AI-200 — Azure AI Cloud Developer Associate

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. 1. A developer needs to store, version, and manage Docker container images for an AI application in Azure. The images must be accessible to Azure Container Apps and Azure Kubernetes Service deployments. Which Azure service should be used?

   • A. Azure Blob Storage
   • B. Azure Container Registry(correct)
   • C. Azure File Share
   • D. Azure Artifact Feeds in Azure DevOps

   Explanation: Azure Container Registry (ACR) is the dedicated Azure service for building, storing, versioning, and managing container images. It integrates natively with Azure Container Apps and AKS for image pulls. Blob Storage (A) stores unstructured data and is not an OCI-compliant container registry. Azure File Share (C) is a managed file system. Azure Artifact Feeds (D) manage NuGet, npm, and Maven packages, not container images.

2. 2. A developer wants to automatically build a new container image in Azure Container Registry every time code is pushed to a GitHub repository, without maintaining a local Docker build environment. Which capability should be used?

   • A. Azure Container Registry geo-replication
   • B. Build and run images by using Azure Container Registry Tasks(correct)
   • C. Azure Kubernetes Service (AKS) build pipeline
   • D. Azure App Service deployment slots

   Explanation: Azure Container Registry Tasks enables cloud-based image builds triggered by code commits, eliminating the need for a local Docker environment. ACR geo-replication (A) replicates images to multiple regions but does not build them from source. AKS does not have its own image build pipeline (C). App Service deployment slots (D) manage application staging, not container image builds.

3. 3. A developer is deploying an AI microservice to Azure App Service as a container. The microservice requires an OpenAI API key and a database connection string at runtime. The developer must not bake these values into the container image. What is the correct approach?

   • A. Add the secrets as Docker ENV instructions in the Dockerfile
   • B. Deploy containers to Azure App Service and configure App Service to supply environment variables and secrets(correct)
   • C. Store secrets in the container image's /tmp directory during the build step
   • D. Pass secrets as command-line arguments when running the container locally and document them in a README

   Explanation: Azure App Service supports injecting environment variables and secrets (sourced from Azure Key Vault references or App Service application settings) at runtime without embedding them in the image. Baking secrets into the Dockerfile (A) or the image filesystem (C) exposes them in the image layer history. Documenting secrets in a README (D) is insecure and does not work for runtime injection.

4. 4. An AI application deployed on Azure Container Apps experiences unpredictable traffic spikes driven by Azure Service Bus message volume. The team wants the application to automatically scale the number of replicas based on the number of pending messages. Which scaling mechanism should be implemented?

   • A. Configure Azure Monitor autoscale rules based on CPU percentage
   • B. Implement event-driven scaling by using Kubernetes Event-driven Autoscaling (KEDA) in Container Apps(correct)
   • C. Set a fixed replica count of 10 to handle peak load at all times
   • D. Use Azure App Service autoscale based on HTTP request rate

   Explanation: KEDA (Kubernetes Event-driven Autoscaling) in Azure Container Apps allows replicas to scale based on event source metrics such as the number of messages in a Service Bus queue — ideal for event-driven AI workloads. CPU-based autoscale (A) reacts to compute usage, not message queue depth. A fixed replica count (C) wastes resources at low load. App Service autoscale (D) applies to App Service, not Container Apps.

5. 5. A DevOps team has a set of Kubernetes manifest files (YAML) that define deployments, services, and config maps for an AI workload. They need to deploy and update these resources on Azure Kubernetes Service. What is the correct approach?

   • A. Deploy and manage applications to Azure Kubernetes Service (AKS) by using manifest files(correct)
   • B. Use the Azure Portal GUI to manually create each Kubernetes resource
   • C. Import the YAML files into Azure Data Factory for orchestration
   • D. Upload the manifest files to Azure Blob Storage and reference them from the AKS dashboard

   Explanation: Deploying and managing AKS applications using manifest files (kubectl apply -f) is the standard, repeatable approach for Kubernetes workloads. Manual GUI creation (B) is not repeatable and does not support version control. Azure Data Factory (C) is a data integration service, not a Kubernetes deployment tool. Blob Storage (D) can store manifest files but does not apply them to a cluster.

6. 6. An SRE team notices that an AI microservice pod on AKS has stopped responding to health checks. They need to determine whether the issue is a container crash loop, a network routing failure, or an application configuration error. Which troubleshooting approach should they use?

   • A. Monitor and troubleshoot solutions on AKS by inspecting logs, events, and end-to-end connectivity(correct)
   • B. Delete and redeploy the entire AKS cluster to reset the state
   • C. Increase the CPU limit in the pod manifest to resolve the issue
   • D. Disable liveness probes to prevent the pod from being restarted

   Explanation: Inspecting logs (kubectl logs), Kubernetes events (kubectl describe), and end-to-end connectivity tests is the standard AKS troubleshooting approach for diagnosing crash loops, network issues, and configuration errors. Deleting and redeploying the cluster (B) is destructive and eliminates diagnostic data. Increasing CPU limits (C) addresses resource constraints, not the unknown root cause. Disabling liveness probes (D) masks the symptom and can allow a broken pod to continue serving traffic.

7. 7. A developer is building a RAG application using Azure Cosmos DB for NoSQL as the vector store. They need to store document embeddings and then find the most semantically similar documents to a given query embedding. Which Cosmos DB for NoSQL capability should they use?

   • A. Use SQL aggregate functions to average embedding vectors across all documents
   • B. Store and retrieve embeddings and execute vector similarity search for semantic retrieval(correct)
   • C. Use the Cosmos DB change feed to stream embeddings to an external search service
   • D. Configure Cosmos DB geo-replication to distribute embeddings globally

   Explanation: Azure Cosmos DB for NoSQL supports native vector indexing and vector similarity search, enabling semantic retrieval directly within the database — the core requirement for a RAG vector store. SQL aggregation (A) computes statistics, not similarity rankings. The change feed (C) streams data changes and could be used as a pipeline step, but it does not perform vector similarity search. Geo-replication (D) addresses availability and latency, not similarity search.

8. 8. An AI pipeline ingests streaming product reviews into Azure Cosmos DB for NoSQL. A downstream agent must process each new review within seconds of insertion. The developer needs the agent to be notified as soon as new items are written without polling. Which Cosmos DB feature should be implemented?

   • A. Schedule a recurring Azure Function to query Cosmos DB every 60 seconds for new items
   • B. Implement a change feed processor to detect and handle new or updated items(correct)
   • C. Configure Cosmos DB automatic indexing to trigger downstream notifications
   • D. Use Azure Synapse Link to push new items to a Synapse Analytics pipeline

   Explanation: The change feed processor provides a reliable, push-based mechanism to detect and react to new or updated items in Cosmos DB without polling, enabling near-real-time downstream processing. Polling with a timer-triggered Function (A) introduces unnecessary latency and resource usage. Automatic indexing (C) optimizes query performance, not event notification. Synapse Link (D) enables analytics over Cosmos DB data but adds latency and complexity compared to the change feed for real-time agent triggering.

9. 9. A developer is querying Azure Cosmos DB for NoSQL and finds that certain queries consume an unexpectedly high number of Request Units (RUs). The query filters on a property that is rarely searched. What is the most effective optimization?

   • A. Add the rarely-searched property to the Cosmos DB indexing policy to reduce RU consumption for that query(correct)
   • B. Set the Cosmos DB consistency level to Eventual to reduce RU consumption globally
   • C. Increase the provisioned throughput to absorb the excess RU cost without code changes
   • D. Move the rarely-searched data to a separate container with a lower consistency level

   Explanation: Optimizing indexing policies to include the filtered property reduces RU consumption for queries on that property, as Cosmos DB can use the index rather than performing a full scan. Lowering consistency (B) reduces replication overhead but does not optimize query RUs for an unindexed property. Increasing throughput (C) raises capacity limits but does not fix the underlying inefficiency. Moving data to a separate container (D) adds operational complexity and does not address the indexing root cause.

10. 10. A developer needs to store vector embeddings in Azure Database for PostgreSQL and perform semantic similarity searches using cosine distance. Which PostgreSQL extension should they use?

    • A. PostGIS — for geospatial data types and spatial queries
    • B. pgvector — for storing embeddings and running vector similarity search(correct)
    • C. pg_cron — for scheduling recurring PostgreSQL jobs
    • D. pg_trgm — for trigram-based text similarity search

    Explanation: pgvector is the PostgreSQL extension that adds vector data types and similarity search operators (cosine distance, L2 distance, inner product), making it the standard choice for storing and querying embeddings in PostgreSQL-based RAG solutions. PostGIS (A) handles geographic data. pg_cron (C) schedules jobs. pg_trgm (D) provides text-pattern-based fuzzy matching, not vector similarity.

11. 11. A developer is optimizing vector search performance on Azure Database for PostgreSQL for a high-throughput AI application. Which TWO actions reduce query latency and compute overhead for pgvector workloads? Choose 2.

    • A. Implement indexing strategies to optimize query latency and reduce pgvector compute overhead(correct)
    • B. Configure compute, memory, and storage resources to support vector workloads(correct)
    • C. Enable read replicas and route all vector queries to the primary instance
    • D. Disable auto-vacuum on the vectors table to reduce background I/O
    • E. Set the connection pool size to 1 to serialize all vector queries

    Explanation: Applying appropriate pgvector index types (such as HNSW or IVFFlat) reduces search latency and compute cost (A). Configuring adequate compute (vCores), memory, and storage ensures the database can load vector indexes into RAM and serve queries without I/O bottlenecks (B). Routing all queries to the primary (C) defeats the purpose of read replicas. Disabling auto-vacuum (D) can cause table bloat and degrade performance. A connection pool size of 1 (E) would serialize all requests, eliminating concurrency.

12. 12. An AI application uses Azure Managed Redis to cache LLM-generated responses keyed by the user's query hash. A new requirement states that cached entries must automatically expire after 10 minutes so users receive fresh responses. Which Redis feature addresses this?

    • A. Implement Azure Managed Redis data operations including caching, expiration, and invalidation(correct)
    • B. Configure Redis persistence (AOF) to write cache entries to disk
    • C. Use Redis Pub/Sub channels to notify consumers when responses are cached
    • D. Enable Redis cluster mode to distribute keys across multiple shards

    Explanation: Setting a TTL (Time To Live) on Redis keys implements automatic expiration — a standard Azure Managed Redis data operation. This ensures cached LLM responses expire after 10 minutes. Redis AOF persistence (B) controls data durability on disk, not cache expiry. Pub/Sub (C) enables messaging patterns, not automatic expiry. Cluster mode (D) improves throughput and capacity but does not address TTL-based expiration.

13. 13. An AI application needs to find semantically similar cached items in Azure Managed Redis — for example, retrieving a cached response for 'How do I reset my password?' when a user asks 'I forgot my password, what should I do?' Which Redis capability should be implemented?

    • A. Use Redis string GET/SET commands with exact key matching
    • B. Implement vector indexing in Azure Managed Redis to enable similarity search(correct)
    • C. Configure Redis Sorted Sets to rank cached responses by recency
    • D. Use Redis Streams to replay previous cached queries

    Explanation: Azure Managed Redis supports vector indexing (via the RediSearch/RedisVL module), enabling approximate nearest-neighbor search over embedding vectors so semantically similar queries can match cached responses. Exact key matching (A) only works when the query string is identical. Sorted Sets (C) rank items by a numeric score, not semantic similarity. Redis Streams (D) is a message log, not a semantic similarity search mechanism.

14. 14. A developer needs to build a reliable background job system for an AI application where tasks are distributed to multiple worker processes. Each task must be processed exactly once, and failed tasks must be retried. Which Azure messaging service should be used?

    • A. Azure Event Hubs — for high-throughput event streaming
    • B. Azure Service Bus — with queues, dead-letter queue handling, and topics/subscriptions(correct)
    • C. Azure Blob Storage event notifications
    • D. Azure API Management

    Explanation: Azure Service Bus queues provide at-most-once or at-least-once delivery guarantees, dead-letter queues for failed message handling, and topics/subscriptions for fan-out — making it the right choice for reliable background job distribution. Event Hubs (A) is optimized for high-throughput event streaming, not for competing consumer patterns with dead-letter queues. Blob Storage event notifications (C) trigger on file operations, not general task distribution. API Management (D) is an API gateway, not a message broker.

15. 15. An AI document processing pipeline writes results to Azure Blob Storage. Downstream services (an indexing service, an audit logger, and a notification service) all need to react when a new result is written. The events must be filtered so each subscriber only receives events relevant to its file type. Which Azure eventing service and feature should be implemented?

    • A. Configure Azure Service Bus queues with one queue per downstream service
    • B. Implement event-driven workflows by using Azure Event Grid, including filters, custom events, and retries(correct)
    • C. Use Azure Stream Analytics to process Blob Storage events
    • D. Schedule a Logic App to poll Blob Storage every minute for new files

    Explanation: Azure Event Grid supports event subscriptions with subject filters (e.g., by file extension or blob path prefix), fan-out to multiple subscribers, and automatic retries — perfectly matching the multi-subscriber, filtered routing requirement. Service Bus queues (A) would require manually routing messages to each queue and do not natively filter Blob Storage events by type. Stream Analytics (C) processes data streams for analytics, not for routing events to downstream services. A polling Logic App (D) introduces latency and wasted cycles when no new files exist.

16. 16. A developer is building a serverless AI inference endpoint that should scale to zero when idle and scale out on demand. The endpoint must be triggered by HTTP POST requests. Which Azure service and trigger type should be used?

    • A. Azure Container Apps with a scheduled revision
    • B. Build serverless APIs using Azure Functions with HTTP triggers and bindings(correct)
    • C. Azure Logic Apps with a recurrence trigger
    • D. Azure API Management with a mock policy

    Explanation: Azure Functions with HTTP triggers provides a fully serverless, scale-to-zero API endpoint that activates on HTTP POST requests. Bindings simplify connecting to other Azure services. Container Apps (A) can scale to zero but requires more infrastructure configuration than Azure Functions for a simple HTTP endpoint. Logic Apps (C) with a recurrence trigger runs on a schedule, not on HTTP request. API Management (D) is a gateway layer, not a compute service that executes inference logic.

17. 17. A team is designing an event-driven AI notification system using Azure Service Bus. They need messages that cannot be processed to be isolated for investigation, and they also need some messages to be broadcast to multiple independent consumers simultaneously. Which TWO Service Bus features satisfy these requirements? Choose 2.

    • A. Dead-letter queues for isolating messages that fail processing(correct)
    • B. Topics and subscriptions for broadcasting messages to multiple independent consumers(correct)
    • C. KEDA scaling to auto-scale consumers based on queue depth
    • D. Azure Functions timer trigger to retry dead-lettered messages on a schedule
    • E. Azure Event Grid custom topics to replace Service Bus topics

    Explanation: Dead-letter queues (A) are a native Service Bus feature that isolates messages that fail processing or exceed retry counts, making them available for investigation and replay. Topics and subscriptions (B) enable a publish-subscribe pattern where a single message is delivered to multiple independent subscriptions/consumers. KEDA (C) is a scaling mechanism, not a messaging feature. A timer-triggered Function (D) is a possible retry pattern but is not a built-in Service Bus feature. Event Grid (E) is a different eventing service and does not replace Service Bus topics in this context.

18. 18. A developer is deploying an Azure Functions app that runs AI document summarization. The app uses three different output bindings: Azure Cosmos DB, Azure Blob Storage, and Azure Service Bus. What does correctly configuring these bindings allow the developer to avoid?

    • A. Writing SDK connection code for each output target — bindings handle connection and serialization automatically(correct)
    • B. Paying for Azure Functions consumption — bindings are a free tier feature
    • C. Deploying the function app to a hosting plan — bindings enable local execution only
    • D. Creating managed identities — bindings use anonymous access by default

    Explanation: Azure Functions output bindings abstract away connection string management, SDK initialization, and serialization code — the developer simply configures the binding and returns the output object. Bindings are available at all pricing tiers, not just a free tier (B). Bindings work both locally and in deployed environments (C). Bindings still require authentication configuration; managed identities are the recommended approach (D).

19. 19. A developer needs to deploy an Azure Functions app for an AI workload. The app must always have at least one warm instance to eliminate cold start latency, and it needs predictable billing. Which hosting plan should be chosen?

    • A. Consumption plan — scales to zero when idle
    • B. Premium plan — keeps pre-warmed instances ready and provides predictable billing(correct)
    • C. Free tier App Service plan — no cost and no cold starts
    • D. Logic Apps Consumption plan — handles cold start by pre-scheduling execution

    Explanation: The Azure Functions Premium plan provides pre-warmed instances (eliminating cold starts), VNET integration, and predictable billing based on allocated compute. The Consumption plan (A) scales to zero, causing cold starts. The Free tier App Service plan (C) has compute quotas and no cold-start guarantee for Functions. Logic Apps (D) is a different service and its consumption plan does not address Azure Functions cold starts.

20. 20. An AI application needs to retrieve a database connection string and an API key at runtime from a centralized, auditable secrets store. Which Azure service should be used?

    • A. Azure Blob Storage — store secrets in a private container
    • B. Azure Key Vault — secure secrets retrieval with rotation support(correct)
    • C. Azure Table Storage — store key-value pairs for configuration
    • D. Azure Cosmos DB — store secrets as JSON documents

    Explanation: Azure Key Vault is the dedicated Azure service for securely storing, rotating, and auditing secrets, keys, and certificates. It integrates with managed identities for secretless access. Blob Storage (A), Table Storage (C), and Cosmos DB (D) are general-purpose data stores without built-in secret rotation, access auditing, or HSM-backed key protection.

21. 21. A developer wants to store feature flags and non-secret application settings (such as model endpoint URLs and inference parameters) in a centralized place that all deployed instances of an AI service can read, with support for dynamic configuration refresh without redeployment. Which Azure service should be used?

    • A. Azure Key Vault
    • B. Azure App Configuration(correct)
    • C. Azure Blob Storage with a settings.json file
    • D. Azure Cosmos DB with a configuration container

    Explanation: Azure App Configuration is designed for storing and managing application settings and feature flags centrally, with support for dynamic refresh (configuration changes propagate to running apps without redeployment). Key Vault (A) is for secrets — storing non-sensitive configuration there is unnecessary overhead. A settings.json in Blob Storage (C) requires manual refresh logic and has no built-in dynamic refresh. Cosmos DB (D) can store configuration but lacks built-in feature flag management and dynamic refresh integration.

22. 22. An AI application spans multiple microservices: an API gateway, a document ingestion service, and an LLM inference service. A request entering the API gateway triggers calls to both downstream services. The team wants to trace a single user request end-to-end across all three services to identify latency bottlenecks. Which approach should they implement?

    • A. Add print statements to each service and manually correlate timestamps from log files
    • B. Trace distributed systems by using OpenTelemetry SDKs to propagate trace context across services(correct)
    • C. Use Azure Monitor VM metrics to measure CPU usage across all services
    • D. Deploy Azure Sentinel to collect security logs from all services

    Explanation: OpenTelemetry SDKs propagate a trace context (trace ID and span ID) across service boundaries via HTTP headers or message metadata, allowing all spans from a single user request to be correlated in a distributed trace — the standard approach for microservice latency analysis. Manual log correlation (A) is error-prone and does not scale. VM CPU metrics (C) measure resource consumption, not request-level latency. Azure Sentinel (D) is a security information and event management (SIEM) tool, not a distributed tracing solution.

23. 23. A developer needs to query Azure Monitor Logs to find all HTTP 500 errors from an AI service in the last hour, and then calculate the error rate as a percentage of total requests. Which query language should they use?

    • A. SQL (T-SQL) executed via Azure SQL Database
    • B. KQL (Kusto Query Language) to analyze logs and metrics in Azure Monitor(correct)
    • C. SPARQL to query Azure Monitor as a semantic graph
    • D. Python pandas to query Azure Monitor REST API responses

    Explanation: KQL (Kusto Query Language) is the native query language for Azure Monitor Logs (Log Analytics) and is used to filter, aggregate, and compute metrics from log tables. T-SQL (A) is for relational databases, not Azure Monitor Logs. SPARQL (C) is for RDF graph databases, not Azure Monitor. While Python can query the Azure Monitor REST API (D), KQL is the purpose-built language for log analytics queries.

24. 24. An AI application's Azure Key Vault contains API keys that must be rotated every 90 days. The application must also be able to retrieve the current version of each key at runtime without code changes after rotation. Which TWO Azure Key Vault features support these requirements? Choose 2.

    • A. Configure automatic secret rotation in Azure Key Vault(correct)
    • B. Retrieve secrets by name (latest version) at runtime so the app automatically uses the rotated value(correct)
    • C. Export all secrets to Azure Blob Storage on a 90-day schedule
    • D. Hard-code secret versions in the application configuration file
    • E. Disable soft-delete to ensure old secret versions are permanently removed immediately after rotation

    Explanation: Automatic rotation (A) ensures Key Vault rotates secrets on the defined schedule without manual intervention. Retrieving secrets by name without pinning a version (B) ensures the app always fetches the latest rotated value at runtime without code changes. Exporting to Blob Storage (C) defeats the purpose of Key Vault's security controls. Hard-coding secret versions (D) requires a code change after every rotation, which breaks the requirement. Disabling soft-delete (E) is a security anti-pattern; soft-delete protects against accidental or malicious secret deletion.

25. 25. An AI platform team wants to store connection strings, model endpoint URLs, and feature flags so that all microservices can read them from a single source, with different values per environment (dev, staging, prod) and without requiring redeployment when a value changes. Which combination of Azure services covers both secrets and non-secret configuration with environment isolation?

    • A. Azure Key Vault for secrets and Azure App Configuration (with environment labels) for non-secret configuration and feature flags(correct)
    • B. Azure Blob Storage for all configuration, using separate containers per environment
    • C. Azure Cosmos DB for all configuration, using separate databases per environment
    • D. Azure Service Bus topics for distributing configuration updates to all microservices

    Explanation: Azure Key Vault handles secrets (connection strings, API keys) with rotation and audit logging, while Azure App Configuration handles non-secret settings and feature flags with environment labels that provide per-environment isolation and dynamic refresh. This combination is the recommended pattern for cloud-native configuration management. Blob Storage (B) and Cosmos DB (C) lack built-in secret protection, rotation, feature flag management, and dynamic refresh. Service Bus (D) is a messaging service, not a configuration store.