AI-200 Practice Test 4 – 50 Questions and Answers (Azure AI Cloud Developer)

AI-200 Practice Test 4: 50 Questions and Answers for Developing AI Cloud Solutions on Azure

Published August 1, 2026

Practice AI-200 questions for Developing AI Cloud Solutions on Azure. This test follows the current skills measured for containerized solutions, Azure data services for AI, messaging and event-driven integration, Azure Functions, security, monitoring, and troubleshooting. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AI-200Questions: 50Recommended score: 70%+Time: 60 minutes

Before you start

This independent practice test includes 30 single-choice, 10 multiple-response, and 10 true/false questions. It is designed for Azure AI Cloud Developer Associate candidates who want scenario-based preparation with clear explanations and Microsoft Learn references. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AI-200 practice test questions

Question 1: Multiple applications share one App Configuration store. An AI worker should load only production keys whose names begin with AiWorker:. Which provider configuration is appropriate?

• Load every key and filter values only after logging them
• Select the AiWorker:* key filter with the Production label filter
• Use the Key Vault Secrets Officer role as a key selector
• Copy the store's read-write access key into the container image

The correct answer is Select the AiWorker:* key filter with the Production label filter.

App Configuration providers support key and label selectors. Selecting only the required prefix and environment label limits the configuration loaded by the workload and avoids unrelated settings.

Related Microsoft Learn topic

Azure App Configuration provider selectors

Question 2: During a production-readiness review of "Peek-Lock receive mode with Complete after success", which recommendation should be approved?

• Hold a lock through unlimited processing without renewal
• Assume a lock prevents all duplicate delivery
• Abandon or dead-letter according to failure policy
• Complete before validating the payload

The correct answer is Abandon or dead-letter according to failure policy.

Peek-Lock separates receiving from settlement, allowing failed or abandoned messages to become available again and requiring idempotent processing. Specifically, abandon or dead-letter according to failure policy. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Peek-Lock receive mode with Complete after success

Question 3: When implementing "Session consistency with a carried session token", a team should disable retries for all transient failures.

• True
• False

The correct answer is False.

Cosmos DB session consistency provides monotonic reads and read-your-writes within a session, with session-token propagation important across client instances. The statement is incorrect; the recommended practice is to test multi-region behavior from the application path.

Related Microsoft Learn topic

Session consistency with a carried session token

Question 4: During a production-readiness review of "Azure Container Apps job", which recommendation should be approved?

• Assume each execution can never retry
• Store the executable inside a Service Bus message
• Use a job for a permanently listening web API
• Inspect job executions and replica logs

The correct answer is Inspect job executions and replica logs.

Container Apps jobs are designed for finite executions and support manual, scheduled, and event-driven trigger types with execution history and logging. Specifically, inspect job executions and replica logs. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Apps job

Question 5: During a design review of "Representative vector-load testing and PostgreSQL resource monitoring", which practices should be approved? Choose 2 answers.

• Use development latency as the only production metric
• Monitor CPU, memory, IOPS, connections, and storage growth
• Assume all embedding models have identical resource needs
• Ignore concurrency in capacity tests
• Measure query latency and recall with production-like vectors

The correct answers are Measure query latency and recall with production-like vectors, and Monitor CPU, memory, IOPS, connections, and storage growth.

Vector workload sizing depends on index type, dimensions, row count, concurrency, recall targets, cache behavior, and storage or I/O characteristics. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Representative vector-load testing and PostgreSQL resource monitoring

Question 6: Which practices are appropriate when using "Service Bus dead-letter queue"? Choose 2 answers.

• Ignore the dead-letter queue indefinitely
• Replay poison messages continuously with no change
• Record a meaningful dead-letter reason and description
• Put secrets in dead-letter descriptions
• Monitor dead-letter counts and age

The correct answers are Record a meaningful dead-letter reason and description, and Monitor dead-letter counts and age.

Each Service Bus entity has a dead-letter subqueue for messages that expire, exceed delivery attempts, or are explicitly dead-lettered; operations must monitor and remediate it. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Service Bus dead-letter queue

Question 7: During a production-readiness review of "CloudEvents schema", which recommendation should be approved?

• Put credentials in event extensions
• Reuse one event ID for unrelated events
• Treat the envelope as guaranteed business validation
• Validate content type and schema at the consumer

The correct answer is Validate content type and schema at the consumer.

CloudEvents defines interoperable envelope attributes such as id, source, type, specversion, time, and data while applications still own payload contracts. Specifically, validate content type and schema at the consumer. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

CloudEvents schema

Question 8: When implementing "Cosmos DB SDK point read with partition key and item id", a team should prefer asynchronous APIs for concurrent I/O.

• True
• False

The correct answer is True.

A point read addressed by item id and partition key is the most efficient Cosmos DB lookup, and reusing the SDK client supports connection management. The statement is correct; the recommended practice is to prefer asynchronous APIs for concurrent I/O.

Related Microsoft Learn topic

Cosmos DB SDK point read with partition key and item id

Question 9: During a production-readiness review of "Service Bus sessions", which recommendation should be approved?

• Enable sessions after entity creation without recreation
• Use sessions as a replacement for idempotency
• Expect ordering across different session IDs
• Keep session state small and design for lock renewal

The correct answer is Keep session state small and design for lock renewal.

Service Bus sessions group related messages and provide an exclusive session lock, enabling ordered processing within a session rather than across the entire entity. Specifically, keep session state small and design for lock renewal. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Service Bus sessions

Question 10: A KQL investigation must combine request rows with matching dependency rows by operation identifier. Which operator should the query use?

• render
• take
• project-away
• join

The correct answer is join.

The KQL join operator merges rows from two tabular expressions when the specified key columns match. Requests and dependencies can therefore be correlated by a shared operation identifier after selecting the required time range and columns.

Related Microsoft Learn topic

KQL join operator

Question 11: When implementing "Kubernetes readiness probe", a team should tune thresholds to avoid startup-related flapping.

• True
• False

The correct answer is True.

A readiness probe controls whether a pod is eligible for Service traffic. Unlike a liveness probe, a readiness failure does not by itself restart the container. The statement is correct; the recommended practice is to tune thresholds to avoid startup-related flapping.

Related Microsoft Learn topic

Kubernetes readiness probe

Question 12: A supported web application must automatically collect traces, metrics, logs, and exceptions and send them to Application Insights by using OpenTelemetry. What should the developer configure?

• The Azure Monitor OpenTelemetry Distro with the Application Insights connection string
• A Service Bus topic with one subscription per telemetry type
• A KQL query embedded in every request handler
• An Azure Container Registry webhook

The correct answer is The Azure Monitor OpenTelemetry Distro with the Application Insights connection string.

The Azure Monitor OpenTelemetry Distro provides supported instrumentation and export to Application Insights, including automatic collection for common application telemetry signals and support for custom telemetry.

Related Microsoft Learn topic

Enable OpenTelemetry in Application Insights

Question 13: Automatic instrumentation does not create a span for a custom AI inference step. What should the developer do?

• Write the model prompt into the container image label
• Create a custom span with an OpenTelemetry tracer around the inference operation
• Create a new Application Insights resource for every inference
• Replace distributed tracing with DNS query logging

The correct answer is Create a custom span with an OpenTelemetry tracer around the inference operation.

Custom operations that are not covered by automatic instrumentation can be represented by spans created through the OpenTelemetry API. The span remains part of the active trace and can include safe, low-cardinality attributes for diagnosis.

Related Microsoft Learn topic

Add custom Azure Monitor OpenTelemetry instrumentation

Question 14: A team is implementing "Database connection pooling". Which recommendations should it follow? Choose 3 answers.

• Hold transactions open during model calls
• Create unbounded pools per process
• Use timeouts and health checks for stale connections
• Reuse connections through an application pool or PgBouncer
• Set pool limits below database connection capacity

The correct answers are Reuse connections through an application pool or PgBouncer, Set pool limits below database connection capacity, and Use timeouts and health checks for stale connections.

Connection pooling reduces connection setup overhead and protects PostgreSQL from excessive concurrent sessions when configured with sensible bounds and timeouts. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Database connection pooling

Question 15: An application uses the same configuration key name in development, staging, and production but requires a different value in each environment. What should the developer use?

• Azure App Configuration labels and an environment-specific label filter
• A different source-code branch for every value
• A Key Vault certificate version for each setting
• A Service Bus session identifier

The correct answer is Azure App Configuration labels and an environment-specific label filter.

Labels create variants of the same App Configuration key. The application can select the label for its environment while keeping the key name stable across deployments.

Related Microsoft Learn topic

Azure App Configuration keys and labels

Question 16: During a production-readiness review of "Azure Event Grid advanced filters", which recommendation should be approved?

• Use filters to decrypt payloads
• Test included and excluded event samples
• Depend on undocumented field shapes
• Assume filters replace subscriber authorization

The correct answer is Test included and excluded event samples.

Event Grid supports subject and advanced filtering so subscriptions receive only matching events, reducing unnecessary invocations and consumer-side filtering. Specifically, test included and excluded event samples. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Event Grid advanced filters

Question 17: To operate "Azure Managed Redis expiration policy" securely and reliably, which actions should the team take? Choose 3 answers.

• Cache sensitive results across tenants with one key
• Set TTLs according to data freshness requirements
• Use namespaced keys that identify version and tenant
• Assume TTL guarantees immediate source consistency
• Monitor hit rate, evictions, and memory pressure

The correct answers are Set TTLs according to data freshness requirements, Use namespaced keys that identify version and tenant, and Monitor hit rate, evictions, and memory pressure.

Redis key expiration limits staleness and memory growth, but TTL selection must reflect source volatility, sensitivity, and acceptable freshness. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure Managed Redis expiration policy

Question 18: During a production-readiness review of "Kubernetes Deployment and Service manifests", which recommendation should be approved?

• Apply manifests declaratively and review rollout status
• Put credentials directly in the Deployment
• Use pod IP addresses as permanent client endpoints
• Modify running containers manually as the release process

The correct answer is Apply manifests declaratively and review rollout status.

In AKS, a Deployment manages replicated pods and rollouts, while a Service provides stable discovery and networking for matching pods. Specifically, apply manifests declaratively and review rollout status. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Kubernetes Deployment and Service manifests

Question 19: During a production-readiness review of "Azure Container Registry repository", which recommendation should be approved?

• Apply RBAC to control push and pull operations
• Store production passwords in image layers
• Treat the latest tag as immutable
• Allow anonymous push access

The correct answer is Apply RBAC to control push and pull operations.

Azure Container Registry provides private repositories for container images and supports image tags, immutable digests, RBAC, and integrations with Azure compute services. Specifically, apply RBAC to control push and pull operations. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Registry repository

Question 20: When implementing "Cosmos DB change feed processor", a team should assume exactly-once side effects.

• True
• False

The correct answer is False.

The change feed processor balances feed ranges across workers and stores progress in a lease container; handlers should tolerate retries and duplicate delivery. The statement is incorrect; the recommended practice is to scale processor instances while leases distribute work.

Related Microsoft Learn topic

Cosmos DB change feed processor

Question 21: During a production-readiness review of "App Service WEBSITES_PORT app setting", which recommendation should be approved?

• Expose multiple arbitrary ports through WEBSITES_PORT
• Use a Service Bus queue to select the HTTP port
• Put the port only in a Key Vault secret with no app setting
• Verify container startup logs when routing fails

The correct answer is Verify container startup logs when routing fails.

For a custom Linux container, App Service routes incoming traffic to the container port identified by the relevant port app setting and exposes configuration through environment variables. Specifically, verify container startup logs when routing fails. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

App Service WEBSITES_PORT app setting

Question 22: A custom telemetry field contains a JSON string with several nested properties. Which KQL function should convert it to a dynamic value for property access?

• parse_json()
• bin()
• ago()
• countif()

The correct answer is parse_json().

The parse_json() function interprets a JSON-formatted string as a dynamic value. The query can then access multiple fields from the resulting property bag without repeatedly extracting each value from the original string.

Related Microsoft Learn topic

KQL parse_json() function

Question 23: When implementing "Cosmos DB indexing policy tailored to query paths", a team should measure query metrics before and after policy changes.

• True
• False

The correct answer is True.

Cosmos DB indexing policies affect query capability, latency, and RU cost; indexing only required paths can reduce write and storage overhead. The statement is correct; the recommended practice is to measure query metrics before and after policy changes.

Related Microsoft Learn topic

Cosmos DB indexing policy tailored to query paths

Question 24: During a production-readiness review of "Event Grid retry policy and dead-letter destination", which recommendation should be approved?

• Return success before persisting the event
• Assume Event Grid preserves events forever
• Make event handlers idempotent
• Replay failures without checking event age or cause

The correct answer is Make event handlers idempotent.

Event Grid retries transient delivery failures with backoff and can dead-letter events after policy limits when a destination is configured. Specifically, make event handlers idempotent. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Event Grid retry policy and dead-letter destination

Question 25: Which practices are appropriate when using "Metadata filtering before or during vector retrieval"? Choose 2 answers.

• Ask the model to infer access rights
• Retrieve all tenants and filter only in generated prose
• Persist filterable metadata with each chunk
• Apply authorized tenant or document predicates with retrieval
• Treat similarity score as authorization

The correct answers are Persist filterable metadata with each chunk, and Apply authorized tenant or document predicates with retrieval.

RAG retrieval should combine semantic similarity with metadata and authorization filters so only relevant, permitted records become model context. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Metadata filtering before or during vector retrieval

Question 26: A team is implementing "Azure Managed Redis vector index". Which recommendations should it follow? Choose 3 answers.

• Combine vector queries with supported metadata filters
• Store vectors with inconsistent dimensions
• Choose an index algorithm appropriate for scale and latency
• Assume vector search is an authorization boundary
• Define a vector field with matching dimensions and distance metric

The correct answers are Define a vector field with matching dimensions and distance metric, Choose an index algorithm appropriate for scale and latency, and Combine vector queries with supported metadata filters.

Azure Managed Redis can index vector fields for similarity search; schema, algorithm, dimensions, metric, memory, and filtering choices affect correctness and performance. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure Managed Redis vector index

Question 27: During a production-readiness review of "A Service Bus trigger for Azure Functions", which recommendation should be approved?

• Assume function success before work completes
• Disable dead-letter monitoring
• Handle retries, poison messages, and idempotency
• Use unbounded concurrency against a limited database

The correct answer is Handle retries, poison messages, and idempotency.

A Service Bus trigger activates a function when messages arrive and integrates broker settlement and retry behavior with the Functions runtime. Specifically, handle retries, poison messages, and idempotency. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

A Service Bus trigger for Azure Functions

Question 28: A legacy dependency requires a password stored in Key Vault, and the password must be rotated automatically before expiration. Which design is appropriate?

• Reuse the same secret version indefinitely
• Store the password in Azure App Configuration as plain text
• Rotate the password manually only after an outage
• Trigger an Azure Function from a Key Vault Event Grid notification to update the dependency and create a new secret version

The correct answer is Trigger an Azure Function from a Key Vault Event Grid notification to update the dependency and create a new secret version.

For resources that still require passwords or access keys, Key Vault rotation can use Event Grid notifications and an Azure Function to update the target resource and store the rotated credential as a new secret version.

Related Microsoft Learn topic

Automate Azure Key Vault secret rotation

Question 29: When implementing "The pgvector vector data type in Azure Database for PostgreSQL", a team should assume a primary key performs nearest-neighbor search.

• True
• False

The correct answer is False.

The pgvector extension adds a vector type, distance operators, and vector indexes for similarity search in Azure Database for PostgreSQL. The statement is incorrect; the recommended practice is to use distance operators that match the similarity requirement.

Related Microsoft Learn topic

The pgvector vector data type in Azure Database for PostgreSQL

Question 30: An application managed identity must read secret values from Azure Key Vault but must not manage the vault or modify secrets. Which role should be assigned at the vault scope?

• Key Vault Contributor
• Key Vault Secrets User
• Key Vault Administrator
• Owner at the subscription scope

The correct answer is Key Vault Secrets User.

The Key Vault Secrets User role grants data-plane permission to read secret contents without granting broad vault-management or secret-management capabilities. Key Vault Contributor controls the vault resource but does not grant access to secret values.

Related Microsoft Learn topic

Azure Key Vault RBAC roles

Question 31: During a design review of "Azure Service Bus queue", which practices should be approved? Choose 2 answers.

• Send commands to a queue for asynchronous processing
• Assume delivery is exactly once
• Delete messages before processing completes
• Use a queue for direct request-response latency only
• Use competing consumers to distribute work

The correct answers are Send commands to a queue for asynchronous processing, and Use competing consumers to distribute work.

A Service Bus queue provides durable brokered messaging and load leveling, with competing consumers receiving messages under at-least-once delivery semantics. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Azure Service Bus queue

Question 32: During a production-readiness review of "Key Vault reference in an App Service setting", which recommendation should be approved?

• Log the resolved secret during startup
• Bake the secret into the image
• Reference the secret from application configuration
• Grant broad vault permissions to all apps

The correct answer is Reference the secret from application configuration.

App Service can resolve a Key Vault reference by using its managed identity, keeping secret values out of source code and normal configuration files. Specifically, reference the secret from application configuration. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Key Vault reference in an App Service setting

Question 33: When implementing "Pinned image digest and vulnerability scanning", a team should use least-privilege registry permissions.

• True
• False

The correct answer is True.

A digest identifies exact image content, while scanning, controlled rebuilds, and least-privilege registry access reduce container supply-chain risk. The statement is correct; the recommended practice is to use least-privilege registry permissions.

Related Microsoft Learn topic

Pinned image digest and vulnerability scanning

Question 34: During a production-readiness review of "Managed identity with AcrPull role", which recommendation should be approved?

• Scope permissions to the required registry
• Enable the registry admin account by default
• Commit credentials to source control
• Grant Owner to every workload

The correct answer is Scope permissions to the required registry.

A managed identity combined with the AcrPull role provides passwordless, least-privilege access for pulling images from a private registry. Specifically, scope permissions to the required registry. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Managed identity with AcrPull role

Question 35: During a production-readiness review of "KEDA-based scale rule in Azure Container Apps", which recommendation should be approved?

• Set an unlimited maximum without capacity planning
• Use image tags as queue-length metrics
• Set minimum and maximum replica boundaries
• Assume scaling makes message handlers idempotent

The correct answer is Set minimum and maximum replica boundaries.

Azure Container Apps integrates KEDA scalers to adjust replicas based on event-source metrics while allowing minimum and maximum replica limits. Specifically, set minimum and maximum replica boundaries. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

KEDA-based scale rule in Azure Container Apps

Question 36: To operate "Service Bus topic with filtered subscriptions" securely and reliably, which actions should the team take? Choose 3 answers.

• Create subscriptions for independent consumer groups
• Publish once to the topic
• Use one queue when every consumer needs its own copy
• Apply subscription filters for relevant message properties
• Assume topic filters enforce application authorization

The correct answers are Publish once to the topic, Create subscriptions for independent consumer groups, and Apply subscription filters for relevant message properties.

Service Bus topics fan messages out to subscriptions, and each subscription behaves like a virtual queue that can use SQL or correlation filters. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Service Bus topic with filtered subscriptions

Question 37: During a production-readiness review of "Azure Container Apps revisions and traffic splitting", which recommendation should be approved?

• Use DNS caching as the rollout controller
• Move traffic back to a healthy revision during rollback
• Edit an existing immutable revision in place
• Delete the old revision before validation

The correct answer is Move traffic back to a healthy revision during rollback.

Container Apps revisions provide immutable deployment snapshots and, in multiple-revision mode, support weighted traffic splitting for canary releases and rollback. Specifically, move traffic back to a healthy revision during rollback. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Apps revisions and traffic splitting

Question 38: During a production-readiness review of "Azure Container Registry Tasks", which recommendation should be approved?

• Require a permanent self-hosted Docker daemon
• Store the resulting image in an Azure Container Registry
• Use tasks as a secret database
• Replace Kubernetes manifests

The correct answer is Store the resulting image in an Azure Container Registry.

ACR Tasks runs cloud-based container build and maintenance workflows and can trigger builds from source changes, base-image updates, schedules, or manual execution. Specifically, store the resulting image in an Azure Container Registry. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Container Registry Tasks

Question 39: When implementing "kubectl describe, events, and logs", a team should expose the application publicly for debugging.

• True
• False

The correct answer is False.

Pod descriptions, Kubernetes events, current or previous logs, endpoints, and connectivity tests provide evidence for systematic AKS troubleshooting. The statement is incorrect; the recommended practice is to verify service endpoints and in-cluster connectivity.

Related Microsoft Learn topic

kubectl describe, events, and logs

Question 40: During a production-readiness review of "Azure Functions HTTP trigger with an output binding", which recommendation should be approved?

• Validate input and configure authorization
• Run unlimited work synchronously in the request
• Assume bindings remove retry considerations
• Store credentials in function code

The correct answer is Validate input and configure authorization.

Azure Functions triggers start executions, while input and output bindings provide declarative access to supported services without replacing validation or reliability design. Specifically, validate input and configure authorization. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Azure Functions HTTP trigger with an output binding

Question 41: Several services appear under ambiguous node names in Application Map. Which OpenTelemetry configuration should identify each logical service and instance?

• Set the container image tag as the trace ID
• Use one identical service name and instance ID for every replica
• Set service.name, optionally service.namespace, and service.instance.id resource attributes
• Rename the Log Analytics workspace for every request

The correct answer is Set service.name, optionally service.namespace, and service.instance.id resource attributes.

Azure Monitor maps OpenTelemetry resource attributes to cloud role name and cloud role instance. Consistent service identity improves Application Map topology, filtering, and service-level troubleshooting.

Related Microsoft Learn topic

Configure Azure Monitor OpenTelemetry resource attributes

Question 42: When implementing "Cosmos DB vector index with matching embedding dimensions", a team should use the appropriate distance function for the embedding model.

• True
• False

The correct answer is True.

Cosmos DB for NoSQL vector search requires a vector policy and compatible vector index whose path, dimensions, data type, and distance function match stored embeddings. The statement is correct; the recommended practice is to use the appropriate distance function for the embedding model.

Related Microsoft Learn topic

Cosmos DB vector index with matching embedding dimensions

Question 43: A Python service must use developer credentials locally and its managed identity after deployment to Azure, without environment-specific authentication code. How should it create the Key Vault client?

• Embed a client secret in the application package
• Use the Azure subscription access key
• Pass DefaultAzureCredential to SecretClient
• Download the managed identity token during the build

The correct answer is Pass DefaultAzureCredential to SecretClient.

DefaultAzureCredential can use local development credentials and automatically use the Azure-hosted workload's managed identity in production. SecretClient then performs secret operations without application-managed credentials.

Related Microsoft Learn topic

Azure Key Vault SecretClient with Python

Question 44: A release must use a tested configuration set that cannot change while the deployment progresses through environments. Which App Configuration capability should be used?

• A mutable key with no label
• A feature flag evaluated separately by every request
• A named immutable App Configuration snapshot
• A Service Bus dead-letter queue

The correct answer is A named immutable App Configuration snapshot.

An App Configuration snapshot is an immutable subset of key-values selected by key and label filters. It provides a stable, auditable configuration set for controlled rollout and last-known-good rollback.

Related Microsoft Learn topic

Azure App Configuration snapshots

Question 45: Which practices are appropriate when using "Cache-aside pattern with explicit invalidation"? Choose 2 answers.

• Read from cache first and load from the source on a miss
• Treat cached data as the only durable copy
• Share keys without tenant boundaries
• Invalidate or refresh affected keys after source updates
• Assume cache writes are automatically transactional with the database

The correct answers are Read from cache first and load from the source on a miss, and Invalidate or refresh affected keys after source updates.

Cache-aside loads data into Redis on demand while retaining the authoritative source and requires a deliberate freshness, invalidation, and failure strategy. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

Cache-aside pattern with explicit invalidation

Question 46: An application must switch at runtime from one immutable App Configuration snapshot to another without changing application code. What should it consume?

• A hard-coded snapshot name compiled into the application
• A local JSON file replaced manually on every instance
• An Azure Monitor workbook parameter
• An App Configuration snapshot reference whose target snapshot can be updated

The correct answer is An App Configuration snapshot reference whose target snapshot can be updated.

A snapshot reference is a key-value that points to an immutable snapshot. When refresh is configured, updating the reference to a different snapshot allows the provider to load the new consistent configuration set without an application code change.

Related Microsoft Learn topic

Azure App Configuration snapshot references

Question 47: When implementing "A high-cardinality Cosmos DB partition key aligned with query patterns", a team should ignore per-partition workload concentration.

• True
• False

The correct answer is False.

A suitable Cosmos DB partition key distributes data and RU consumption and supports efficient routing for the workload’s common access patterns. The statement is incorrect; the recommended practice is to validate expected storage and request distribution.

Related Microsoft Learn topic

A high-cardinality Cosmos DB partition key aligned with query patterns

Question 48: To operate "An HNSW pgvector index" securely and reliably, which actions should the team take? Choose 3 answers.

• Expect exact exhaustive results at zero cost
• Use a scalar B-tree for cosine distance ordering
• Tune search parameters against recall and latency targets
• Monitor memory and build-time impact
• Create the index with the operator class matching the distance metric

The correct answers are Create the index with the operator class matching the distance metric, Tune search parameters against recall and latency targets, and Monitor memory and build-time impact.

HNSW is an approximate nearest-neighbor index supported by pgvector and commonly trades memory and build cost for strong query performance and recall. The selected practices support a secure and operable implementation; the remaining choices introduce incorrect assumptions or avoidable risk.

Related Microsoft Learn topic

An HNSW pgvector index

Question 49: During a production-readiness review of "Function App application settings and deployment slots", which recommendation should be approved?

• Validate the staging slot before swapping
• Assume every trigger is safe to run in both slots
• Place secrets in the deployment artifact
• Skip post-swap monitoring

The correct answer is Validate the staging slot before swapping.

Function deployment slots support staged validation and swapping, while slot-specific app settings keep selected configuration attached to an environment. Specifically, validate the staging slot before swapping. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Function App application settings and deployment slots

Question 50: During a production-readiness review of "Application idempotency plus Service Bus duplicate detection", which recommendation should be approved?

• Deduplicate business operations in the consumer
• Assume broker deduplication covers downstream side effects
• Remove idempotency keys after the first exception
• Generate a new ID for every retry

The correct answer is Deduplicate business operations in the consumer.

Duplicate detection can discard repeated sends with the same MessageId inside its configured window, while consumer idempotency protects downstream side effects. Specifically, deduplicate business operations in the consumer. The other choices describe unsafe or incorrect implementation patterns.

Related Microsoft Learn topic

Application idempotency plus Service Bus duplicate detection