Practice Free AI-200 Developing AI Cloud Solutions on Azure Exam Questions Answers With Explanation

Detailed Explanation: GitHub Actions is the correct orchestration mechanism among the options because the case requires an automated, version-controlled pipeline and Bicep-based declarative deployment. Microsoft documents GitHub Actions as a supported way to deploy Bicep and automate Azure resource deployment. Local Git, Azure Functions Core Tools, and Azure CLI can participate in development or scripted deployment, but they do not by themselves satisfy the stated requirement for a repository-driven, repeatable CI/CD pipeline.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Deploy Bicep with GitHub Actions | Automate Function app resource deployment

Detailed Explanation: Azure Key Vault references in App Service settings satisfy the requirement to keep secrets out of container images, source control, and directly stored application configuration. App Service resolves the referenced secret at runtime by using the app identity, so the application can consume the value as a normal setting without embedding credentials in the image. GitHub secrets are build/deployment secrets rather than a runtime App Service secret-delivery mechanism. Dockerfile ENV instructions would place secret material in the image configuration and violate the case requirements.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Use Key Vault references for App Service and Functions | Managed identities for Azure resources

Verified Answer: 1) Instrument the application code with the OpenTelemetry SDK; 2) configure an Azure Monitor trace exporter in the OpenTelemetry SDK; 3) redeploy the instrumented services.

Detailed Explanation: Trace correlation requires the application to create OpenTelemetry spans and an exporter to send those spans to Azure Monitor. Instrumentation must therefore be present before the updated service is deployed. The previous Application Insights SDK instrumentation does not satisfy the case-study requirement that all tracing use OpenTelemetry. Configuring an OpenTelemetry view is unrelated to basic distributed-trace export, and calling TrackEvent is an Application Insights SDK pattern rather than the required OpenTelemetry approach.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Enable Azure Monitor OpenTelemetry

Detailed Explanation: The objective is to reduce RU consumption from vector similarity queries. Microsoft guidance identifies vector numeric precision and vector-index selection as major cost and performance levers. Using a lower supported vector precision can reduce storage and processing cost, while quantizedFlat and DiskANN are designed to reduce latency and RU consumption compared with flat search for appropriate data sizes. Strong consistency would increase resource cost rather than solve vector-search efficiency. A regular composite index is not a substitute for the vector index. Option B should be read as reducing vector numeric precision, not changing a generic “indexing precision” setting.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Vector search in Azure Cosmos DB | Optimize Cosmos DB vector search performance

Trigger for container images build: Base image update

Implementation of image builds: ACR Task

The correct trigger is Base image update because Proseware requires every custom container image to be rebuilt automatically whenever its Docker Hub base image changes. Azure Container Registry Tasks can detect base-image dependencies from the Dockerfile FROM instruction and automatically trigger a rebuild when that base image is updated. Microsoft confirms that ACR Tasks can track base images in public repositories such as Docker Hub and Microsoft Container Registry, as well as images stored in Azure Container Registry.

The build implementation must be an ACR Task . This directly satisfies the technical requirement that image-build automation run inside Azure Container Registry , eliminating dependencies on local developer machines or separate external build services. ACR Tasks provides cloud-based container building and can automate builds based on source-code commits, base-image updates, or scheduled triggers.

A GitHub workflow could orchestrate CI/CD, but using it as the actual image-building implementation would conflict with the explicit requirement that builds execute inside ACR. Docker Compose defines multi-container applications; it is not the native ACR build automation mechanism. A Commit trigger addresses source changes rather than the stated base-image update requirement, while Scheduled builds would introduce unnecessary periodic execution.

Study Guide references: Azure Container Registry Tasks; base-image dependency tracking; automated rebuilds; Docker Hub base-image triggers; cloud-native container builds.

Use GitHub Actions because Proseware requires an automated, version-controlled deployment pipeline and explicitly prohibits local and command-line deployments. Microsoft documents GitHub Actions as a supported CI/CD mechanism for Azure Functions: a workflow stored under .github/workflows can build and deploy Function app code automatically in response to repository events such as pushes or pull requests. The Azure Functions deployment action can deploy the application package directly to the target Function app.

GitHub Actions also satisfies the infrastructure requirement. Microsoft provides first-class support for deploying Bicep templates through GitHub Actions , enabling Azure resources to be provisioned declaratively from the same source-controlled pipeline. A pull-request workflow can perform validation or Bicep what-if analysis before changes are merged, while a main-branch workflow can perform the actual deployment after approval. This provides repeatability, auditing, and separation from individual developer machines.

Azure Functions Core Tools and Azure CLI are commonly used for interactive/local deployments, which directly conflicts with the requirement to eliminate command-line deployment. Local Git deployment also fails the requirement for a centrally automated Bicep-based deployment process.

Study Guide references: Azure Functions CI/CD; GitHub Actions; infrastructure as code with Bicep; automated Azure deployments; version-controlled deployment workflows.

Verified Answer: Identify document changes: Change feed processor. Scale out vectorization processing: Lease container.

Detailed Explanation: The change feed processor is designed to react to inserts and updates in a monitored Cosmos DB container, which directly matches the requirement to generate embeddings for new or changed documents. Its lease container stores processing state and coordinates work across multiple workers, allowing the processing workload to scale out without duplicating ownership of change-feed ranges. A periodic full scan would consume unnecessary RUs, and neither strong consistency nor container RU throughput is the coordination mechanism for distributed change-feed workers.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Azure Cosmos DB change feed processor

Comply with the authentication policy for database access: Use managed identity authentication.

Support high-concurrency requests with minimal latency: Use a connection pooling library.

Protect database stability during traffic spikes: Configure maximum pool size.

The Recommendation API should use managed identity authentication because Fabrikam explicitly requires service-to-database authentication without long-lived credentials. Azure Container Apps managed identities allow applications to obtain Microsoft Entra tokens at runtime and access supported Azure resources without storing usernames, passwords, or connection secrets in application configuration.

For high-concurrency PostgreSQL access, implement a connection pooling library . Azure Database for PostgreSQL documentation recommends connection pooling because repeatedly opening new database connections creates backend processes and consumes CPU and memory. Reusing existing connections reduces connection-establishment overhead and improves latency and throughput. Azure also provides PgBouncer as a built-in pooling option for Flexible Server.

To protect PostgreSQL during sudden traffic spikes, configure a maximum pool size . An unlimited pool can allow application demand to create excessive concurrent connections, which can exhaust database memory and increase contention. Microsoft warns that increasing connection counts can cause significant performance degradation and recommends conservative connection limits combined with pooling.

Therefore, the optimal configuration combines managed identity + connection pooling + bounded pool size .

Study Guide references: Azure Container Apps managed identities; Azure Database for PostgreSQL connection management; PgBouncer; connection-pool sizing and resource protection.

Service fails to communicate with another service: Inspect Kubernetes service endpoints.

Pod restarts repeatedly: Inspect container logs.

Readiness probe failures are observed: Inspect Pod descriptions.

For a service-to-service communication failure , first inspect the Kubernetes service endpoints . Microsoft’s AKS troubleshooting guidance recommends verifying that the destination pod IP address and application port appear as endpoints for the Kubernetes Service. An empty or incorrect endpoint list commonly indicates a selector/label mismatch, incorrect port configuration, or unavailable backend pods.

For a pod that restarts repeatedly , inspect the container logs , including the previous container instance when necessary. Microsoft specifically recommends kubectl logs < pod > --previous for workloads that repeatedly restart because it exposes application errors and termination messages from the container immediately before the restart.

For readiness probe failures , inspect the Pod description by using kubectl describe pod. The description exposes the configured health probes, pod conditions, container state, and associated probe-failure events, allowing you to determine whether the probe path, port, timing, or application readiness behavior is incorrect. Microsoft recommends reviewing kubectl describe output when pods are not Ready or health probes are failing.

Therefore, the correct mapping is service endpoints ? container logs ? Pod descriptions .

Study Guide references: AKS troubleshooting; Kubernetes Services and endpoints; container logging; Pod health; readiness/liveness probes; kubectl describe and kubectl logs.

The applicable Azure OpenAI control is Modified Abuse Monitoring . Microsoft documents that customers processing highly sensitive or confidential information can apply to modify the normal abuse-monitoring process when they cannot permit Microsoft to store or conduct human review of prompts and completions. Approval is subject to Microsoft ' s Limited Access eligibility requirements and must be requested through the designated Microsoft process.

For approved configurations, the abuse-monitoring treatment of prompts and completions is modified so that normal human review does not occur. Microsoft guidance on zero-data-retention scenarios specifically directs eligible customers to request Modified Abuse Monitoring rather than attempting to achieve the requirement by disabling unrelated telemetry services.

Disabling Azure Monitor does not change Azure OpenAI ' s service-side abuse-monitoring policy; it only affects customer-configured operational telemetry. Changing the model version likewise has no direct effect on retention requirements. Storing application data in Cosmos DB controls the application ' s own persistence layer and does not govern Azure OpenAI service processing.

Therefore, among the available choices, A is the required action. More precisely, the relevant request is Modified Abuse Monitoring ; modified content filtering/Guardrails is a separate control unless the organization also requires changes to safety filtering.

Study Guide references: Azure OpenAI ? Data privacy and security; Abuse monitoring; Modified Abuse Monitoring; Limited Access requirements.

===============

A retrieval-augmented generation (RAG) architecture is the correct mechanism when generated answers must be traceable to specific source documents. RAG first retrieves relevant document chunks from a search index or other knowledge source, supplies those chunks to the language model as grounding context, and then generates an answer based on that retrieved information. Microsoft specifically documents that RAG enables responses containing citations back to source content .

For reliable citation generation, each retrieved chunk should carry identifying metadata such as a source identifier, document title, section, page, or URL . Microsoft’s Azure RAG guidance recommends labeling retrieved chunks and including source metadata with them, then explicitly instructing the model to cite the corresponding sources in its response. This allows users to verify individual claims against the underlying documents.

Modern Azure AI Search agentic retrieval can also return structured references and grounding metadata , specifically designed for citation linking.

Increasing top_p only alters token sampling. Content filtering addresses safety, not provenance. Using a base model without retrieval provides no authoritative document linkage.

Study Guide references: RAG architecture; grounding data; retrieval metadata; Azure AI Search references; prompt engineering for citations.

Detailed Explanation: Deferral is intended for a message that cannot be processed now because a particular dependency is temporarily unavailable, while the application wants to keep the message in the main queue for later retrieval by sequence number. Complete would permanently remove it, dead-letter would move it aside as a failed message, and abandon immediately releases the lock for redelivery. Deferral therefore best matches the requirement to postpone the individual message while keeping it available for deliberate later processing.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Service Bus message deferral | Service Bus message transfers, locks, and settlement

Detailed Explanation: System topics represent events emitted by Azure services and are not the correct resource for an application publishing its own hundreds of event types to thousands of customers through one custom endpoint. Event Grid domains are intended for exactly this type of application-level multi-tenant topic organization and expose one publishing endpoint for many topics. Therefore a system topic with a subscription per customer does not satisfy the stated publishing model, even though Event Grid supports filtering and secure delivery in other contexts.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Azure Event Grid event domains

Verification completed using official Microsoft Learn sources only. Original exhibits have been retained unchanged.

Detailed Explanation: An HTTP trigger is the only option that directly accepts a synchronous external request and can return a response immediately to the caller. Azure Functions uses HTTP triggers to implement serverless APIs and webhooks, while Microsoft Entra authentication can be applied to the Function App or API surface. Queue, Event Grid, and Service Bus triggers are asynchronous event-processing mechanisms and do not provide the request/response semantics required by this public API scenario.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Azure Functions HTTP trigger

Use where , join , and summarize .

The where operator filters telemetry to the required scope, including records from the last hour and failed requests. For example, a predicate can restrict timestamp > ago(1h) and request success status in the same filtering expression.

Next, use join to correlate request telemetry with dependency telemetry. Application Insights assigns related telemetry a common operation_Id , and Microsoft specifically demonstrates joining the dependencies and requests tables on operation_Id to identify dependency calls associated with requests.

Finally, use summarize with avg(duration) grouped by the appropriate operation identifier or operation name. summarize performs aggregation over groups and is therefore the required operator for calculating average dependency duration. Microsoft documents dependency duration as supporting an Avg aggregation.

extend is unnecessary because no derived column is required, while distinct merely removes duplicate rows and cannot calculate averages or correlate two telemetry tables.

A representative structure is:

requests

| where timestamp > ago(1h) and success == false

| join (dependencies | where timestamp > ago(1h)) on operation_Id

| summarize avg_dependency_duration = avg(duration1) by operation_Name

Study Guide references: Azure Monitor Application Insights; KQL where; telemetry correlation using operation_Id; join; summarize; dependency duration analysis.

Use Azure AI Speech Custom Neural Voice . Microsoft describes custom voice as a text-to-speech capability for creating a unique synthetic voice for a product, brand, or character rather than selecting one of the standard voices provided by the Speech service. The organization supplies authorized voice recordings and corresponding scripts, and the custom voice workflow creates a voice model that can subsequently be deployed and consumed through Speech text-to-speech functionality.

This directly satisfies the requirement that the voice be distinct from the standard neural voice catalog. Prebuilt neural voices are high-quality, ready-to-use voices supplied by Microsoft, but they do not create a company-specific branded voice. Microsoft explicitly differentiates standard voices from custom voices and identifies custom voice as the mechanism for creating a voice unique to a brand.

Custom Neural Voice is a Limited Access capability. Organizations must meet Microsoft ' s eligibility and responsible-AI requirements, including obtaining appropriate consent from voice talent and receiving access approval for the intended use case.

Azure AI Language sentiment analysis evaluates text sentiment, while Azure AI Translator performs language translation. Neither creates a custom text-to-speech voice.

Study Guide references: Azure AI Speech ? text-to-speech; Custom Neural Voice; voice model creation; branded synthetic voices; responsible AI and Limited Access.

===============

Verified Answer: Yes; Yes; No.

Detailed Explanation: The get_secret call supplies an explicit version value, so it retrieves that particular version of dbPassword. DefaultAzureCredential can authenticate to Key Vault by using the Azure-hosted application’s managed identity without embedding a client secret in the application. Because the code requests a fixed version, later secret rotation creates a newer version but subsequent executions of this exact code continue to request the specified old version. To follow the latest version automatically, the version parameter must be omitted.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Managed identities for Azure resources | Use Key Vault references for App Service and Functions