AI-200 Practice Set 16: 47 Exam-Style Questions

How many partitions should you choose for a stream expected to need 8 parallel consumers at peak?

1. A 1
2. ✓ B At least 8, allowing headroom for future growth (correct answer)
3. C 4
4. D It does not matter

Shortcut: Partition count caps consumer parallelism and generally cannot be reduced. Provisioning at or above the expected peak concurrency avoids a costly migration later.

What is the purpose of the Application Map?

1. A To show subscription costs
2. ✓ B To visualise component dependencies with call rates, latencies, and failure rates (correct answer)
3. C To display resource groups
4. D To list alerts

Shortcut: Application Map builds a topology from telemetry, using cloud_RoleName and dependency data to reveal which hop is slow or failing in a distributed system.

You must retain container stdout logs for 90 days and query them with KQL. What is the standard configuration?

1. ✓ A Enable Container Insights sending to a Log Analytics workspace with a 90-day retention setting (correct answer)
2. B Mount a persistent volume and write logs to disk
3. C Enable Application Insights profiler
4. D Use kubectl logs with a cron job

Shortcut: Container Insights ships stdout/stderr into the ContainerLogV2 table in Log Analytics, where retention is configurable and data is queryable with KQL.

Which scaling operation on Flexible Server requires a restart?

1. A Increasing storage size
2. ✓ B Changing compute tier or size (correct answer)
3. C Adding a firewall rule
4. D Creating an index

Shortcut: Compute scaling restarts the server, causing brief downtime. Storage can be grown online, and storage cannot be reduced afterwards.

What is required to use a Storage Queue as an Event Grid event handler?

1. A Premium Storage Account
2. ✓ B Any Azure Storage Account (General Purpose v2); Event Grid writes to the queue directly (correct answer)
3. C Service Bus namespace
4. D Logic Apps connector

Shortcut: Storage Queue is a native Event Grid handler. Event Grid serializes events as JSON and enqueues them. Any GPv2 storage account works.

What does Azure Monitor Diagnostic Settings control?

1. A Application Insights instrumentation key
2. ✓ B Where platform logs and metrics from Azure resources are sent (Log Analytics, Storage Account, Event Hubs) (correct answer)
3. C AKS cluster autoscaler settings
4. D Virtual machine agent configuration

Shortcut: Diagnostic Settings configure the routing of resource-level diagnostic logs and metrics to Log Analytics workspaces, Azure Storage (archive), or Event Hubs (stream to SIEM). Each resource has its own diagnostic settings.

Which az acr build flag allows submitting a build without waiting for it to complete?

1. A --skip-wait
2. B --async
3. ✓ C --no-wait (correct answer)
4. D --background

Shortcut: --no-wait returns control immediately after submitting the build, without waiting for completion. The build continues in the background.

An application requires a Redis cache that supports vector similarity search (ANN) natively. Which tier/module is required?

1. A Premium with clustering
2. ✓ B Enterprise with RediSearch (vector search support) (correct answer)
3. C Standard with custom scripting
4. D Basic with Lua scripts

Shortcut: RediSearch in Azure Cache for Redis Enterprise supports vector similarity search (HNSW and flat indexes) over Hashes or JSON documents alongside full-text search.

Which observability configuration gives end-to-end correlation across a function and the services it calls?

1. ✓ A Application Insights with distributed tracing enabled (correct answer)
2. B Console logging only
3. C Storage logs
4. D Azure Advisor

Shortcut: Application Insights propagates the operation_Id across requests and dependencies, allowing a single trace to be followed through every hop of the call chain.

A team configures Microsoft Defender for Cloud's Defender for DevOps. What does this protect?

1. A Production Azure workloads
2. ✓ B Source code repositories and CI/CD pipelines (GitHub, Azure DevOps) scanning for IaC misconfigurations and exposed secrets (correct answer)
3. C Kubernetes cluster runtime
4. D Azure Container Registry images

Shortcut: Defender for DevOps integrates with GitHub and Azure DevOps to scan IaC templates (Bicep, Terraform, ARM) for security misconfigurations and detect exposed secrets in repositories and pipelines.

What is required for two revisions to be addressable individually for testing during a traffic split?

1. A Separate environments
2. ✓ B Revision labels, which produce stable per-revision FQDNs (correct answer)
3. C Separate ingress objects
4. D Distinct container images only

Shortcut: Assigning a label to a revision creates a dedicated hostname for it, allowing direct testing of that revision independently of the weighted traffic split.

Which measurement should drive the similarity threshold in a semantic cache?

1. A A fixed 0.5 for all workloads
2. ✓ B An empirically tuned threshold validated against labelled prompt pairs (correct answer)
3. C The vector dimension
4. D The cache size

Shortcut: Thresholds are embedding-model and domain specific. Too loose returns wrong answers; too tight destroys the hit rate. It must be calibrated on representative data.

A cloud-native application must handle temporary Service Bus connectivity issues gracefully. Which SDK feature handles transient errors with exponential backoff automatically?

1. A Manual retry loop with Thread.Sleep
2. ✓ B ServiceBusRetryOptions configured on ServiceBusClient (correct answer)
3. C Custom exception handler in processor
4. D No retry needed; Service Bus guarantees delivery

Shortcut: The Azure Service Bus SDK includes built-in retry logic via ServiceBusRetryOptions. Configure MaxRetries, RetryMode (Exponential/Fixed), and MaxDelay on the ServiceBusClient.

Which TWO statements about Azure RBAC evaluation are correct?

1. ✓ A Allow assignments are additive and inherited down the scope hierarchy (correct answer)
2. ✓ B A deny assignment takes precedence over any allow assignment (correct answer)
3. C Removing a role assignment instantly invalidates already-issued access tokens
4. D Assignments at a child scope override and replace those at a parent scope
5. E Data-plane access is granted by management-plane roles such as Contributor

Shortcut: Effective permissions are the union of every applicable allow assignment inherited from management group down to resource, and deny assignments override them. Tokens remain valid until expiry, so revocation is not instantaneous, and data-plane access needs explicit data roles.

Which scaling rule prevents a Container App from scaling below 1 replica, ensuring it remains warm?

1. A Set scaleRules to empty
2. ✓ B Set minReplicas to 1 (correct answer)
3. C Set maxReplicas to 1
4. D Set HTTP rule concurrent requests to infinity

Shortcut: Setting minReplicas: 1 ensures at least one replica is always running, preventing cold starts. This costs more than scale-to-zero but avoids startup latency for latency-sensitive apps.

A vector search returns poor results. Increasing which IVFFlat parameter improves recall without rebuilding the index?

1. A lists
2. B m
3. ✓ C ivfflat.probes (correct answer)
4. D ef_construction

Shortcut: probes=N at query time controls how many inverted lists are searched. Higher probes = better recall. This is a session-level setting requiring no index rebuild.

Which approach scales a Container App consumer based on Service Bus backlog?

1. A A CPU scale rule
2. ✓ B A KEDA azure-servicebus scaler using queue length with messageCount threshold (correct answer)
3. C A cron rule
4. D Manual scaling

Shortcut: The KEDA Service Bus scaler reads the queue or subscription message count and scales replicas, including from zero, according to the configured messageCount target.

Which data-plane role would you assign for an application that must send messages to a Service Bus queue only?

1. A Azure Service Bus Data Owner
2. ✓ B Azure Service Bus Data Sender (correct answer)
3. C Contributor
4. D Azure Service Bus Data Receiver

Shortcut: Data Sender permits send operations exclusively. Data Owner would additionally allow receiving and managing entities, exceeding what a publisher requires.

You observe that pulls from a geo-replicated registry in one region are slow while others are fast. What should you check first?

1. ✓ A Whether the replica in that region is in a failed or syncing state (correct answer)
2. B Whether Content Trust is enabled
3. C Whether the retention policy is too aggressive
4. D Whether the admin account is disabled

Shortcut: Each replica reports its own provisioning and sync status. A replica that is syncing or failed forces clients to fall back to a distant region, which manifests as slow pulls in that geography.

What does the Cosmos DB SDK's bulk executor / bulk operations mode provide?

1. A Automatic partition key selection
2. ✓ B Optimized throughput for inserting or updating large numbers of documents in parallel (correct answer)
3. C Automatic geo-replication
4. D Real-time change notifications

Shortcut: The SDK's bulk execution mode batches and parallelizes operations across partitions, maximizing RU/s utilization for large-scale imports or migrations.

A security-critical Event Hubs namespace must not be accessible from the public internet. Which features achieve network isolation?

1. A IP firewall rules only
2. ✓ B Private endpoints and disabling public network access (Standard/Premium) (correct answer)
3. C NSG on the client side
4. D Azure Front Door WAF

Shortcut: Private endpoints create a private IP for the Event Hubs namespace in the VNet. Combining with --public-network-access Disabled blocks all public internet access to the namespace.

Which authentication flow does DefaultAzureCredential use when running in Azure App Service or Azure Functions?

1. A Interactive browser flow
2. B Client secret from environment variable
3. ✓ C Managed identity (system or user-assigned) (correct answer)
4. D Azure CLI credentials

Shortcut: DefaultAzureCredential tries multiple auth methods in order. In Azure App Service/Functions, it uses the managed identity endpoint (IMDS), transparently authenticating with the service's assigned identity.

What happens when an AKS cluster's Kubernetes version reaches end of support?

1. A The cluster is automatically upgraded
2. B Azure charges a penalty fee
3. ✓ C The cluster continues running but receives no security patches; you must upgrade manually (correct answer)
4. D The cluster is immediately deleted

Shortcut: AKS supports N-2 Kubernetes minor versions. After a version goes out of support, existing clusters continue running but receive no security patches. Upgrade is the customer's responsibility.

A point read by id and partition key costs how many RUs for a 1 KB document under typical conditions?

1. ✓ A Approximately 1 RU (correct answer)
2. B Approximately 5 RU
3. C Approximately 10 RU
4. D It varies with container size

Shortcut: A 1 KB point read costs about 1 RU and is the cheapest and most predictable operation. Designing access patterns around point reads keeps costs low and latency flat.

Which Event Grid tier or mode supports MQTT for IoT-style device messaging?

1. A Event Grid Basic topics
2. ✓ B Event Grid namespaces with MQTT broker functionality (correct answer)
3. C Custom topics only
4. D System topics

Shortcut: 1/v5 broker with hierarchical topic spaces and client authentication, alongside pull-delivery namespace topics.

An application needs a connection string that changes when the database password rotates, with zero downtime. What design achieves this?

1. A Hardcode the password
2. ✓ B Store the connection string in Key Vault, rotate with dual credentials, and refresh the client cache on the rotation event (correct answer)
3. C Restart the app hourly
4. D Disable rotation

Shortcut: Two-set credential rotation keeps the old credential valid while the new one is published, and refreshing the cache on the rotation event avoids any window of failed authentication.

A function app must access resources in a VNet (e.g., a private PostgreSQL endpoint). Which plan and feature enables outbound VNet connectivity?

1. A Consumption plan with VNet integration
2. ✓ B Premium plan with Regional VNet Integration (correct answer)
3. C Dedicated plan without VNet integration
4. D Container Apps Consumption plan

Shortcut: ). Consumption plan does not support VNet integration.

A team manages multiple registries. They need centralized image management with the ability to push to replicas. What is the recommended ACR replication strategy?

1. A Separate registries in each region with manual sync
2. ✓ B A single Premium registry with geo-replication to required regions (correct answer)
3. C Standard registries with container image copy via az acr import
4. D One registry per application team, cross-region access via VNet peering

Shortcut: A single geo-replicated Premium registry provides a single management plane. Images replicate automatically, and clients pull from the nearest regional replica.

What is the best practice for avoiding cache stampede (thundering herd) in Azure Cache for Redis when a popular key expires?

1. A Use a very long TTL
2. ✓ B Implement probabilistic early expiration (PER) or lock-based cache miss handling (correct answer)
3. C Disable key expiry
4. D Use WATCH/MULTI/EXEC transactions

Shortcut: Cache stampede occurs when many clients simultaneously re-compute a popular expired key. Probabilistic early expiration refreshes before expiry, or use a distributed lock to ensure only one client populates the cache on miss.

A team runs a KQL query to find the top 5 slowest API endpoints in Application Insights. Which KQL clause returns the top results?

1. A LIMIT 5
2. B TOP 5 BY duration
3. ✓ C top 5 by duration desc (correct answer)
4. D ORDER BY duration DESC LIMIT 5

Shortcut: KQL syntax: requests | summarize avg(duration) by name | top 5 by avg_duration desc. The top operator returns the N rows with the highest (or lowest with asc) values of the specified column.

Which authentication method avoids storing a SAS key in the consumer application?

1. A Connection string in app settings
2. ✓ B Managed identity with the Event Hubs Data Receiver role (correct answer)
3. C Shared access policy in code
4. D Anonymous access

Shortcut: Identity-based connections let the SDK obtain an Entra ID token via managed identity, so no shared access signature or key needs to exist in configuration.

Which statement about AKS system node pools is accurate?

1. A They can be scaled to zero nodes
2. ✓ B They must run Linux and host critical system pods such as CoreDNS (correct answer)
3. C They cannot run user workloads under any circumstances
4. D They are billed separately from user node pools

Shortcut: A system node pool must be Linux with at least one node because it hosts kube-system components. User pools may scale to zero; system pools may not.

What is the recommended way to batch-insert millions of embedding rows efficiently?

1. A Individual INSERT statements in autocommit
2. ✓ B COPY (or the binary COPY protocol) with the vector index created afterwards (correct answer)
3. C INSERT ... ON CONFLICT per row
4. D Using a stored procedure loop

Shortcut: COPY is dramatically faster than row-by-row inserts, and deferring index creation until after the load avoids the cost of incrementally maintaining the graph during ingestion.

Which action reduces query cost when repeatedly analysing the same large dataset?

1. A Increase retention
2. ✓ B Materialise the result into a summary table with a scheduled query rule (correct answer)
3. C Disable sampling
4. D Add more workspaces

Shortcut: Scheduled query rules can write aggregated results into a custom table. Subsequent analysis reads the small summary rather than rescanning raw telemetry.

Which Event Grid advanced filter operator checks if a numeric property is between two values?

1. A StringContains
2. ✓ B NumberInRange (correct answer)
3. C IsNotNull
4. D StringBeginsWith

Shortcut: NumberInRange matches if the numeric event field value falls within a specified inclusive range [min, max]. Useful for filtering events by version numbers, priority levels, or measurements.

When using DAPR service invocation in Container Apps, what does the appId property specify?

1. A The container image name
2. B The DAPR component version
3. ✓ C The unique identifier of the target app within the environment for service-to-service calls (correct answer)
4. D The Azure resource name

Shortcut: The DAPR appId is the unique name of the target Container App (set via --dapr-app-id). DAPR uses this for service discovery and invocation routing within the environment.

A production Flexible Server must automatically fail over to a standby if the primary becomes unavailable. Which configuration achieves automatic failover?

1. A Read replica promotion (manual)
2. ✓ B Zone-redundant HA with automatic failover (no manual intervention) (correct answer)
3. C pg_auto_failover extension self-managed
4. D Azure Traffic Manager routing

Shortcut: Zone-redundant HA in Flexible Server automatically detects primary failure and fails over to the standby (typically within 60-120 seconds) without manual intervention. DNS is updated automatically.

An Azure subscription has the Owner role assigned to a security group. A new user is added to the group. When do they gain the Owner permissions?

1. A Within 24 hours
2. ✓ B Immediately (group membership changes propagate to RBAC in seconds) (correct answer)
3. C At next sign-in only
4. D After an admin approves

Shortcut: RBAC evaluates group membership at runtime. When a user is added to a group that has a role assignment, the permissions are effective immediately on the user's next token issuance (typically within minutes).

Which scenario justifies the Flex Consumption plan over classic Consumption?

1. A No difference
2. ✓ B When you need VNet integration and configurable instance memory while still scaling to zero (correct answer)
3. C When you need Always On
4. D When you need a static IP only

Shortcut: Flex Consumption adds VNet integration, per-instance memory selection, and improved cold-start behaviour, while retaining scale-to-zero billing.

Which logging destination is configured at the Container Apps environment level?

1. A Application Insights instrumentation key
2. ✓ B The Log Analytics workspace receiving console and system logs (correct answer)
3. C Azure Storage account for blobs
4. D Event Hubs namespace

Shortcut: The environment specifies the Log Analytics workspace. Console logs land in ContainerAppConsoleLogs_CL and platform events in ContainerAppSystemLogs_CL for all apps in that environment.

Which command returns the remaining time to live of a key in seconds?

1. A EXPIRE key
2. ✓ B TTL key (correct answer)
3. C PERSIST key
4. D OBJECT IDLETIME key

Shortcut: TTL returns the remaining lifetime in seconds, -1 if the key has no expiry, and -2 if the key does not exist. PTTL gives the same in milliseconds.

What is the security advantage of managed identities over service principals with secrets?

1. A They are faster
2. ✓ B Credentials are issued and rotated by the platform and never exposed to the application or operators (correct answer)
3. C They cost less
4. D They support more roles

Shortcut: With managed identities there is no secret to leak, expire, or rotate manually. Certificate rotation is handled entirely by Azure behind the metadata endpoint.

Which Service Bus metric should you monitor to detect messages accumulating faster than they are being processed?

1. ✓ A Active message count (queue depth) (correct answer)
2. B Dead-letter message count
3. C Server errors metric
4. D Connection count

Shortcut: Active message count (queue depth) indicates how many messages are awaiting processing. A rising count signals that consumers are slower than producers — scale consumers or investigate processing bottlenecks.

Which AKS feature monitors container CPU and memory usage and automatically adjusts pod resource requests/limits over time?

1. A HPA
2. B Cluster Autoscaler
3. ✓ C Vertical Pod Autoscaler (VPA) (correct answer)
4. D Azure Monitor Container Insights

Shortcut: VPA (Vertical Pod Autoscaler) adjusts pod resource requests/limits based on actual usage history. It can operate in Recreate mode (restarts pods) or just provide recommendations.

Which Cosmos DB feature allows you to query data using the Spark API in Azure Synapse Analytics with zero ETL?

1. A Cosmos DB change feed
2. B Azure Data Factory pipeline
3. ✓ C Azure Synapse Link for Cosmos DB (analytical store) (correct answer)
4. D Azure Stream Analytics

Shortcut: Synapse Link enables HTAP by automatically syncing data to a column-store analytical replica. Synapse Spark and SQL Serverless can query this store directly with no ETL and no impact on Cosmos DB RUs.

An Azure Kubernetes Service pod accesses Key Vault using the Secrets Store CSI Driver. Which identity mechanism is recommended?

1. A Service principal with client secret in Kubernetes Secret
2. ✓ B Workload Identity (OIDC-federated managed identity) (correct answer)
3. C Node-level managed identity (kubelet)
4. D SAS token stored in pod environment

Shortcut: Workload Identity (OIDC federation) binds a Kubernetes service account to an Azure managed identity. The CSI Driver uses this to authenticate to Key Vault without any stored credentials in the cluster.

Which statement about Service Bus transactions is correct?

1. A They can span multiple namespaces
2. ✓ B They group send and settle operations on entities within a single namespace into an atomic unit (correct answer)
3. C They include external databases
4. D They are unsupported

Shortcut: A transaction scope can atomically combine operations such as completing one message and sending another, provided all entities live in the same namespace. External resources are not enlisted.