image, run tests against it, and push only if tests pass. Which construct expresses this?

1. A A quick task with az acr build
2. ✓ B A YAML task file with build, cmd, and push steps plus a 'when' condition (correct answer)
3. C Three separate scheduled tasks
4. D A Dockerfile with multi-stage builds only

Shortcut: yaml support sequential build/cmd/push steps, dependencies via 'when', and shared volumes, enabling test gating inside the registry build itself.

Which entity setting automatically removes a queue after a period of no activity?

1. A TimeToLive
2. ✓ B AutoDeleteOnIdle (correct answer)
3. C MaxDeliveryCount
4. D LockDuration

Shortcut: AutoDeleteOnIdle deletes the entity itself after the specified idle interval, which is useful for ephemeral, per-session or per-request reply queues.

A microservice architecture uses 20 different secrets. Which Key Vault design approach reduces operational overhead?

1. A One Key Vault per microservice (20 vaults)
2. B One shared vault for all microservices with RBAC controlling access per service
3. ✓ C One vault per environment (dev/staging/prod) (correct answer)
4. D Store secrets in Azure Table Storage with encryption

Shortcut: One vault per environment (dev, staging, prod) balances operational simplicity with security isolation. RBAC within each vault controls which services/identities access which secrets. One per microservice creates excessive management overhead.

An application needs to filter results to only documents in a specific category before applying vector similarity search. What is this pattern called?

1. A Post-filtering
2. ✓ B Pre-filtering (filtered ANN) (correct answer)
3. C Hybrid search
4. D Metadata retrieval

Shortcut: Pre-filtering applies a WHERE clause predicate before or during ANN search. pgvector with HNSW supports filtered search: SELECT ... WHERE category = 'X' ORDER BY embedding <=> $1 LIMIT 10.

A Service Bus topic has a subscription with an action rule. What can a rule action do to a message?

1. A Delete the message
2. ✓ B Set or remove message properties before delivery to the subscription (correct answer)
3. C Route to another topic
4. D Delay delivery

Shortcut: Rule actions (SQL-based) can modify message properties (set user properties, change system properties) when a filter matches, enabling message enrichment or routing before delivery.

A Container Apps app is deployed in an environment with no VNet integration. What type of ingress is available?

1. A Internal only
2. ✓ B External only (correct answer)
3. C Both internal and external
4. D Neither; VNet required for ingress

Shortcut: Without VNet integration, only external ingress (public FQDN) is available. Internal ingress requires VNet integration so the environment has a VNet-assigned address.

An AKS cluster is monitored by Azure Managed Prometheus. Where are the scraped metrics stored and how are they queried?

1. A Log Analytics Workspace via KQL
2. ✓ B Azure Monitor Workspace (Prometheus-compatible endpoint), queried via PromQL or Grafana (correct answer)
3. C Azure Storage Account
4. D InfluxDB on the cluster

Shortcut: Azure Managed Prometheus stores metrics in an Azure Monitor Workspace with a Prometheus-compatible query endpoint. Use PromQL directly or Azure Managed Grafana for visualization.

For a RAG pipeline, which Cosmos DB capability lets you keep the vector and its source document together to avoid a second lookup?

1. ✓ A Storing the embedding as a property on the same document as the text (correct answer)
2. B Using a separate vector-only container
3. C Storing vectors in analytical store
4. D Using the change feed

Shortcut: Co-locating the embedding array and the source text in one document means the nearest-neighbour query returns the content directly, removing a round trip and its RU cost.

Which property distinguishes the type of occurrence so handlers can branch logic?

1. ✓ A eventType (correct answer)
2. B subject
3. C dataVersion
4. D topic

Shortcut: BlobCreated. It is also the field most commonly used in subscription-level filters.

A ConfigMap change is not reflected in a running pod. Why?

1. A ConfigMaps are immutable
2. ✓ B ConfigMaps mounted as environment variables are read only at container start (correct answer)
3. C The ConfigMap must be in a different namespace
4. D kubelet caches ConfigMaps for 24 hours

Shortcut: Environment variables are injected once at startup. Volume-mounted ConfigMaps update in place after a short sync delay, but env-var consumers require a pod restart or rollout.

Which alert would best detect credential misuse?

1. ✓ A An alert on AuditEvent logs showing secret reads from unexpected identities or IP ranges (correct answer)
2. B CPU alert on the vault
3. C Storage capacity alert
4. D Cost alert

Shortcut: Key Vault has no CPU or capacity to monitor. Anomalous data-plane access patterns in AuditEvent logs are the meaningful security signal.

A team needs rate limiting per API client in Redis. Which approach correctly counts requests within a sliding window?

1. A INCR with fixed TTL (fixed window)
2. ✓ B Sorted Set with ZADD timestamp, ZREMRANGEBYSCORE, ZCARD (sliding window) (correct answer)
3. C List with LPUSH/LLEN
4. D Hash with HINCR

Shortcut: The sliding window rate limiter stores request timestamps in a Sorted Set, removes entries older than the window (ZREMRANGEBYSCORE), and counts remaining entries (ZCARD) to determine if the limit is exceeded.

An Event Grid subscription receives a Blob Created event. The event data contains the blob URL. Which property holds the blob URL?

1. A data.url
2. B data.blobUrl
3. C data.url in the event data (contentType, eTag, url)
4. ✓ D subject (the blob path) (correct answer)

Shortcut: txt). The data object contains size, contentType, eTag, and other metadata.

Which component in AKS provides mutual TLS between services automatically without code changes?

1. A Kubernetes NetworkPolicy
2. ✓ B Istio service mesh (correct answer)
3. C Azure Load Balancer
4. D nginx ingress TLS termination

Shortcut: Istio (and other service meshes) automatically inject sidecar proxies that handle mTLS between services transparently, without application code changes.

A team enforces that all storage accounts must use HTTPS-only traffic. Which Azure Policy built-in effect ensures existing non-compliant accounts are remediated?

1. A Audit
2. B Deny (blocks new ones)
3. ✓ C DeployIfNotExists with a remediation task (correct answer)
4. D Modify

Shortcut: DeployIfNotExists with a remediation task deploys a linked template to fix existing non-compliant resources. For storage accounts, it can enforce the 'supportsHttpsTrafficOnly' property via remediation.

A query filters on tenant_id then orders by vector distance. Which index strategy is most effective?

1. A A single HNSW index on the vector only
2. ✓ B Partial HNSW indexes per tenant, or a composite B-tree on tenant_id plus HNSW with sufficient ef_search (correct answer)
3. C A B-tree on the vector column
4. D No index

Shortcut: Pre-filtering interacts poorly with approximate indexes because the filter can eliminate most graph candidates. Partitioning or partial indexes per tenant keeps recall high under filtering.

Which approach handles a poison event that repeatedly crashes the processor?

1. A Increase throughput units
2. ✓ B Catch the exception, write the event to a dead-letter store, checkpoint past it, and continue (correct answer)
3. C Delete the partition
4. D Reduce retention

Shortcut: Event Hubs has no built-in dead-lettering. The consumer must isolate the bad event itself and advance the checkpoint, otherwise the partition stalls permanently.

What is the recommended way to manage Kubernetes resource quotas for multiple teams sharing an AKS cluster?

1. A One cluster per team
2. ✓ B ResourceQuota and LimitRange objects per namespace (correct answer)
3. C Azure subscription limits
4. D Cluster Autoscaler per team

Shortcut: ResourceQuota objects limit total resources (CPU, memory, object counts) per namespace. LimitRange sets default/min/max resource requests for pods in that namespace.

Which query pattern identifies the most common exception types in the last day?

1. ✓ A exceptions | where timestamp > ago(1d) | summarize count() by type | order by count_ desc (correct answer)
2. B exceptions | take 10
3. C traces | count
4. D requests | summarize count()

Shortcut: Grouping the exceptions table by type and ordering by the resulting count surfaces the dominant failure modes for triage.

Which property in a Cosmos DB NoSQL document always specifies the item's unique identifier within its partition?

1. A _rid
2. B _self
3. ✓ C id (correct answer)
4. D pk

Shortcut: The id property is the mandatory unique identifier for each item within a Cosmos DB container. Combined with the partition key, it uniquely identifies any item globally in the container.

How does Service Bus partition-enabled queues improve throughput?

1. A By adding more consumers automatically
2. ✓ B By spreading messages across multiple message brokers internally (correct answer)
3. C By compressing messages
4. D By using AMQP multiplexing

Shortcut: Partition-enabled queues/topics split across multiple message brokers and stores. This removes single-broker bottleneck and improves throughput and availability (with some feature limitations).

You need to run a one-off data migration container with access to the app's secrets, exactly once. What is the cleanest option?

1. ✓ A A Container Apps Job with a manual trigger and replicaCompletionCount 1 (correct answer)
2. B Scaling the main app to 2 replicas temporarily
3. C A cron scale rule
4. D An init container on the main app

Shortcut: A manually triggered Job runs to completion once, can reference the same secrets and identity, and terminates without affecting the serving app.

How does Key Vault auto-rotate a secret connected to a storage account access key?

1. A Key Vault generates new storage keys directly
2. ✓ B A rotation function reads the event (SecretNearExpiry), regenerates the storage key via Azure Storage API, updates Key Vault secret version (correct answer)
3. C Automatic; no action required
4. D Azure AD rotates storage keys automatically

Shortcut: Key Vault Near-Expiry event triggers an Azure Function rotation job. The function regenerates the storage account key (az storage account keys renew) and stores the new value as a new secret version in Key Vault.

What is the effect of setting maxmemory-policy to noeviction when memory is exhausted?

1. A Random keys are dropped
2. ✓ B Write commands return an OOM error while reads continue (correct answer)
3. C The server restarts
4. D TTLs are shortened automatically

Shortcut: noeviction refuses new writes with an OOM error rather than discarding data. It suits durable queues but is a poor fit for caches.

Which deployment method is recommended for production to guarantee immutable, consistent releases?

1. A FTP upload
2. ✓ B Run-from-package deployment (WEBSITE_RUN_FROM_PACKAGE) (correct answer)
3. C Editing code in the portal
4. D Manual file copy

Shortcut: Run-from-package mounts a versioned zip as a read-only file system, giving atomic swaps, faster cold starts, and no partially deployed states.