AI-200 Practice Test 2 – 50 Questions and Answers (Azure AI Cloud Developer)

AI-200 Practice Test 2: 50 Questions and Answers for Developing AI Cloud Solutions on Azure

Published August 1, 2026

Practice AI-200 questions for Developing AI Cloud Solutions on Azure. This test follows the current skills measured for containerized solutions, Azure data services for AI, messaging and event-driven integration, Azure Functions, security, monitoring, and troubleshooting. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AI-200Questions: 50Recommended score: 70%+Time: 60 minutes

Before you start

This independent practice test includes 30 single-choice, 10 multiple-response, and 10 true/false questions. It is designed for Azure AI Cloud Developer Associate candidates who want scenario-based preparation with clear explanations and Microsoft Learn references. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AI-200 practice test questions

Question 1: A team is implementing "Kubernetes Deployment and Service manifests". Which foundational practice should it apply?

• Declare desired pod replicas and container images in a Deployment
• Use pod IP addresses as permanent client endpoints
• Modify running containers manually as the release process
• Put credentials directly in the Deployment

The correct answer is Declare desired pod replicas and container images in a Deployment.

In AKS, a Deployment manages replicated pods and rollouts, while a Service provides stable discovery and networking for matching pods. Specifically, declare desired pod replicas and container images in a Deployment. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Kubernetes Deployment and Service manifests

Question 2: A team is implementing "Cosmos DB indexing policy tailored to query paths". Which foundational practice should it apply?

• Index properties used by filters and ordering
• Remove every index from a query-heavy container
• Assume indexes have no write cost
• Optimize without representative query tests

The correct answer is Index properties used by filters and ordering.

Cosmos DB indexing policies affect query capability, latency, and RU cost; indexing only required paths can reduce write and storage overhead. Specifically, index properties used by filters and ordering. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Cosmos DB indexing policy tailored to query paths

Question 3: Which practices are appropriate when using "Key Vault for secrets and App Configuration for nonsecret settings"? Choose 2 answers.

• Store secrets in Key Vault
• Store ordinary settings and feature flags in App Configuration
• Commit local secret files
• Grant all developers unrestricted production vault access
• Expose resolved secrets through configuration endpoints

The correct answers are Store secrets in Key Vault, and Store ordinary settings and feature flags in App Configuration.

Key Vault is designed for secrets, keys, and certificates, while App Configuration centralizes nonsecret settings and can reference Key Vault values. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Key Vault for secrets and App Configuration for nonsecret settings

Question 4: When implementing "Service Bus topic with filtered subscriptions", a team should publish once to the topic.

• True
• False

The correct answer is True.

Service Bus topics fan messages out to subscriptions, and each subscription behaves like a virtual queue that can use SQL or correlation filters. The statement is correct; the recommended practice is to publish once to the topic.

Related Microsoft Learn topic

Service Bus topic with filtered subscriptions

Question 5: A team is implementing "Metadata filtering before or during vector retrieval". Which foundational practice should it apply?

• Persist filterable metadata with each chunk
• Retrieve all tenants and filter only in generated prose
• Ask the model to infer access rights
• Treat similarity score as authorization

The correct answer is Persist filterable metadata with each chunk.

RAG retrieval should combine semantic similarity with metadata and authorization filters so only relevant, permitted records become model context. Specifically, persist filterable metadata with each chunk. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Metadata filtering before or during vector retrieval

Question 6: When implementing "Azure Event Grid advanced filters", a team should use filters to decrypt payloads.

• True
• False

The correct answer is False.

Event Grid supports subject and advanced filtering so subscriptions receive only matching events, reducing unnecessary invocations and consumer-side filtering. The statement is incorrect; the recommended practice is to filter on supported event fields and operators.

Related Microsoft Learn topic

Azure Event Grid advanced filters

Question 7: A team is implementing "Least-privilege Azure RBAC on separate managed identities". Which foundational practice should it apply?

• Treat network isolation as a replacement for authorization
• Give components separate identities where trust boundaries differ
• Reuse a broad admin identity everywhere
• Grant roles permanently for temporary troubleshooting

The correct answer is Give components separate identities where trust boundaries differ.

Separate managed identities and narrowly scoped RBAC permissions reduce credential management and limit the impact of a compromised component. Specifically, give components separate identities where trust boundaries differ. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Least-privilege Azure RBAC on separate managed identities

Question 8: A team is implementing "Key Vault reference in an App Service setting". Which foundational practice should it apply?

• Log the resolved secret during startup
• Grant broad vault permissions to all apps
• Enable a managed identity for the app
• Bake the secret into the image

The correct answer is Enable a managed identity for the app.

App Service can resolve a Key Vault reference by using its managed identity, keeping secret values out of source code and normal configuration files. Specifically, enable a managed identity for the app. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Key Vault reference in an App Service setting

Question 9: During a design review of "Azure App Configuration feature flag", which practices should be approved? Choose 2 answers.

• Define flags outside the application binary
• Store credentials inside flag descriptions
• Assume flags replace authorization checks
• Leave obsolete flags permanently
• Refresh configuration at a controlled interval

The correct answers are Define flags outside the application binary, and Refresh configuration at a controlled interval.

App Configuration feature flags externalize operational switches and can support targeted or gradual behavior changes without a new build. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure App Configuration feature flag

Question 10: A team is implementing "Pinned image digest and vulnerability scanning". Which foundational practice should it apply?

• Deploy an exact image digest
• Store secrets in image history
• Skip provenance and dependency updates
• Rely only on a mutable latest tag

The correct answer is Deploy an exact image digest.

A digest identifies exact image content, while scanning, controlled rebuilds, and least-privilege registry access reduce container supply-chain risk. Specifically, deploy an exact image digest. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Pinned image digest and vulnerability scanning

Question 11: Which practices are appropriate when using "Managed identity and Key Vault RBAC"? Choose 2 answers.

• Grant only the required Key Vault data-plane role
• Log the secret value for diagnostics
• Enable an identity on the workload
• Use one identity with broad access across all vaults
• Grant subscription Owner to the app

The correct answers are Enable an identity on the workload, and Grant only the required Key Vault data-plane role.

Managed identity provides an Entra identity without an application secret, and Key Vault data-plane RBAC grants narrowly scoped secret access. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Managed identity and Key Vault RBAC

Question 12: A team is implementing "Cosmos DB change feed processor". Which foundational practice should it apply?

• Expect delete events in every change-feed mode without verification
• Assume exactly-once side effects
• Use a lease container for coordination and checkpoints
• Write checkpoints to local ephemeral memory only

The correct answer is Use a lease container for coordination and checkpoints.

The change feed processor balances feed ranges across workers and stores progress in a lease container; handlers should tolerate retries and duplicate delivery. Specifically, use a lease container for coordination and checkpoints. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Cosmos DB change feed processor

Question 13: When implementing "Application idempotency plus Service Bus duplicate detection", a team should assign stable message identifiers for retried sends.

• True
• False

The correct answer is True.

Duplicate detection can discard repeated sends with the same MessageId inside its configured window, while consumer idempotency protects downstream side effects. The statement is correct; the recommended practice is to assign stable message identifiers for retried sends.

Related Microsoft Learn topic

Application idempotency plus Service Bus duplicate detection

Question 14: A team is implementing "A high-cardinality Cosmos DB partition key aligned with query patterns". Which foundational practice should it apply?

• Use one tenant value for all global traffic
• Ignore per-partition workload concentration
• Choose a key with enough distinct values
• Change the partition key in place after launch

The correct answer is Choose a key with enough distinct values.

A suitable Cosmos DB partition key distributes data and RU consumption and supports efficient routing for the workload’s common access patterns. Specifically, choose a key with enough distinct values. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

A high-cardinality Cosmos DB partition key aligned with query patterns

Question 15: A team is implementing "Kubernetes readiness probe". Which foundational practice should it apply?

• Probe an unrelated always-successful endpoint
• Use readiness failures to restart the container automatically
• Test a dependency or endpoint that represents readiness
• Disable probes to speed up deployment

The correct answer is Test a dependency or endpoint that represents readiness.

A readiness probe controls whether a pod is eligible for Service traffic. Unlike a liveness probe, a readiness failure does not by itself restart the container. Specifically, test a dependency or endpoint that represents readiness. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Kubernetes readiness probe

Question 16: When implementing "Azure Managed Redis expiration policy", a team should set TTLs according to data freshness requirements.

• True
• False

The correct answer is True.

Redis key expiration limits staleness and memory growth, but TTL selection must reflect source volatility, sensitivity, and acceptable freshness. The statement is correct; the recommended practice is to set TTLs according to data freshness requirements.

Related Microsoft Learn topic

Azure Managed Redis expiration policy

Question 17: A team is implementing "Bounded retries with exponential backoff, jitter, and idempotency". Which foundational practice should it apply?

• Use identical retry timing across all instances
• Retry every 4xx response
• Retry only failures classified as transient
• Hide final failures from monitoring

The correct answer is Retry only failures classified as transient.

Production clients should retry only transient failures with bounded exponential backoff and jitter, while protecting side effects through idempotency and surfacing exhaustion. Specifically, retry only failures classified as transient. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Bounded retries with exponential backoff, jitter, and idempotency

Question 18: A team is implementing "KEDA-based scale rule in Azure Container Apps". Which foundational practice should it apply?

• Choose a scaler that matches the event source
• Set an unlimited maximum without capacity planning
• Assume scaling makes message handlers idempotent
• Use image tags as queue-length metrics

The correct answer is Choose a scaler that matches the event source.

Azure Container Apps integrates KEDA scalers to adjust replicas based on event-source metrics while allowing minimum and maximum replica limits. Specifically, choose a scaler that matches the event source. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

KEDA-based scale rule in Azure Container Apps

Question 19: To operate "Function App application settings and deployment slots" securely and reliably, which actions should the team take? Choose 3 answers.

• Place secrets in the deployment artifact
• Validate the staging slot before swapping
• Assume every trigger is safe to run in both slots
• Mark settings as deployment-slot settings when they must not swap
• Store environment-specific values in app settings

The correct answers are Store environment-specific values in app settings, Mark settings as deployment-slot settings when they must not swap, and Validate the staging slot before swapping.

Function deployment slots support staged validation and swapping, while slot-specific app settings keep selected configuration attached to an environment. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Function App application settings and deployment slots

Question 20: A team is implementing "Database connection pooling". Which foundational practice should it apply?

• Create unbounded pools per process
• Reuse connections through an application pool or PgBouncer
• Disable encryption to reduce latency
• Hold transactions open during model calls

The correct answer is Reuse connections through an application pool or PgBouncer.

Connection pooling reduces connection setup overhead and protects PostgreSQL from excessive concurrent sessions when configured with sensible bounds and timeouts. Specifically, reuse connections through an application pool or PgBouncer. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Database connection pooling

Question 21: When implementing "Peek-Lock receive mode with Complete after success", a team should process while the broker lock is held.

• True
• False

The correct answer is True.

Peek-Lock separates receiving from settlement, allowing failed or abandoned messages to become available again and requiring idempotent processing. The statement is correct; the recommended practice is to process while the broker lock is held.

Related Microsoft Learn topic

Peek-Lock receive mode with Complete after success

Question 22: A team is implementing "Application Insights dependency telemetry and correlated traces". Which foundational practice should it apply?

• Compare request and dependency duration and failure data
• Assume correlation exists without context propagation
• Log only successful requests
• Place full credentials in dependency names

The correct answer is Compare request and dependency duration and failure data.

Correlated request and dependency telemetry helps identify which downstream call contributes latency or failures across a distributed application. Specifically, compare request and dependency duration and failure data. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Application Insights dependency telemetry and correlated traces

Question 23: A team is implementing "OpenTelemetry trace-context propagation". Which foundational practice should it apply?

• Record secrets and full prompts as span attributes
• Propagate W3C trace context across service and message boundaries
• Use user email as an unbounded metric dimension
• Create a new unrelated trace at every hop

The correct answer is Propagate W3C trace context across service and message boundaries.

Distributed tracing depends on propagating trace context so spans from multiple components form one end-to-end trace. Specifically, propagate W3C trace context across service and message boundaries. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

OpenTelemetry trace-context propagation

Question 24: During a design review of "A Service Bus trigger for Azure Functions", which practices should be approved? Choose 2 answers.

• Disable dead-letter monitoring
• Use unbounded concurrency against a limited database
• Assume function success before work completes
• Configure the Service Bus connection or identity securely
• Tune concurrency to downstream capacity

The correct answers are Configure the Service Bus connection or identity securely, and Tune concurrency to downstream capacity.

A Service Bus trigger activates a function when messages arrive and integrates broker settlement and retry behavior with the Functions runtime. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

A Service Bus trigger for Azure Functions

Question 25: A team is implementing "Azure Container Apps job". Which foundational practice should it apply?

• Store the executable inside a Service Bus message
• Select manual, scheduled, or event-driven execution
• Use a job for a permanently listening web API
• Assume each execution can never retry

The correct answer is Select manual, scheduled, or event-driven execution.

Container Apps jobs are designed for finite executions and support manual, scheduled, and event-driven trigger types with execution history and logging. Specifically, select manual, scheduled, or event-driven execution. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Apps job

Question 26: A team is implementing "KQL where, project, and summarize operators". Which foundational practice should it apply?

• Use summarize to rotate secrets
• Treat KQL as an application transaction language
• Use project to restart pods
• Use where to restrict rows

The correct answer is Use where to restrict rows.

KQL uses tabular operators: where filters rows, project shapes columns, and summarize performs aggregations such as counts grouped by dimensions or time bins. Specifically, use where to restrict rows. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

KQL where, project, and summarize operators

Question 27: Which practices are appropriate when using "CloudEvents schema"? Choose 2 answers.

• Reuse one event ID for unrelated events
• Populate stable event type, source, id, and time metadata
• Version the event data contract deliberately
• Treat the envelope as guaranteed business validation
• Put credentials in event extensions

The correct answers are Populate stable event type, source, id, and time metadata, and Version the event data contract deliberately.

CloudEvents defines interoperable envelope attributes such as id, source, type, specversion, time, and data while applications still own payload contracts. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

CloudEvents schema

Question 28: A team is implementing "Representative vector-load testing and PostgreSQL resource monitoring". Which foundational practice should it apply?

• Ignore concurrency in capacity tests
• Use development latency as the only production metric
• Measure query latency and recall with production-like vectors
• Assume all embedding models have identical resource needs

The correct answer is Measure query latency and recall with production-like vectors.

Vector workload sizing depends on index type, dimensions, row count, concurrency, recall targets, cache behavior, and storage or I/O characteristics. Specifically, measure query latency and recall with production-like vectors. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Representative vector-load testing and PostgreSQL resource monitoring

Question 29: A team is implementing "Head or tail sampling with explicit retention goals". Which foundational practice should it apply?

• Define a sampling strategy consistent across services
• Assume sampling has no effect on trace completeness
• Capture secrets because sampled data is smaller
• Sample each service independently with incompatible rules

The correct answer is Define a sampling strategy consistent across services.

OpenTelemetry sampling controls trace volume and cost; consistent decisions and deliberate retention of diagnostically valuable traces improve usefulness. Specifically, define a sampling strategy consistent across services. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Head or tail sampling with explicit retention goals

Question 30: When implementing "Cache-aside pattern with explicit invalidation", a team should treat cached data as the only durable copy.

• True
• False

The correct answer is False.

Cache-aside loads data into Redis on demand while retaining the authoritative source and requires a deliberate freshness, invalidation, and failure strategy. The statement is incorrect; the recommended practice is to read from cache first and load from the source on a miss.

Related Microsoft Learn topic

Cache-aside pattern with explicit invalidation

Question 31: A team is implementing "Session consistency with a carried session token". Which foundational practice should it apply?

• Assume session guarantees span unrelated clients without a token
• Use consistency settings to replace idempotency
• Disable retries for all transient failures
• Reuse the session token when the client context moves

The correct answer is Reuse the session token when the client context moves.

Cosmos DB session consistency provides monotonic reads and read-your-writes within a session, with session-token propagation important across client instances. Specifically, reuse the session token when the client context moves. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Session consistency with a carried session token

Question 32: To operate "Azure App Configuration sentinel key and refresh registration" securely and reliably, which actions should the team take? Choose 3 answers.

• Treat configuration refresh as secret rotation by itself
• Set a reasonable refresh interval and preserve last-known-good behavior
• Change the sentinel before dependent keys
• Update related keys before changing the sentinel
• Register the sentinel to trigger refresh

The correct answers are Update related keys before changing the sentinel, Register the sentinel to trigger refresh, and Set a reasonable refresh interval and preserve last-known-good behavior.

A sentinel key can signal that a coordinated set of App Configuration values is ready, reducing partial refreshes while controlling polling frequency. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure App Configuration sentinel key and refresh registration

Question 33: A team is implementing "kubectl describe, events, and logs". Which foundational practice should it apply?

• Assume every failure is an Azure outage
• Expose the application publicly for debugging
• Start with destructive cleanup
• Inspect pod status and recent events

The correct answer is Inspect pod status and recent events.

Pod descriptions, Kubernetes events, current or previous logs, endpoints, and connectivity tests provide evidence for systematic AKS troubleshooting. Specifically, inspect pod status and recent events. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

kubectl describe, events, and logs

Question 34: A team is implementing "Azure Container Registry repository". Which foundational practice should it apply?

• Use repositories to organize related images
• Allow anonymous push access
• Treat the latest tag as immutable
• Store production passwords in image layers

The correct answer is Use repositories to organize related images.

Azure Container Registry provides private repositories for container images and supports image tags, immutable digests, RBAC, and integrations with Azure compute services. Specifically, use repositories to organize related images. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Registry repository

Question 35: When implementing "Azure Managed Redis vector index", a team should define a vector field with matching dimensions and distance metric.

• True
• False

The correct answer is True.

Azure Managed Redis can index vector fields for similarity search; schema, algorithm, dimensions, metric, memory, and filtering choices affect correctness and performance. The statement is correct; the recommended practice is to define a vector field with matching dimensions and distance metric.

Related Microsoft Learn topic

Azure Managed Redis vector index

Question 36: A team is implementing "Cosmos DB vector index with matching embedding dimensions". Which foundational practice should it apply?

• Define the vector path and index type in the container policy
• Compare vectors as ordinary text
• Assume vector indexing removes RU consumption
• Mix incompatible embedding dimensions in one indexed path

The correct answer is Define the vector path and index type in the container policy.

Cosmos DB for NoSQL vector search requires a vector policy and compatible vector index whose path, dimensions, data type, and distance function match stored embeddings. Specifically, define the vector path and index type in the container policy. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Cosmos DB vector index with matching embedding dimensions

Question 37: A team is implementing "The pgvector vector data type in Azure Database for PostgreSQL". Which foundational practice should it apply?

• Compare embeddings lexicographically as strings
• Mix arbitrary dimensions in the same vector column
• Assume a primary key performs nearest-neighbor search
• Enable the supported vector extension

The correct answer is Enable the supported vector extension.

The pgvector extension adds a vector type, distance operators, and vector indexes for similarity search in Azure Database for PostgreSQL. Specifically, enable the supported vector extension. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

The pgvector vector data type in Azure Database for PostgreSQL

Question 38: A team is implementing "Azure Functions HTTP trigger with an output binding". Which recommendations should it follow? Choose 3 answers.

• Validate input and configure authorization
• Use bindings for declarative service integration where appropriate
• Assume bindings remove retry considerations
• Store credentials in function code
• Use the trigger to start execution from an HTTP request

The correct answers are Use the trigger to start execution from an HTTP request, Use bindings for declarative service integration where appropriate, and Validate input and configure authorization.

Azure Functions triggers start executions, while input and output bindings provide declarative access to supported services without replacing validation or reliability design. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure Functions HTTP trigger with an output binding

Question 39: A team is implementing "Managed identity with AcrPull role". Which foundational practice should it apply?

• Assign the identity only the AcrPull role when push is unnecessary
• Grant Owner to every workload
• Enable the registry admin account by default
• Commit credentials to source control

The correct answer is Assign the identity only the AcrPull role when push is unnecessary.

A managed identity combined with the AcrPull role provides passwordless, least-privilege access for pulling images from a private registry. Specifically, assign the identity only the AcrPull role when push is unnecessary. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Managed identity with AcrPull role

Question 40: When implementing "Service Bus dead-letter queue", a team should ignore the dead-letter queue indefinitely.

• True
• False

The correct answer is False.

Each Service Bus entity has a dead-letter subqueue for messages that expire, exceed delivery attempts, or are explicitly dead-lettered; operations must monitor and remediate it. The statement is incorrect; the recommended practice is to record a meaningful dead-letter reason and description.

Related Microsoft Learn topic

Service Bus dead-letter queue

Question 41: A team is implementing "Cosmos DB SDK point read with partition key and item id". Which foundational practice should it apply?

• Supply both item id and partition-key value
• Create a new client for every request
• Omit the known partition key
• Use a cross-partition query for every lookup

The correct answer is Supply both item id and partition-key value.

A point read addressed by item id and partition key is the most efficient Cosmos DB lookup, and reusing the SDK client supports connection management. Specifically, supply both item id and partition-key value. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Cosmos DB SDK point read with partition key and item id

Question 42: A team is implementing "Private endpoint with correct private DNS integration". Which foundational practice should it apply?

• Return the public IP from internal DNS
• Skip connectivity tests from the actual runtime
• Link the required private DNS zone to client virtual networks
• Use a private endpoint as a replacement for RBAC

The correct answer is Link the required private DNS zone to client virtual networks.

Private endpoints expose a service through a private IP, while correct DNS-zone links and access controls are required for clients to use that path reliably. Specifically, link the required private DNS zone to client virtual networks. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Private endpoint with correct private DNS integration

Question 43: To operate "Event Grid retry policy and dead-letter destination" securely and reliably, which actions should the team take? Choose 3 answers.

• Configure a storage dead-letter destination where supported
• Assume Event Grid preserves events forever
• Make event handlers idempotent
• Return success before persisting the event
• Monitor delivery failures and dead-lettered events

The correct answers are Configure a storage dead-letter destination where supported, Monitor delivery failures and dead-lettered events, and Make event handlers idempotent.

Event Grid retries transient delivery failures with backoff and can dead-letter events after policy limits when a destination is configured. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Event Grid retry policy and dead-letter destination

Question 44: When implementing "Azure Service Bus queue", a team should assume delivery is exactly once.

• True
• False

The correct answer is False.

A Service Bus queue provides durable brokered messaging and load leveling, with competing consumers receiving messages under at-least-once delivery semantics. The statement is incorrect; the recommended practice is to send commands to a queue for asynchronous processing.

Related Microsoft Learn topic

Azure Service Bus queue

Question 45: A team is implementing "App Service WEBSITES_PORT app setting". Which foundational practice should it apply?

• Expose multiple arbitrary ports through WEBSITES_PORT
• Use a Service Bus queue to select the HTTP port
• Set the app setting to the container listening port
• Put the port only in a Key Vault secret with no app setting

The correct answer is Set the app setting to the container listening port.

For a custom Linux container, App Service routes incoming traffic to the container port identified by the relevant port app setting and exposes configuration through environment variables. Specifically, set the app setting to the container listening port. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

App Service WEBSITES_PORT app setting

Question 46: A team is implementing "Azure Container Registry Tasks". Which foundational practice should it apply?

• Replace Kubernetes manifests
• Use tasks as a secret database
• Require a permanent self-hosted Docker daemon
• Run quick, scheduled, or source-triggered image builds

The correct answer is Run quick, scheduled, or source-triggered image builds.

ACR Tasks runs cloud-based container build and maintenance workflows and can trigger builds from source changes, base-image updates, schedules, or manual execution. Specifically, run quick, scheduled, or source-triggered image builds. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Registry Tasks

Question 47: When implementing "Service Bus sessions", a team should expect ordering across different session IDs.

• True
• False

The correct answer is False.

Service Bus sessions group related messages and provide an exclusive session lock, enabling ordered processing within a session rather than across the entire entity. The statement is incorrect; the recommended practice is to set the same SessionId on related messages.

Related Microsoft Learn topic

Service Bus sessions

Question 48: A team is implementing "An HNSW pgvector index". Which foundational practice should it apply?

• Use a scalar B-tree for cosine distance ordering
• Skip representative recall testing
• Expect exact exhaustive results at zero cost
• Create the index with the operator class matching the distance metric

The correct answer is Create the index with the operator class matching the distance metric.

HNSW is an approximate nearest-neighbor index supported by pgvector and commonly trades memory and build cost for strong query performance and recall. Specifically, create the index with the operator class matching the distance metric. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

An HNSW pgvector index

Question 49: A team is implementing "Azure Container Apps revisions and traffic splitting". Which foundational practice should it apply?

• Edit an existing immutable revision in place
• Delete the old revision before validation
• Use DNS caching as the rollout controller
• Create an immutable revision for the new version

The correct answer is Create an immutable revision for the new version.

Container Apps revisions provide immutable deployment snapshots and, in multiple-revision mode, support weighted traffic splitting for canary releases and rollback. Specifically, create an immutable revision for the new version. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Apps revisions and traffic splitting

Question 50: A team is implementing "Versionless Key Vault secret reference with cache refresh planning". Which recommendations should it follow? Choose 3 answers.

• Delete the old credential before consumers can refresh
• Use rotation-compatible references when automatic adoption is required
• Assume every SDK refreshes instantly
• Test old and new credential overlap during rotation
• Plan for client or platform caching behavior

The correct answers are Use rotation-compatible references when automatic adoption is required, Plan for client or platform caching behavior, and Test old and new credential overlap during rotation.

A versionless secret identifier resolves to the current version, but applications must account for caching, refresh timing, and safe credential overlap. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Versionless Key Vault secret reference with cache refresh planning