AI-200 Developing AI Cloud Solutions on Azure Questions and Answers

Verified Answer: Preserve parent sampling decisions: ParentBasedSampler. Capture all spans locally: AlwaysOnSampler. Sample 10% in production: TraceIdRatioBasedSampler(0.1).

Detailed Explanation: Parent-based sampling propagates the sampling decision from the upstream parent, preventing broken sampling decisions across a distributed trace. AlwaysOnSampler records every span, which is suitable for local test environments where complete trace visibility is more important than telemetry volume. TraceIdRatioBasedSampler with 0.1 selects approximately ten percent of traces based on trace identifiers, providing deterministic fixed-ratio sampling for production. A batch span processor and an exporter control processing/export, not the sampling decision itself.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | OpenTelemetry sampling in Azure Monitor | Enable Azure Monitor OpenTelemetry

The question maps directly to the AI-200 objective “Develop AI solutions by using Azure Cosmos DB for NoSQL,” which includes running queries and optimizing query performance and Request Unit (RU) consumption.

Statement 1: No — The minimum throughput is not 400 RU/s.

The PowerShell command provisions the container with:

-AutoscaleMaxThroughput 5000

Azure Cosmos DB autoscale operates between approximately 10% and 100% of the configured maximum throughput . Microsoft documentation specifically gives the example of an autoscale container provisioned with 5,000 RU/s scaling between 500 RU/s and 5,000 RU/s . Therefore, for this container, the minimum operating autoscale throughput is 500 RU/s , not 400 RU/s.

Therefore:

“The minimum throughput for the container is 400 RU/s.” → No

Statement 2: No — The first query is not an in-partition query.

The container uses:

/EmployeeId

as its partition key.

The first query is:

SELECT * FROM c WHERE c.EmployeeId > ' 12345 '

Although the query references the partition key, it uses a range predicate ( > ) , not an equality predicate. Microsoft explicitly states that a range filter on a partition key is not scoped to a single physical partition . To qualify as an in-partition query, the filter must identify the applicable partition, typically through an equality predicate such as:

WHERE c.EmployeeId = ' 12345 '

Microsoft ' s documentation provides essentially the same example: a query using DeviceId > ... against a container partitioned by DeviceId is not an in-partition query .

Therefore:

“The first query statement is an in-partition query.” → No

Statement 3: Yes — The second query is a cross-partition query.

The second query is:

SELECT * FROM c WHERE c.UserId = ' 12345 '

The container ' s partition key is /EmployeeId, not /UserId. Because the query contains no filter on the partition key , Azure Cosmos DB cannot route it to one logical partition. It must fan out the query across the applicable physical partitions and combine the results.

Microsoft describes this behavior directly: when a query does not contain a filter on the partition key, it must execute across the partitions.

Therefore:

“The second query statement is a cross-partition query.” → Yes

Service fails to communicate with another service: Inspect Kubernetes service endpoints.

Pod restarts repeatedly: Inspect container logs.

Readiness probe failures are observed: Inspect Pod descriptions.

For a service-to-service communication failure , first inspect the Kubernetes service endpoints . Microsoft’s AKS troubleshooting guidance recommends verifying that the destination pod IP address and application port appear as endpoints for the Kubernetes Service. An empty or incorrect endpoint list commonly indicates a selector/label mismatch, incorrect port configuration, or unavailable backend pods.

For a pod that restarts repeatedly , inspect the container logs , including the previous container instance when necessary. Microsoft specifically recommends kubectl logs < pod > --previous for workloads that repeatedly restart because it exposes application errors and termination messages from the container immediately before the restart.

For readiness probe failures , inspect the Pod description by using kubectl describe pod. The description exposes the configured health probes, pod conditions, container state, and associated probe-failure events, allowing you to determine whether the probe path, port, timing, or application readiness behavior is incorrect. Microsoft recommends reviewing kubectl describe output when pods are not Ready or health probes are failing.

Therefore, the correct mapping is service endpoints → container logs → Pod descriptions .

Study Guide references: AKS troubleshooting; Kubernetes Services and endpoints; container logging; Pod health; readiness/liveness probes; kubectl describe and kubectl logs.

The correct solution is to implement connection pooling , ideally by using the built-in PgBouncer capability in Azure Database for PostgreSQL Flexible Server. Connection pooling allows many concurrent application requests to share and reuse a smaller set of established PostgreSQL server connections instead of repeatedly opening and closing database sessions. Microsoft notes that creating a new PostgreSQL connection for each operation consumes server resources because each connection involves its own backend process. Reusing pooled connections therefore reduces connection overhead, lowers CPU and memory consumption, and improves throughput for high-concurrency workloads.

This directly matches Fabrikam ' s stated requirement that database connections support high concurrency with minimal latency through connection optimization . PgBouncer can efficiently multiplex large numbers of client connections onto fewer PostgreSQL connections, particularly in transaction pooling mode.

Increasing max_connections is not the preferred solution because each additional PostgreSQL connection consumes memory and other resources; Microsoft explicitly recommends PgBouncer instead when more concurrent connections are required. Increasing shared_buffers addresses caching and memory allocation rather than connection-management overhead. Read replicas can scale read workloads, but they do not optimize the application ' s connection lifecycle.

Study Guide references: Azure Database for PostgreSQL Flexible Server → connection pooling; PgBouncer; connection management and high-concurrency performance.

Define a table schema with vector and metadata columns.

Load embedding vectors and associated product metadata.

Configure a Hierarchical Navigable Small World (HNSW) index on the embedding vector columns.

Perform a similarity search using a WHERE clause and the < = > operator.

The workflow must first establish a PostgreSQL schema containing both the pgvector embedding column and the product metadata required for filtering. The embeddings and their associated metadata are then bulk-loaded. This ordering is important because Microsoft recommends loading data before creating vector indexes ; creating the index afterward provides faster ingestion and a more optimal index layout.

After loading, configure an HNSW index on the embedding column. HNSW is an approximate-nearest-neighbor index supported by pgvector and provides a strong speed/recall tradeoff for low-latency vector retrieval. Microsoft specifically documents HNSW for efficient cosine-distance searches in Azure Database for PostgreSQL.

Finally, execute the retrieval query so that mandatory product metadata constraints are applied through a WHERE clause , while vector similarity is evaluated with the < = > cosine-distance operator . This satisfies Fabrikam ' s requirement to calculate similarity only for eligible products.

A B-tree index is not an ANN vector index, and increasing Redis memory does not implement PostgreSQL semantic retrieval.

Study Guide references: Azure Database for PostgreSQL → pgvector, HNSW indexing, bulk-load optimization, vector similarity operators, metadata-filtered retrieval.

Trigger scaling based on queue depth: Azure Service Bus scaler

Deallocate instances when the message queue is empty: Minimum replicas = 0

Prevent uncontrolled burst scaling: Maximum replicas = 10

The batch retraining workload must scale according to queue length , so the correct KEDA trigger is the Azure Service Bus scaler . KEDA integrates with Azure Service Bus and monitors queue or subscription metrics, allowing AKS workloads to scale according to the number of pending messages rather than CPU utilization or HTTP request concurrency. Microsoft documents KEDA as the event-driven autoscaling mechanism for AKS and specifically supports Azure-based scalers for queue-driven workloads.

To meet the requirement to deallocate workload instances when no messages remain, configure minimum replicas = 0 . KEDA supports scale-to-zero for event-driven workloads, which is particularly appropriate for intermittent batch or machine-learning processing because no pods need to remain running while the queue is empty. Microsoft specifically identifies scale-to-zero as a KEDA capability and recommends it for sporadic ML workloads where cost optimization is important.

Finally, configure maximum replicas = 10 . A finite maximum replica count establishes an explicit upper scaling boundary, preventing large queue bursts from creating an uncontrolled number of worker replicas and protecting both infrastructure cost and downstream services.

Study Guide references: AKS → KEDA; Azure Service Bus event-driven scaling; minReplicaCount; maxReplicaCount; scale-to-zero; autoscaling limits.

The batch embedding workload is planned to run in Azure Kubernetes Service (AKS) , and Kubernetes workloads should be defined declaratively by using YAML manifest files . Microsoft states that a Kubernetes manifest defines the desired state of cluster resources, including Deployments, Jobs, Services, ConfigMaps, and other Kubernetes objects. These manifests can then be deployed by using kubectl apply -f < manifest > .yaml.

For this case, YAML is particularly appropriate because the technical requirements emphasize repeatable, version-controlled, automated deployments . A batch vector embedding regeneration process would typically be represented as a Kubernetes workload such as a Job or another batch-oriented resource, with its configuration committed to Git alongside the rest of the deployment definitions.

kubectl run and kubectl create are imperative commands and are less appropriate for a controlled Git-based deployment model because they do not inherently preserve the complete desired-state definition as source-controlled configuration. XML is not the standard Kubernetes manifest format. az aks commands are primarily used to provision and manage the AKS cluster itself rather than declaratively define application workloads running inside the cluster.

Therefore, the correct choice is YAML-formatted Kubernetes manifest files .

Study Guide references: Azure Kubernetes Service → Kubernetes manifests; declarative deployments; kubectl apply; Git-based workload configuration.

Verified Answer: Register a global trace provider → initialize the application TraceProvider. Export traces to Azure Monitor → create/configure AzureMonitorTraceExporter. Connect exporter to provider → add a span processor. Generate spans → use tracer.start_as_current_span(...).

Detailed Explanation: OpenTelemetry tracing is a pipeline: the application obtains a tracer from a configured provider, creates spans, passes ended spans through a span processor, and exports them using the Azure Monitor exporter. Creating spans alone is insufficient; without the provider/processor/exporter chain, no telemetry reaches Azure Monitor. Log sampling and legacy Application Insights TrackEvent calls are unrelated to the required OpenTelemetry trace-export path.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Enable Azure Monitor OpenTelemetry

The correct architecture uses an Azure Storage queue as an asynchronous buffer between the HTTP ingestion path and the computationally expensive image-processing workload. The HTTP-triggered function should accept the upload, enqueue a work message, and return promptly rather than waiting for image processing to finish. Microsoft specifically recommends asynchronous patterns for long-running HTTP operations because an HTTP-triggered Azure Function can encounter the Azure Load Balancer response timeout even though the underlying function continues executing.

A queue-triggered function then performs image processing independently. Azure Functions applies target-based scaling to Azure Queue Storage triggers based on queued workload, allowing worker capacity to expand as the backlog increases rather than being directly tied to HTTP arrival processing.

For reliability, Azure Queue-triggered Functions provide retry behavior. The visibilityTimeout setting controls the delay before a failed message becomes available for another attempt, while maxDequeueCount controls how many processing attempts occur before the message is transferred to the < queue-name > -poison queue. The default maximum is five attempts.

C defeats the asynchronous requirement. D can be useful for tracking upload state, but it does not itself provide workload decoupling, retry handling, or queue-driven scaling.

Study Guide references: Azure Functions → Queue Storage triggers and bindings; event-driven scaling; retry/poison queue behavior; asynchronous HTTP processing.

Command: func init

Parameter: --worker-runtime

Use func init to initialize a new Azure Functions project. Microsoft documents func init as the Azure Functions Core Tools command that creates the project structure in either the current directory or a specified project folder. The command is specifically intended for creating a new Functions application project, whereas func new creates an individual function from a template inside an already initialized project.

The --worker-runtime parameter specifies the language/runtime model for the Functions project. For example, Microsoft documents func init --worker-runtime python for Python projects and func init --worker-runtime dotnet-isolated for modern C#/.NET isolated-worker projects.

--language is not the primary parameter used to establish the Functions worker runtime in this scenario. It can be relevant to certain runtime combinations, such as Node.js, but the Core Tools project initialization examples for Python and C# rely on --worker-runtime. --target-framework is used to select a specific .NET target framework after the worker/runtime model is determined; it does not identify whether the project should be Python or C#.

Therefore, the correct combination is func init + --worker-runtime .

Study Guide references: Azure Functions Core Tools → func init; local Functions project creation; --worker-runtime; Python and .NET isolated worker projects.

pp1: Consumption. App2: Premium.

Detailed Explanation: For App1, the Windows code-based Consumption plan satisfies event-driven autoscaling, allows execution up to the stated ten-minute range, and has the highest scaling ceiling among the listed event-driven choices for this workload. App2 is deployed as a Linux container image; among Premium, Dedicated, and Consumption, Premium is the event-driven plan that supports Linux containerized Functions and permits long-running execution. Dedicated hosting is not the requested event-driven autoscale model. The original Premium/Premium answer therefore did not maximize App1’s upper scaling limit.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Azure Functions scale and hosting

Use the dead-letter action. Azure Service Bus provides a dedicated dead-letter queue (DLQ) for each queue and subscription. Its purpose is to isolate messages that cannot be successfully processed, including malformed or poison messages, so that they do not continue cycling through the active queue and interfering with valid workload processing. Microsoft explicitly identifies malformed or unexpected payloads as a typical poison-message scenario suitable for the DLQ.

When an application explicitly dead-letters a message, the message is moved to the queue ' s dead-letter subqueue where it can be inspected, diagnosed, corrected, or resubmitted later. The dead-letter operation can also include a reason and error description, which improves operational troubleshooting.

Complete removes a successfully processed message permanently, so it is inappropriate for a failed message that must be retained. Abandon releases the message lock and makes the message available for redelivery, which would perpetuate repeated failures. Defer postpones processing but leaves the message associated with the main entity and requires its sequence number for later retrieval; it is not the standard mechanism for isolating poison messages.

Therefore, the correct action is dead-letter .

Study Guide references: Azure Service Bus → message settlement; dead-letter queues; poison-message handling; DeadLetter operation.

Use where , join , and summarize .

The where operator filters telemetry to the required scope, including records from the last hour and failed requests. For example, a predicate can restrict timestamp > ago(1h) and request success status in the same filtering expression.

Next, use join to correlate request telemetry with dependency telemetry. Application Insights assigns related telemetry a common operation_Id , and Microsoft specifically demonstrates joining the dependencies and requests tables on operation_Id to identify dependency calls associated with requests.

Finally, use summarize with avg(duration) grouped by the appropriate operation identifier or operation name. summarize performs aggregation over groups and is therefore the required operator for calculating average dependency duration. Microsoft documents dependency duration as supporting an Avg aggregation.

extend is unnecessary because no derived column is required, while distinct merely removes duplicate rows and cannot calculate averages or correlate two telemetry tables.

A representative structure is:

requests

| where timestamp > ago(1h) and success == false

| join (dependencies | where timestamp > ago(1h)) on operation_Id

| summarize avg_dependency_duration = avg(duration1) by operation_Name

Study Guide references: Azure Monitor Application Insights; KQL where; telemetry correlation using operation_Id; join; summarize; dependency duration analysis.

Step 1: Create the Azure Functions app with a Consumption plan type.

Use the Consumption plan for serverless.

Step 2: Create a system-assigned managed identity for the application.

Create a system-assigned managed identity for your application.

Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.

Step 3: Create an access policy in Key Vault for the application identity.

Create an access policy in Key Vault for the application identity you created earlier. Enable the " Get " secret permission on this policy. Do not configure the " authorized application " or applicationId settings, as this is not compatible with a managed identity.

To reduce false-positive intent predictions , add representative utterances to the None intent . The None intent exists specifically for user utterances that should not map to any defined business intent. Microsoft recommends adding examples that resemble potential false positives so that the model learns a stronger decision boundary between valid intent utterances and unrelated or ambiguous input.

For example, if the GetContactDetails intent contains requests such as “give me the customer phone number,” the None intent should contain similar-looking but semantically unrelated phrases that could otherwise be incorrectly classified as GetContactDetails. During prediction, an utterance can be classified as None when it resembles None-training examples or when the highest intent score falls below the configured None threshold. Microsoft specifically advises adding false-positive examples to the None intent to improve intent discrimination.

Adding more examples to GetContactDetails alone generally strengthens recognition of that intent but does not provide the model with enough negative examples. A machine-learned entity addresses entity extraction rather than intent classification. Active learning helps identify uncertain utterances for review, but it is not the direct corrective action requested.

Study Guide references: Azure AI Language → Conversational Language Understanding; intents; None intent; intent classification; reducing false positives.

Verified Answer: 1) Instrument the application code with the OpenTelemetry SDK; 2) configure an Azure Monitor trace exporter in the OpenTelemetry SDK; 3) redeploy the instrumented services.

Detailed Explanation: Trace correlation requires the application to create OpenTelemetry spans and an exporter to send those spans to Azure Monitor. Instrumentation must therefore be present before the updated service is deployed. The previous Application Insights SDK instrumentation does not satisfy the case-study requirement that all tracing use OpenTelemetry. Configuring an OpenTelemetry view is unrelated to basic distributed-trace export, and calling TrackEvent is an Application Insights SDK pattern rather than the required OpenTelemetry approach.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Enable Azure Monitor OpenTelemetry

Detailed Explanation: Azure Key Vault references in App Service settings satisfy the requirement to keep secrets out of container images, source control, and directly stored application configuration. App Service resolves the referenced secret at runtime by using the app identity, so the application can consume the value as a normal setting without embedding credentials in the image. GitHub secrets are build/deployment secrets rather than a runtime App Service secret-delivery mechanism. Dockerfile ENV instructions would place secret material in the image configuration and violate the case requirements.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Use Key Vault references for App Service and Functions | Managed identities for Azure resources

Verified Answer: Identify document changes: Change feed processor. Scale out vectorization processing: Lease container.

Detailed Explanation: The change feed processor is designed to react to inserts and updates in a monitored Cosmos DB container, which directly matches the requirement to generate embeddings for new or changed documents. Its lease container stores processing state and coordinates work across multiple workers, allowing the processing workload to scale out without duplicating ownership of change-feed ranges. A periodic full scan would consume unnecessary RUs, and neither strong consistency nor container RU throughput is the coordination mechanism for distributed change-feed workers.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Azure Cosmos DB change feed processor

Detailed Explanation: GitHub Actions is the correct orchestration mechanism among the options because the case requires an automated, version-controlled pipeline and Bicep-based declarative deployment. Microsoft documents GitHub Actions as a supported way to deploy Bicep and automate Azure resource deployment. Local Git, Azure Functions Core Tools, and Azure CLI can participate in development or scripted deployment, but they do not by themselves satisfy the stated requirement for a repository-driven, repeatable CI/CD pipeline.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Deploy Bicep with GitHub Actions | Automate Function app resource deployment

Use GitHub Actions because Proseware requires an automated, version-controlled deployment pipeline and explicitly prohibits local and command-line deployments. Microsoft documents GitHub Actions as a supported CI/CD mechanism for Azure Functions: a workflow stored under .github/workflows can build and deploy Function app code automatically in response to repository events such as pushes or pull requests. The Azure Functions deployment action can deploy the application package directly to the target Function app.

GitHub Actions also satisfies the infrastructure requirement. Microsoft provides first-class support for deploying Bicep templates through GitHub Actions , enabling Azure resources to be provisioned declaratively from the same source-controlled pipeline. A pull-request workflow can perform validation or Bicep what-if analysis before changes are merged, while a main-branch workflow can perform the actual deployment after approval. This provides repeatability, auditing, and separation from individual developer machines.

Azure Functions Core Tools and Azure CLI are commonly used for interactive/local deployments, which directly conflicts with the requirement to eliminate command-line deployment. Local Git deployment also fails the requirement for a centrally automated Bicep-based deployment process.

Study Guide references: Azure Functions CI/CD; GitHub Actions; infrastructure as code with Bicep; automated Azure deployments; version-controlled deployment workflows.

Trigger for container images build: Base image update

Implementation of image builds: ACR Task

The correct trigger is Base image update because Proseware requires every custom container image to be rebuilt automatically whenever its Docker Hub base image changes. Azure Container Registry Tasks can detect base-image dependencies from the Dockerfile FROM instruction and automatically trigger a rebuild when that base image is updated. Microsoft confirms that ACR Tasks can track base images in public repositories such as Docker Hub and Microsoft Container Registry, as well as images stored in Azure Container Registry.

The build implementation must be an ACR Task . This directly satisfies the technical requirement that image-build automation run inside Azure Container Registry , eliminating dependencies on local developer machines or separate external build services. ACR Tasks provides cloud-based container building and can automate builds based on source-code commits, base-image updates, or scheduled triggers.

A GitHub workflow could orchestrate CI/CD, but using it as the actual image-building implementation would conflict with the explicit requirement that builds execute inside ACR. Docker Compose defines multi-container applications; it is not the native ACR build automation mechanism. A Commit trigger addresses source changes rather than the stated base-image update requirement, while Scheduled builds would introduce unnecessary periodic execution.

Study Guide references: Azure Container Registry Tasks; base-image dependency tracking; automated rebuilds; Docker Hub base-image triggers; cloud-native container builds.