AI-200 practice questions with answers

Answer: A) No resource consumption charges, because the revision is scaled to zero replicas

On the Consumption plan, you pay for resources allocated to running replicas. A revision scaled to zero (minimum replicas = 0) incurs no resource consumption charges; idle rates apply only when the minimum replica count is greater than zero.

• ACorrect. In the Consumption plan, you are charged only while replicas are running. According to the billing documentation, no resource consumption charges are incurred while a revision is scaled to zero replicas.
• BIncorrect. Idle-rate billing applies only when the minimum replica count is greater than zero and the revision is scaled to that minimum. With a minimum of 0 and no running replicas, there is nothing to bill.
• CIncorrect. Container Apps supports scaling to zero replicas when the minimum replica count is 0, so the app is not forced to keep one replica running.
• DIncorrect. Billing per workload profile instance applies to the Dedicated plan. Consumption plan billing is based on vCPU-seconds and GiB-seconds allocated to running replicas, plus HTTP requests.

Answer: A) A liveness probe that checks an endpoint that fails when the app is stuck

Liveness probes are the Kubernetes mechanism for restarting containers that are running but unhealthy, such as deadlocked processes. Readiness probes only remove a pod from load balancing, and startup probes only apply while the container starts.

• ACorrect. The kubelet uses liveness probes to decide when to restart a container. If the container fails its liveness probe, the kubelet restarts it. Microsoft's AKS guidance lists unexpected deadlocks as a case where a liveness probe helps. The check must fail when the app is stuck, and it should be shallow, not dependent on downstream services.
• BIncorrect. When a readiness probe fails, the pod is marked not ready and removed from the service load balancers, but the container is not restarted. The deadlocked process would stay stuck, so the team would still have to recover it manually.
• CIncorrect. A startup probe tells the kubelet when the application has finished starting, and liveness and readiness probes don't begin until it succeeds. It covers only the startup phase, so it can't detect a deadlock that happens later while the container is running.
• DIncorrect. A Pod Disruption Budget limits how many pods can be unavailable during voluntary disruptions such as upgrades or node drains. It doesn't check whether a container is healthy and doesn't restart one that is stuck.

Answer: A) Add a Startup probe for the container, with a failure threshold and period long enough to cover the model load time

Use a startup probe for slow-starting containers. Liveness and readiness checks don't begin until it succeeds, so a long model load isn't mistaken for a hang. A readiness probe only controls whether a replica gets traffic.

• ACorrect. Liveness and readiness checks don't start until a startup probe succeeds, so the liveness probe can't restart a container that is still loading. Giving the startup probe enough failureThreshold × periodSeconds to cover the load time protects the slow startup, and the liveness probe can keep tight settings for steady-state hang detection.
• BIncorrect. A readiness probe only decides whether a replica receives traffic. It doesn't stop the liveness probe from running and restarting the container during the slow model load.
• CIncorrect. A lower failureThreshold makes the liveness probe give up after fewer failures, so the container would be restarted even earlier during the model load. That makes the problem worse.
• DIncorrect. Azure Container Apps supports only TCP and HTTP(S) probes, so exec probes can't be used. Changing the probe type also wouldn't keep liveness checks from running during startup.

Answer: A) Add a diskANN vector index on the embedding path in the container's indexing policy

Vector searches without a vector index consume many more RUs. For millions of high-dimensional embeddings, a diskANN index gives low RU cost and high recall, while flat indexes are limited to 505 dimensions. Removing TOP N or raising searchListSizeMultiplier increases cost.

• ACorrect. Microsoft Learn says vector searches have lower latency, higher throughput, and lower RU consumption when they use a vector index. DiskANN supports up to 4,096 dimensions and offers some of the lowest RU cost queries while keeping accuracy high. It is generally the best-performing index type when a search covers more than 50,000 vectors.
• BIncorrect. A flat index supports vectors of at most 505 dimensions, so it can't index these 1,536-dimension embeddings. Even for smaller vectors, a flat index runs a brute-force search, which is not ideal across millions of vectors.
• CIncorrect. This option tunes diskANN recall per query. Raising it trades higher latency and RU cost for higher recall, so it moves RU consumption in the wrong direction. It also does nothing when no diskANN index exists.
• DIncorrect. Microsoft Learn says to always use a TOP N clause in vector search queries. Without it, the search tries to return many more results, and the query costs more RUs and has higher latency.

Answer: A) Three replicas, so the service meets the read-write SLA requirement for queries and indexing

The Azure AI Search SLA applies only to billable tiers. It requires at least two replicas for read-only query workloads and at least three for read-write workloads that include indexing. Partitions don't affect SLA eligibility.

• ACorrect. The availability SLA applies to billable-tier services that have at least three replicas for read-write workloads (queries and indexing). Three is the minimum that covers both.
• BIncorrect. Two replicas meet the SLA only for read-only (query) workloads. Read-write workloads that include indexing need at least three replicas.
• CIncorrect. Partitions add storage and indexing capacity, but the SLA depends on replica count. A single-replica service doesn't qualify for the SLA.
• DIncorrect. A billable tier is required but isn't enough on its own. The service also needs at least two replicas for queries and at least three for read-write workloads.

Answer: A) A filter expression on the tenantId field, such as tenantId eq '<id>', sent with the query

To isolate tenants in a shared index, add a filter on a filterable tenant field to every vector query. The default preFilter mode applies that filter during the vector search, so results stay scoped to the tenant without losing matches. Scoring, reranking and k settings only affect ranking or result count.

• ACorrect. Filters apply to filterable non-vector fields and limit which documents a vector query can return. With the default, recommended preFilter mode, the filter is applied during HNSW traversal, so only that tenant's chunks are candidates and k matches are returned if they exist.
• BIncorrect. A scoring profile only changes relevance scores and ranking. Other tenants' chunks can still appear in the results, so it doesn't isolate tenants.
• CIncorrect. Semantic ranking reorders results that were already retrieved, based on meaning. It doesn't remove documents from other tenants.
• DIncorrect. k only controls how many nearest neighbors are returned. It doesn't control which tenant those neighbors belong to, so other customers' chunks can still be returned.

Answer: A) Send ticket text to Azure Language PII detection and chunk and embed the redacted output

To keep PII out of a RAG index, detect and redact it before chunking and embedding, for example with Azure Language PII detection. Embeddings, encryption at rest, and Prompt Shields don't remove PII from stored chunk text that is later returned to the LLM.

• ACorrect. Azure Language PII detection identifies, classifies, and redacts sensitive data in text and can return redacted results. Microsoft Learn lists support tickets as a typical input and recommends applying privacy controls before storage or downstream AI processing. If redacted text is chunked and embedded, the phone numbers and email addresses never reach the stored chunks or the LLM's grounding context.
• BIncorrect. In this pipeline the original chunk text is stored with each vector and passed to the LLM as grounding context. Any PII in that text can therefore appear in retrieved results and generated answers, whatever happens to the vectors.
• CIncorrect. Encryption at rest protects stored data from unauthorized access to the storage media. It is decrypted transparently for authorized queries, so the PII would still be retrieved and given to the LLM as grounding context.
• DIncorrect. Prompt Shields detects adversarial inputs, such as user prompt attacks and hidden instructions in documents. It doesn't find or redact personal data like phone numbers or email addresses.

Answer: A) A Foundry resource, with one or more Foundry projects created under it for the team's work

Microsoft Foundry (formerly Azure AI Foundry) now uses a single Foundry resource with child projects. That structure brings agents, models, tools, and evaluation together under one set of access control, networking, and policies. Hub-based projects are now part of the classic experience.

• ACorrect. In the current resource model, a single Foundry resource holds projects. Agents, models, and tools are managed together under it, with unified role-based access control, networking, and policies under one Azure resource provider namespace.
• BIncorrect. Hub-based projects belong to the earlier Hub + Azure OpenAI + Azure AI Services model and are reached through the Foundry (classic) portal. Microsoft says new investment is focused on Foundry projects in the new portal.
• CIncorrect. This is the older multi-resource setup that the Foundry resource replaces. It doesn't give one place to manage access control, networking, and policies for agents, models, and tools. Azure OpenAI resources can be upgraded to a Foundry resource.
• DIncorrect. A Machine Learning workspace with per-model endpoints doesn't provide Foundry projects or the current portal's Agent Service experience. It also doesn't give the single resource the team wants for managing agents, models, and tools together.

Answer: A) Serve chat with synchronous streaming calls to a standard deployment, and submit the nightly documents as a JSONL file to a Global Batch deployment

Match each workload to the right calling pattern. Use synchronous streaming calls for interactive chat. Use Global Batch for latency-tolerant bulk work, which costs 50% less and has a separate enqueued token quota that doesn't affect online traffic.

• ACorrect. Interactive chat needs real-time responses, so synchronous (streaming) calls fit. Global Batch runs asynchronous jobs at 50% less cost than Global Standard, with a 24-hour target turnaround. It also uses a separate enqueued token quota, so it doesn't disrupt online workloads.
• BIncorrect. Batch jobs have a 24-hour target turnaround that isn't guaranteed. That is unacceptable for chat users waiting for a reply.
• CIncorrect. The nightly job would pay full real-time prices and use the same deployment's tokens-per-minute quota as chat. That can cause throttling (429 errors) for users and misses the batch discount.
• DIncorrect. This reverses the patterns. Polling a batch job doesn't make it interactive because turnaround targets hours, not seconds. Running the bulk job synchronously gives up the batch discount and its separate quota.

Answer: A) Deploy it as a hosted agent in Foundry Agent Service

Foundry Agent Service hosted agents run your own framework code (for example, LangGraph) as a container, with a managed endpoint, scaling, Entra identity, and session state provided by Foundry. Prompt agents can't run custom code.

• ACorrect. Hosted agents in Foundry Agent Service run code built with frameworks such as LangGraph, packaged as a container image or a .zip file. Foundry provides the managed endpoint, automatic scaling, a dedicated Entra identity, and session-level state persistence.
• BIncorrect. A prompt agent is defined only through configuration (instructions, model, and tools). It has no application code, so it can't run the team's custom LangGraph orchestration logic.
• CIncorrect. This could run the code, but the team would have to host the agent and build its state handling, identity setup, and tool integrations themselves. That's exactly the work they want to avoid.
• DIncorrect. An AI gateway manages, secures, and throttles calls to AI endpoints. It doesn't host or run agent code, so the team would still need somewhere to run the agent.

Answer: A) Add an image_url content part to the user message and set its url field to the image's public HTTPS address

Vision-enabled chat models take images in an image_url content part whose url can be a web URL or a base64 data URL, so a publicly hosted image can be referenced directly without re-encoding.

• ACorrect. In a user message, the image_url content part accepts either a web URL or a base64-encoded data URL. A publicly reachable image can be referenced by its URL, so there's no need to download and encode it first.
• BIncorrect. A base64 data URL is one supported option and is useful for local images. It isn't required, because the image_url content part also accepts a web URL.
• CIncorrect. The model doesn't browse to URLs written as plain text in a message. The image must be supplied in an image_url content part to be processed as image input.
• DIncorrect. The detail parameter sets image processing fidelity, with values such as auto, low and high. It doesn't choose between a URL and base64. The image address goes in the url field.

Answer: A) Run the function under an identity that has read-only access to only the order data it needs

With function calling, the model decides when to call a function and with which arguments. Microsoft recommends least privilege, such as read-only database access, rather than relying on schemas, prompts, or after-the-fact logging.

• ACorrect. Microsoft recommends the principle of least privilege for function calling: grant only the minimum access the function needs, such as read-only database access for a query function. This limits the damage if the model is manipulated into calling the function in an unintended way.
• BIncorrect. A tight schema helps the model generate valid calls, but Microsoft says not to rely solely on excluding capabilities in the function definition as a security control. The underlying access is still what limits the damage.
• CIncorrect. Logging helps detect misuse after it happens, but it doesn't prevent it. With broad rights, a manipulated call could still change or expose data.
• DIncorrect. System message instructions guide the model's behavior, but prompt injection can override them. They don't replace limiting the permissions the function actually has.

Answer: A) Use the list of harms to drive systematic measurement and mitigations, then red team again with and without the mitigations in place to check whether they work

Red teaming finds harms but doesn't replace measurement or mitigation. The list of harms should drive systematic measurement and mitigations, and the app should then be tested again with and without those mitigations.

• ACorrect. The guidance says the goal of red teaming is to find harms and build a list that shows what needs to be measured and mitigated. Red teaming doesn't replace systematic measurement and mitigation. Teams should test product versions again with and without mitigations to check how well they work, and add newly found harms to the list.
• BIncorrect. The guidance says people should not read specific red-teaming examples as a metric for how widespread a harm is. Red teaming shows where risks exist. Measuring them takes systematic measurement.
• CIncorrect. The guidance says red teaming is not a replacement for systematic measurement and rigorous mitigation work. Manual rounds alone are not enough to show that mitigations work.
• DIncorrect. Microsoft says each LLM app's context is unique. Teams should do their own red teaming to find gaps in the existing safety systems and to identify and mitigate shortcomings in the default filters.

Answer: A) Enable NVIDIA DCGM exporter scraping in Azure Monitor managed service for Prometheus and view the metrics in Grafana

For NVIDIA GPU node pools on AKS, Microsoft recommends having Azure Monitor managed service for Prometheus scrape the DCGM exporter and viewing the metrics in Grafana. The older Container insights GPU collection in InsightMetrics is no longer recommended and only tracks GPU counts, requests and limits.

• ACorrect. Microsoft's guidance is to have the Azure Monitor managed Prometheus agent scrape the NVIDIA DCGM exporter by setting dcgmexporter = true in ama-metrics-settings-configmap in kube-system. The metrics include DCGM_FI_DEV_GPU_UTIL, DCGM_FI_DEV_FB_USED and DCGM_FI_DEV_TEMPERATURE. You can view them in the Azure-managed 'Kubernetes | NVIDIA GPU DCGM Exporter' Grafana dashboard.
• BIncorrect. Microsoft says this method is no longer recommended for collecting GPU metrics. It also only records GPU counts, requests and limits (nodeGpuCapacity, nodeGpuAllocatable, containerGpuRequests, containerGpuLimits), not utilization, memory use or temperature.
• CIncorrect. AKS diagnostic settings route cluster resource logs, such as control plane logs, to a destination. They don't collect per-GPU telemetry from the nodes. GPU utilization and temperature come from the DCGM exporter.
• DIncorrect. Azure Policy checks resource configuration for compliance. It doesn't collect runtime metrics, so it can't report GPU utilization, memory use or temperature.

Answer: A) Building an application safety system that inspects grounding content and plugin interactions, for example by using Azure AI Content Safety

With PaaS AI such as Azure OpenAI, Microsoft secures the AI platform layer, including its built-in safety system. The customer owns the AI application layer, including an application safety system that inspects metaprompt content, grounding data and plugin interactions.

• ACorrect. In a PaaS deployment, the AI application layer belongs to the customer. Microsoft's guidance says to build an application safety system that deeply inspects the content used in the metaprompt and the interactions with plugins and data connectors. Azure AI Content Safety is one way to do this.
• BIncorrect. This is the AI platform layer. For a PaaS service such as Azure OpenAI, Microsoft provides and secures the platform, and the customer reaches the model through APIs.
• CIncorrect. Microsoft supplies built-in platform-layer safety systems for its PaaS offering Azure OpenAI. Customers configure how they use those systems, but they don't build them.
• DIncorrect. Physical infrastructure security always stays with Microsoft for cloud services, including PaaS AI services such as Azure OpenAI.