Updated Sep 02, 2026 Certification Exam AI-200 Dumps - Practice Test Questions [Q18-Q38]

Updated Sep 02, 2026  Certification Exam AI-200 Dumps - Practice Test Questions

Updated Verified AI-200 dumps Q&As - Pass Guarantee or Full Refund

NEW QUESTION # 18
You store embeddings in Redis by using keys formatted as doc:(id). Some embeddings are accessed frequently. Others are rarely used.
You need to implement a caching strategy that keeps only frequently accessed embeddings in memory.
What should you use?

• A. allkeys-lru
• B. EXPIRE command
• C. volatile-ttl
• D. time-window expiration

Answer: A

Explanation:
To implement this strategy, you should use allkeys-lru combined with the EXPIRE command as a secondary fallback.
Primary Mechanism: Configure your Redis maxmemory-policy to allkeys-lru.
Secondary Mechanism: Apply the EXPIRE command to your keys as a safety net.
Why allkeys-lru is the Best Choice
Memory Management: It automatically evicts the Least Recently Used (LRU) keys across your entire dataset when Redis hits its memory limit.
Frequent Access: It guarantees that frequently accessed embeddings stay in memory, regardless of when they were created.Prefix Independent: It scans all keys, making it perfect for your doc:(id) format Reference:
https://rahulchowdhury.in/blog/redis-caching-patterns-every-mern-dev

NEW QUESTION # 19
Hotspot Question
You plan to develop an Azure Functions app with an HTTP trigger.
The app must support the following functionality:
- Event-driven scaling
- Ability to use custom Linux images for function execution
You need to identify the app's hosting plan and the maximum amount of time that the app function can take to respond to incoming requests.
Which configuration setting values should you use? To answer, select the appropriate values in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: Premium
To fulfill your requirements, you should use the Azure Functions Premium plan (also known as the Elastic Premium plan).
Event-Driven Scaling: It features dynamic, automatic scale-out driven by the Azure scale controller. It can scale down to zero instances when idle, ensuring you only pay for active compute time.
Custom Linux Images: Unlike the base Consumption plan, the Premium plan allows you to deploy and run your functions inside a custom Linux container image. This lets you bring your own custom OS dependencies, specialized tools, or specific runtime environments.
Box 2: 230 seconds
The correct maximum timeout value to use for an HTTP-triggered function is 230 seconds.
Azure Load Balancer Limit: Regardless of the specific Azure Functions hosting plan or timeout configurations you set in host.json, the Azure Functions Scale and Hosting documentation states that an HTTP-triggered function has a hard limit of 230 seconds to respond to a request.
Idle Timeout: This constraint is strictly enforced due to the default idle timeout of the underlying Azure Load Balancer. If your function runs longer than 230 seconds without returning a response, the connection will be dropped, resulting in a timeout error.
Reference:
https://learn.microsoft.com/en-us/azure/azure-functions/functions-deployment-technologies
https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale

NEW QUESTION # 20
You need to give an Azure OpenAI-based agent the ability to call a company's internal REST API to check order status during a conversation. What should you implement?

• A. Function calling (tools) with a defined JSON schema
• B. Fine-tuning the model on order data
• C. Prompt flow variant testing
• D. Azure AI Search vector index over order records

Answer: A

Explanation:
Function calling lets you describe available functions/tools with a JSON schema; the model decides when to invoke them and with what arguments, and your application executes the actual API call and returns results to the model.

NEW QUESTION # 21
You deploy a production Azure Function app that connects to an Azure SQL Database.
The solution must provide the following functionality:
- Prevent secrets from being exposed in source control.
- Support secret rotation without redeploying the function app.
- Avoid downtime during credential updates.
You need to configure secure and maintainable secret management.
What should you configure?

• A. Parameter file stored in source control
• B. Hard-coded connection string in the startup class
• C. Environment variables in local.settings.json
• D. Application settings with Key Vault references

Answer: D

Explanation:
To meet all requirements, you should configure Application settings with Key Vault references.
Source Control Protection: The Function App source code and configuration files only store a reference URI (e.g., @Microsoft.KeyVault(SecretUri=...)) rather than the actual connection string, keeping secrets entirely out of source control.
Seamless Secret Rotation: Azure Key Vault handles secret rotation natively. When a database password changes, you simply update the secret in Key Vault.
Zero Downtime: By using versionless Key Vault references (omitting the specific version GUID from the URI), the Azure Function App will automatically fetch the latest secret version within 24 hours without requiring a code redeployment or app restart.
References:
https://oneuptime.com/blog/post/2026-02-16-how-to-configure-managed-identity-for-azure-app-service-to-access-key-vault-secrets-without-credentials/view

NEW QUESTION # 22
Drag and Drop Question
You are developing a .NET application that uses Azure Cosmos DB for NoSQL to store application data.
The application uses the Azure Cosmos DB for NoSQL SDK to interact with the database account.
The application must perform the following tasks:
- Initialize the connection by using the account endpoint and key.
- Define shared throughput.
- Perform create, read, update, and delete (CRUD) operations on items
stored in a container.
You need to implement the SDK components required for the application to access and manage data in Azure Cosmos DB for NoSQL.
Which SDK components should you use? To answer, move the appropriate components to the correct requirements. You may use each component once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: CosmosClient
To initialize the connection to an Azure Cosmos DB for NoSQL account using the account endpoint and key, you must use the CosmosClient class.
Box 2: Database
The database SDK component should be used to define shared throughput.
In Azure Cosmos DB, shared throughput (provisioned Request Units per second or RU/s) is configured at the database level. When throughput is provisioned on a database, that capacity is shared among all the containers created within that specific database.
Box 3: Container
To perform item create, read, update, and delete (CRUD) operations, you should use the Container SDK component In the Azure Cosmos DB for NoSQL SDK for .NET, individual JSON documents (items) live inside a container. The Container class exposes the specific methods required to execute CRUD operations on these items.
Reference:
https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-dotnet-get-started

NEW QUESTION # 23
Case Study 1 - Fabrikam Inc.
Background
Fabrikam Inc. is a global retail analytics company that provides AI-driven demand forecasting and product recommendation services to online retailers. The company is modernizing its solution to run entirely on Microsoft Azure.
The platform ingests transaction data, generates embeddings for semantic retrieval, performs vector similarity search, and returns product recommendations through containerized microservices. Developers use Python and Azure SDKs. Operations teams manage container orchestration, scaling, monitoring, and security.
The solution must meet strict performance, scalability, and security requirements.
Current environment
Application architecture
The Recommendation engine is a customer-facing HTTP API running as a containerized Python application. The engine is deployed to Azure Container Apps (ACA).
Embeddings are stored in Azure Database for PostgreSQL by using pgvector.
Semantic retrieval uses metadata filtering combined with vector similarity search.
Azure Managed Redis is used as a caching layer.
Front-end and API workloads are deployed to Azure Container Apps (ACA).
Batch model retraining workloads run in Azure Kubernetes Service (AKS).
Container and CI/CD
Container images are stored in Azure Container Registry (ACR).
CI/CD uses ACR Tasks to build images on commit.
ACA environments support revision management.
AKS workloads are deployed by using Kubernetes manifest files stored in Git.
Monitoring
Logs are collected in Azure Monitor.
Teams inspect container logs and Kubernetes events when troubleshooting.
Developers write KQL queries to analyze latency spikes.
Business requirements
Customer experience: Maintain a seamless, low-latency recommendation experience for end- users, even during unpredictable seasonal traffic spikes.
Operational cost efficiency: Minimize compute expenditures by deallocating resources during periods of inactivity and by preventing runaway scaling costs.
Data integrity and freshness: Ensure that product recommendations always reflect the most current catalog metadata and pricing to prevent customer dissatisfaction.
Security and compliance: Adhere to a Zero Trust security model by eliminating long-lived credentials and centralizing the management of all sensitive secrets.
Global scalability: Support the rapid ingestion of millions of new product embeddings daily without degrading query performance for existing retailers.
Technical requirements
Performance: Semantic search latency must remain under 200 milliseconds at peak load.
Database optimization: Use pgvector for embeddings and implement metadata filtering to reduce compute overhead. Configure compute and memory appropriately for vector workloads to ensure high-dimensional index residency in RAM and efficient mathematical throughput. Vector similarity calculations must be performed only against products that satisfy mandatory metadata constraints.
Database performance: Database connections must support high concurrency with minimal latency through the implementation of connection optimization.
Data load strategy: To ensure maximum ingestion throughput, secondary indexes must be applied only after bulk loading of embeddings is complete.
Caching: Redis cache entries must expire automatically after 10 minutes. Implement a reactive mechanism to invalidate cache entries upon metadata updates.
Identity: Use managed identities for all service-to-service and service-to-database authentication.
Plain-text credentials in configuration files are strictly prohibited.
Secret management: All secrets must be stored centrally. Secrets must be rotated automatically by using a centralized lifecycle policy.
Scaling: Use Kubernetes event-driven autoscaling (KEDA) for event-driven scaling. The Recommendation API must scale based on HTTP traffic, while batch jobs must scale based on queue length and support scale-to-zero.
CI/CD: All images must be stored in Azure Container Registry. Use ACR Tasks to automate image builds triggered by source code commits.
Monitoring: Use KQL to analyze performance telemetry and troubleshoot microservice connectivity failures. Inspect logs and events when troubleshooting AKS and ACA.
Drag and Drop Question
You need to configure the Redis integration for the Recommendation API.
Which configurations should you use? To answer, move the appropriate configurations to the correct requirements. You may use each configuration once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Scenario, Application: Azure Managed Redis is used as a caching layer.
Box 1: Configure the Time to Live (TTL) on each cache key
You must configure the Time to Live (TTL) on each cache key to meet this requirement. Azure Managed Redis (like standard Redis) does not support a global, database-wide default TTL configuration for newly created keys.
Scenario: Technical requirements: Caching: Redis cache entries must expire automatically after
10 minutes.
Box 2: Publish invalidation events to a Redis channel
Publishing invalidation events to a Redis Pub/Sub channel is a highly effective, standard architecture to invalidate cache entries across microservices or application nodes. It establishes a reactive, event-driven backplane that ensures system data integrity without requiring tight coupling between your database updates and web servers.
Scenario: Technical requirements: Implement a reactive mechanism to invalidate cache entries upon metadata updates.
Box 3: Implement the cache-aside pattern with lazy loading
To meet your search latency target for recurring product requests, you should implement the cache-aside pattern with lazy loading.
Directly reduces latency: Lazy loading ensures that frequently requested product data is kept in memory (Redis), allowing subsequent recurring requests to bypass the slower database completely.
Optimizes memory usage: Data is only loaded into the cache when actually requested, preventing your Azure Managed Redis instance from filling up with rarely accessed product data.
Reference:
https://learn.microsoft.com/en-us/azure/architecture/databases/architecture/write-through-caching-azure-sql-managed-redis
https://www.gigson.co/blog/what-is-redis-a-beginners-guide-to-in-memory-caching

NEW QUESTION # 24
You are evaluating a fine-tuned Azure OpenAI model against the base model before promoting it to production. Which Azure AI Foundry capability should you use?

• A. Azure Monitor Application Insights only
• B. Prompt flow bulk testing / evaluation with metrics (groundedness, coherence, relevance)
• C. Content Safety category configuration
• D. Azure AI Search indexer scheduling

Answer: B

Explanation:
Azure AI Foundry's evaluation tooling (often via prompt flow or the Evaluation SDK) runs bulk test sets against both models and scores outputs on metrics like groundedness, coherence, and relevance, enabling an objective comparison before promotion.

NEW QUESTION # 25
You deploy an AI application across multiple Azure regions.
The application must be able to view writes across all regions within a predictable time window.
You need to determine the appropriate consistency level.
What are two consistency levels you can use to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

• A. Bounded staleness
• B. Eventual
• C. Strong
• D. Session

Answer: A,C

Explanation:
The two appropriate consistency levels for a globally distributed AI application needing to view writes within a predictable time window are Bounded Staleness and Strong.
Bounded Staleness: This provides a guarantee that reads will lag behind writes by a user- specified "staleness window" (either in time or number of operations). It delivers high availability and predictable read consistency across all regions, balancing performance with strict read-order guarantees.
Strong: This provides linearizable and absolute consistency, ensuring that writes are seen synchronously across all regions. It features an exact zero-second predictable time window, though it comes at the expense of higher latency for multi-region operations due to the time required to replicate globally.
Reference:
https://learn.microsoft.com/en-us/azure/cosmos-db/consistency-levels

NEW QUESTION # 26
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen.
You are preparing a production deployment for an Azure Function app. The app will run across multiple environments.
The solution must support environment-specific configuration and prevent secrets from being stored in source control.
You need to develop the solution.
Solution: Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity.
Does the solution meet the goal?

• A. Yes
• B. No

Answer: A

Explanation:
Correct:
* Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity.
This is an industry-standard best practice architectural pattern.
Using Azure App Configuration combined with Azure Key Vault references completely satisfies your compliance requirements. It centralizes feature flags and non-sensitive configurations, keeps sensitive data safely out of source control, handles multi-environment deployments cleanly, and eliminates credentials via a passwordless Managed Identity.
Incorrect:
* Store connection strings in the Function app application settings configured in the Azure Portal.
* Store production secrets in environment variables set by the Dockerfile.
Reference:
https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references

NEW QUESTION # 27
Hotspot Question
A company uses Azure Monitor Application Insights to monitor application behavior, including incoming requests and dependencies.
You must identify failed requests from the last hour. You must also calculate the average duration of failed request dependency calls, grouped by operation name.
You need to analyze telemetry in Application Insights.
Which operators should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: where
Filter telemetry rows
The where operator filters a table to rows that satisfy a specific predicate. Both box 1 and box 2 require filtering telemetry data to the last hour (timestamp > ago(1h)).
Box 2: where
In the Kusto Query Language (KQL), the where operator filters a table to rows that satisfy a specific predicate or condition. Inside the inner subquery, you need to filter the dependencies telemetry table to only include records from the last hour (timestamp > ago(1)) Box 3: summarize Aggregate calculated data The summarize operator produces a table that aggregates the content of the input table. It is used here with the avg() aggregation function to calculate the average duration grouped by the operation_Name.
Reference:
https://tryhackme.com/room/kqlkustobasicqueries

NEW QUESTION # 28
Hotspot Question
You are reviewing the message-processing code in a backend worker service.
You review the following Python code that initializes and starts a Service Bus processor.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: No
No, messages are not removed from the queue as soon as they are received when using PEEK_LOCK mode.
How PEEK_LOCK Works
The Lock: The Service Bus processor locks the message exclusively for your worker for a specific duration.
The Invisible State: Other workers cannot see or process the message while the lock is active.
The Removal: The message is only permanently removed from the queue after it is successfully processed and explicitly completed.
Box 2: Yes
Yes, the message can be retried by another consumer if it fails due to a TransientServiceError.
Explicit abandonment: The code calls receiver.abandon_message(msg) when catching a TransientServiceError.
Lock release: Abandoning a message immediately releases the PEEK_LOCK held by the current worker.
Immediate availability: The message returns to the active queue and becomes instantly visible to other competing consumers.
Box 3: No
No, messages with invalid JSON payloads will not be retried until the maximum delivery count is reached. They will be sent to the dead-letter queue (DLQ) immediately on the very first attempt.
Immediate Dead-Lettering: The code catches the json.JSONDecodeError and explicitly calls receiver.dead_letter_message(msg).
Instant Termination: This API call tells Azure Service Bus to move the message to the DLQ right away, bypassing the normal delivery count logic.
No Re-delivery: Because the message is moved to the DLQ, the broker removes it from the main queue, stopping any further processing attempts.
Reference:
https://learn.microsoft.com/en-us/python/api/azure-servicebus/azure.servicebus.aio.servicebusreceiver
https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-queues

NEW QUESTION # 29
Case Study 1 - Fabrikam Inc.
Background
Fabrikam Inc. is a global retail analytics company that provides AI-driven demand forecasting and product recommendation services to online retailers. The company is modernizing its solution to run entirely on Microsoft Azure.
The platform ingests transaction data, generates embeddings for semantic retrieval, performs vector similarity search, and returns product recommendations through containerized microservices. Developers use Python and Azure SDKs. Operations teams manage container orchestration, scaling, monitoring, and security.
The solution must meet strict performance, scalability, and security requirements.
Current environment
Application architecture
The Recommendation engine is a customer-facing HTTP API running as a containerized Python application. The engine is deployed to Azure Container Apps (ACA).
Embeddings are stored in Azure Database for PostgreSQL by using pgvector.
Semantic retrieval uses metadata filtering combined with vector similarity search.
Azure Managed Redis is used as a caching layer.
Front-end and API workloads are deployed to Azure Container Apps (ACA).
Batch model retraining workloads run in Azure Kubernetes Service (AKS).
Container and CI/CD
Container images are stored in Azure Container Registry (ACR).
CI/CD uses ACR Tasks to build images on commit.
ACA environments support revision management.
AKS workloads are deployed by using Kubernetes manifest files stored in Git.
Monitoring
Logs are collected in Azure Monitor.
Teams inspect container logs and Kubernetes events when troubleshooting.
Developers write KQL queries to analyze latency spikes.
Business requirements
Customer experience: Maintain a seamless, low-latency recommendation experience for end- users, even during unpredictable seasonal traffic spikes.
Operational cost efficiency: Minimize compute expenditures by deallocating resources during periods of inactivity and by preventing runaway scaling costs.
Data integrity and freshness: Ensure that product recommendations always reflect the most current catalog metadata and pricing to prevent customer dissatisfaction.
Security and compliance: Adhere to a Zero Trust security model by eliminating long-lived credentials and centralizing the management of all sensitive secrets.
Global scalability: Support the rapid ingestion of millions of new product embeddings daily without degrading query performance for existing retailers.
Technical requirements
Performance: Semantic search latency must remain under 200 milliseconds at peak load.
Database optimization: Use pgvector for embeddings and implement metadata filtering to reduce compute overhead. Configure compute and memory appropriately for vector workloads to ensure high-dimensional index residency in RAM and efficient mathematical throughput. Vector similarity calculations must be performed only against products that satisfy mandatory metadata constraints.
Database performance: Database connections must support high concurrency with minimal latency through the implementation of connection optimization.
Data load strategy: To ensure maximum ingestion throughput, secondary indexes must be applied only after bulk loading of embeddings is complete.
Caching: Redis cache entries must expire automatically after 10 minutes. Implement a reactive mechanism to invalidate cache entries upon metadata updates.
Identity: Use managed identities for all service-to-service and service-to-database authentication.
Plain-text credentials in configuration files are strictly prohibited.
Secret management: All secrets must be stored centrally. Secrets must be rotated automatically by using a centralized lifecycle policy.
Scaling: Use Kubernetes event-driven autoscaling (KEDA) for event-driven scaling. The Recommendation API must scale based on HTTP traffic, while batch jobs must scale based on queue length and support scale-to-zero.
CI/CD: All images must be stored in Azure Container Registry. Use ACR Tasks to automate image builds triggered by source code commits.
Monitoring: Use KQL to analyze performance telemetry and troubleshoot microservice connectivity failures. Inspect logs and events when troubleshooting AKS and ACA.
Hotspot Question
You need to optimize secure database connectivity from the containerized Recommendation API.
How should you configure the application? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: Use managed identity authentication.
Scenario: Identity: Use managed identities for all service-to-service and service-to-database authentication. Plain-text credentials in configuration files are strictly prohibited.' Box 2: Use a connection pooling library Scenario: Environment: Embeddings are stored in Azure Database for PostgreSQL by using pgvector.
To support high-concurrency requests with minimal latency on Azure Database for PostgreSQL, the best action is to use a connection pooling library (or leverage Azure's built-in PgBouncer feature).
Eliminates Connection Overhead:
PostgreSQL utilizes a process-per-connection model. Forking a new backend process for every incoming request introduces substantial CPU and memory overhead, severely degrading latency under high concurrency. A connection pool keeps a warm set of reusable database sessions active.
Optimized for Azure: Microsoft provides a built-in managed PgBouncer integration for Azure Database for PostgreSQL. Enabling it in transaction mode allows the database to accept thousands of concurrent client connections while keeping actual backend processes lean and stable Box 3: Configure a maximum pool size Configure a maximum pool size is the best action to directly protect database stability during sudden traffic spikes.
Prevents Resource Exhaustion: Traffic spikes naturally lead to a surge in connection requests.
Unchecked connections consume substantial RAM and CPU overhead, which can crash the database or trigger severe latency. Limiting the pool size stops the "thundering herd" problem Acts as a Shock Absorber: When the pool hits its maximum limit, extra client requests are safely queued at the application or connection pooling layer (like Azure's built-in PgBouncer proxy) rather than overwhelming the database backend Reference:
https://docs.azure.cn/en-us/postgresql/connectivity/concepts-pgbouncer
https://learn.microsoft.com/en-au/answers/questions/5884412/best-practise-azure-postgresql-flexible-server-max

NEW QUESTION # 30
Your chat application calls Azure OpenAI Service. You need to prevent the model from returning content that promotes self-harm, even if the prompt is crafted to bypass instructions. What should you configure?

• A. A lower max_tokens value
• B. A system message instructing the model to refuse harmful topics
• C. Azure AI Content Safety filters on the Azure OpenAI resource
• D. Azure AI Search semantic ranking

Answer: C

Explanation:
System messages can be circumvented by adversarial prompting. Content Safety filters operate independently of the model and inspect both input and output, blocking harmful categories (including self-harm) regardless of prompt engineering.

NEW QUESTION # 31
Hotspot Question
You deploy a Linux container image to App Service.
The container requires the following environment variables at runtime:
- A non-sensitive configuration value named MODEL_VERSION
- A database password that must remain secure
You need to configure App Service to provide these environment variables at runtime.
Which configurations should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: App setting with plain text value
To provide a non-sensitive environment variable named MODEL_VERSION to a Linux custom container deployed to Azure App Service, you should configure it as an Application Setting (App Setting). In Azure App Service, any custom configuration defined within the Application Settings is automatically injected into Linux containers as an environment variable at runtime.
Box 2: Key Vault reference syntax
You should configure the database password as an Azure Key Vault reference inside App Service Application Settings. This prevents the secret from being stored in plaintext in the app configuration and injects it securely into the container as an environment variable at runtime.
Reference:
https://learn.microsoft.com/en-us/azure/app-service/tutorial-custom-container?tabs=azure-cli&pivots=container-linux

NEW QUESTION # 32
You are developing an AI API deployed to ACA. The API requires database credentials that are stored in Key Vault. Key Vault is configured to use Azure RBAC for access control.
The database credentials are rotated periodically by the security team. The application must always use the latest version of each credential without being redeployed and without exposing secrets in code or configurations.
You need to implement a secure secret access strategy that prevents credential exposure and fetches the latest version of each secret at runtime without redeploying the container.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A. Retrieve the secret at runtime by using the SDK.
• B. Configure a Key Vault RBAC role assignment.
• C. Configure a Key Vault access policy.
• D. Assign a system-assigned managed identity.
• E. Export the secret during deployment.

Answer: A,B,D

Explanation:
Step-by-Step Implementation Guide
1. Assign a System-Assigned Managed Identity
2. Configure Key Vault RBAC Role Assignment
Role Selection: Assign the Key Vault Secrets User role to the container app's managed identity.
Scope Limitation: Limit the scope of this assignment to the specific Key Vault or individual secrets rather than the entire resource group.
3. Retrieve the Secret at Runtime Using the SDK
Reference:
https://oneuptime.com/blog/post/2026-02-16-how-to-use-managed-identity-with-azure-container-apps-to-access-azure-services/view

NEW QUESTION # 33
Case Study 2 - Proseware Inc.
Background
Proseware Inc. develops AI-powered knowledge management solutions for enterprise customers.
The company is modernizing its platform to support semantic search, intelligent document retrieval, and real-time partner integrations.
The engineering team uses Python and Azure SDKs. The architecture is being redesigned to support containerized microservices, vector search workloads, and serverless backend processing.
Planned Application Architecture
Microservices are containerized by using Docker.
Code for containerized microservices and Azure Function apps is developed locally but stored in a GitHub repository.
Custom images for containerized microservices are stored in Azure Container Registry (ACR).
Base images are stored in Docker Hub. Custom images must be rebuilt automatically whenever their base images are updated.
Azure Cosmos DB for NoSQL stores documents, metadata, and vector embeddings.
Azure Functions generate vector embeddings of Azure Cosmos DB for NoSQL-hosted documents and send messages to Service Bus to trigger search index updates.
Azure Container Apps (ACA) apps host backend API services that provide semantic search across Azure Cosmos DB for NoSQL documents. API services process Service Bus messages and update search indexes.
Azure Kubernetes Service (AKS) processes batch vector embedding regeneration for existing Azure Cosmos DB for NoSQL documents (whenever the embedding model is changed).
An extranet-facing containerized webhook allows business partners to submit documents to be processed by internal AI workflows for semantic search and retrieval.
Monitoring
Telemetry generated by Azure resources is sent to Azure Monitor.
A Log Analytics workspace is used to collect ACA apps logs, AKS container logs, and Azure Functions apps logs.
Monitoring of Azure Functions is currently implemented by using Azure Application Insights SDK instrumentation.
Business Requirements
Embeddings for new or updated Azure Cosmos DB for NoSQL-hosted documents must be automatically generated.
Backend API services must scale automatically during business hours.
Cold start delay of backend APIs must be minimized.
Secrets must be stored outside of container images.
Developers must be able to correlate telemetry across Azure Functions hosts and apps.
All tracing must be implemented by using OpenTelemetry SDK instrumentation.
Development efforts must be minimized.
Technical Requirements
Container images must be built automatically and validated before code updates are merged into the main branch.
Image build automation must run inside the Azure Container Registry, eliminating dependency on local developer machines and external build services.
Dependency of image builds on local developer machines must be eliminated.
Event-driven scaling in ACA must occur based on the number of pending messages in the Azure Service Bus queue.
Azure Cosmos DB for NoSQL RU consumption must be minimized.
Vector similarity search must use embeddings stored in Azure Cosmos DB for NoSQL.
The partner-facing containerized webhook service must run on Azure App Service.
Secrets must NOT be stored in container images, source control, or application configuration directly. They must be accessed securely at runtime.
All secrets must be stored centrally in Azure Key Vault and accessed at runtime through a managed identity.
Azure App Service must supply secrets at runtime without relying on external services.
Resources and workloads must be deployed by using Bicep templates through an automated, version-controlled pipeline. Local and command-line deployments must be eliminated to ensure repeatable, auditable deployments.
Known Issues
RU consumption spikes during vector similarity queries.
Drag and Drop Question
You need to implement trace correlation according to the business requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

Answer:

Explanation:

Explanation:
Scenario, Business Requirements
All tracing must be implemented by using OpenTelemetry SDK instrumentation.
Development efforts must be minimized.
Step 1: Instrument the application code by using OpenTelemetry SDK
This adds the foundational tracking APIs to your code so it can create and capture trace spans.
Step 2: Configure a trace exporter in the OpenTelemetry SDK
This instructs the initialized SDK where to transmit the captured trace data (e.g., to a local console or a cloud backend).
Step 3: Redeploy the instrumented services
This pushes the modified codebase and configuration changes into your active runtime environment.
Reference:
https://opentelemetry.io/docs/languages/python/instrumentation/

NEW QUESTION # 34
An AI platform uses App Configuration for feature flags and endpoint routing.
The platform stores secrets alongside configuration data and does NOT support dynamic refresh.
The solution must support dynamic configuration refresh while ensuring that secrets are NOT stored in App Configuration.
You need to enable secure dynamic configuration management for the platform.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

• A. Allow configuration updates with a polling interval.
• B. Use a service principal secret for both App Configuration and Key Vault access.
• C. Store API keys in Key Vault.
• D. Store configuration values in environment variables.
• E. Use managed identity for both App Configuration and Key Vault access.

Answer: A,C,E

Explanation:
[A]
Setting up a cache expiration or polling interval enables the application to detect configuration changes periodically without restarting, fulfilling the requirement for dynamic refresh.
[B]
Using Azure Managed Identities eliminates hardcoded credentials. It allows your application to securely authenticate to both Azure App Configuration and Azure Key Vault.
[C]
Moving API keys to Azure Key Vault adheres to security best practices. Azure App Configuration can reference these secrets securely using Key Vault references, ensuring secrets are never stored as plaintext in the configuration store.
Reference:
https://smartbridge.com/azure-ai-foundry-enterprise-guide-2/

NEW QUESTION # 35
Case Study 1 - Fabrikam Inc.
Background
Fabrikam Inc. is a global retail analytics company that provides AI-driven demand forecasting and product recommendation services to online retailers. The company is modernizing its solution to run entirely on Microsoft Azure.
The platform ingests transaction data, generates embeddings for semantic retrieval, performs vector similarity search, and returns product recommendations through containerized microservices. Developers use Python and Azure SDKs. Operations teams manage container orchestration, scaling, monitoring, and security.
The solution must meet strict performance, scalability, and security requirements.
Current environment
Application architecture
The Recommendation engine is a customer-facing HTTP API running as a containerized Python application. The engine is deployed to Azure Container Apps (ACA).
Embeddings are stored in Azure Database for PostgreSQL by using pgvector.
Semantic retrieval uses metadata filtering combined with vector similarity search.
Azure Managed Redis is used as a caching layer.
Front-end and API workloads are deployed to Azure Container Apps (ACA).
Batch model retraining workloads run in Azure Kubernetes Service (AKS).
Container and CI/CD
Container images are stored in Azure Container Registry (ACR).
CI/CD uses ACR Tasks to build images on commit.
ACA environments support revision management.
AKS workloads are deployed by using Kubernetes manifest files stored in Git.
Monitoring
Logs are collected in Azure Monitor.
Teams inspect container logs and Kubernetes events when troubleshooting.
Developers write KQL queries to analyze latency spikes.
Business requirements
Customer experience: Maintain a seamless, low-latency recommendation experience for end- users, even during unpredictable seasonal traffic spikes.
Operational cost efficiency: Minimize compute expenditures by deallocating resources during periods of inactivity and by preventing runaway scaling costs.
Data integrity and freshness: Ensure that product recommendations always reflect the most current catalog metadata and pricing to prevent customer dissatisfaction.
Security and compliance: Adhere to a Zero Trust security model by eliminating long-lived credentials and centralizing the management of all sensitive secrets.
Global scalability: Support the rapid ingestion of millions of new product embeddings daily without degrading query performance for existing retailers.
Technical requirements
Performance: Semantic search latency must remain under 200 milliseconds at peak load.
Database optimization: Use pgvector for embeddings and implement metadata filtering to reduce compute overhead. Configure compute and memory appropriately for vector workloads to ensure high-dimensional index residency in RAM and efficient mathematical throughput. Vector similarity calculations must be performed only against products that satisfy mandatory metadata constraints.
Database performance: Database connections must support high concurrency with minimal latency through the implementation of connection optimization.
Data load strategy: To ensure maximum ingestion throughput, secondary indexes must be applied only after bulk loading of embeddings is complete.
Caching: Redis cache entries must expire automatically after 10 minutes. Implement a reactive mechanism to invalidate cache entries upon metadata updates.
Identity: Use managed identities for all service-to-service and service-to-database authentication.
Plain-text credentials in configuration files are strictly prohibited.
Secret management: All secrets must be stored centrally. Secrets must be rotated automatically by using a centralized lifecycle policy.
Scaling: Use Kubernetes event-driven autoscaling (KEDA) for event-driven scaling. The Recommendation API must scale based on HTTP traffic, while batch jobs must scale based on queue length and support scale-to-zero.
CI/CD: All images must be stored in Azure Container Registry. Use ACR Tasks to automate image builds triggered by source code commits.
Monitoring: Use KQL to analyze performance telemetry and troubleshoot microservice connectivity failures. Inspect logs and events when troubleshooting AKS and ACA.
You need to improve throughput for concurrent application requests to PostgreSQL. What should you implement?

• A. Increase shared_buffers.
• B. Enable read replicas.
• C. Implement connection pooling.
• D. Increase max_connections.

Answer: C

Explanation:
To improve throughput for highly concurrent application requests in this architecture, you should implement connection pooling.
PostgreSQL follows a process-based architecture where each client connection spawns a separate backend process. This consumes significant memory and CPU overhead during high concurrency. Connection pooling (using tools like PgBouncer or Azure's built-in pooler) allows containerized microservices to reuse a fixed set of database connections. This drastically reduces connection overhead, prevents database exhaustion, and maximizes throughput for short, rapid API queries like vector similarity searches.
Reference:
https://medium.com/@srajanpathak45/a-principal-engineers-guide-to-postgresql-and-modern-alternatives-e8920fd6269a

NEW QUESTION # 36
A large retail company operates online and physical stores. The company tracks inventory levels in real time to manage stock efficiently across all locations. You develop an Azure Event Grid solution to handle events generated by the inventory management system deployed to Azure.
You need to implement a subscription filter that dynamically adjusts to seasonal changes in product demand.
Which event filter should you use?

• A. A subscription filter that uses a label filter to include events tagged with seasonal promotional codes
• B. A static subject filter that targets events with a subject ending in "/seasonal/inventory"
• C. A prefix filter on the event type field that matches the current season's name
• D. An advanced filter using a Boolean condition that evaluates multiple data fields, including a season field within the event data

Answer: D

Explanation:
To handle dynamic, seasonal changes in product demand within Azure Event Grid, you should use Advanced Filters with a string or numeric comparison that evaluates event data attributes, typically paired with an automated external process (like an Azure Function or Logic App) to dynamically update the subscription filter rules via the Event Grid management API as seasons change Reference:
https://techcommunity.microsoft.com/blog/analyticsonazure/a-technical-implementation-guide-for-multi-store-retail-environments/4488418

NEW QUESTION # 37
Hotspot Question
You have an Azure Service Bus namespace that contains a topic named Topic1.
You plan to create a subscription named Sub1 to Topic1. In Sub1, you plan to filter messages from Topic1 based on their system properties and apply an action that will annotate each filtered message.
You need to configure the filtering.
How should you configure the filtering? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Answer:

Explanation:

Explanation:
Box 1: Use the SQL type.
To achieve this goal, you must use a SQL filter (also known as a SqlFilter) type Box 2: Copy a message and annotate its metadata.
The correct filtering action to use is to copy a message and annotate its metadata.
When an action is applied (such as setting a new property or modifying an existing one via SQL filter actions), Azure Service Bus creates a copy of the inbound message for the subscription and annotates the copy's metadata.
Reference:
https://turbo360.com/blog/azure-service-bus-topic-filter

NEW QUESTION # 38
......

Exam Engine for AI-200 Exam Free Demo & 365 Day Updates: https://www.realvalidexam.com/AI-200-real-exam-dumps.html