AI-200: Developing AI Cloud Solutions on Azure

AI-200 exam objectives

The objective domains the AI-200 exam is built from.

AI-200 practice questions and answers

10 free sample questions from the AI-200 bank, with the correct answer and a full explanation for each. These are original questions written to the Microsoft objective domains — not real exam content.

1. Question 1Connect to and consume Azure services

   After migrating a message processor from a virtual machine to Azure Container Apps, the team removed the Azure Service Bus connection string. The container app has a system-assigned managed identity and uses the Azure Service Bus SDK to receive and complete messages from one queue. Which role assignment provides least privilege?

   • AAssign Azure Service Bus Data Receiver to the managed identity at the queue scope.
   • BAssign Azure Service Bus Data Sender to the managed identity at the queue scope.
   • CAssign Azure Service Bus Data Owner to the managed identity at the namespace scope.
   • DAssign Reader to the managed identity at the namespace scope.

   Show answer and explanation

   Correct answer

   • Assign Azure Service Bus Data Receiver to the managed identity at the queue scope.

   Explanation

   The least-privilege built-in role for receiving and completing messages from a Service Bus queue is Azure Service Bus Data Receiver. Assign it to the container app managed identity at the queue scope, or at the namespace scope only if queue-level scoping is not used.

   • Azure Service Bus Data Sender allows sending messages, not receiving or completing them.
   • Azure Service Bus Data Owner includes send, receive, and management of data-plane entities, which is broader than required.
   • Reader is an Azure management-plane role and does not authorize Service Bus data-plane receive operations.

   References:

   • Use Managed Identities to access Azure Service Bus
   • Authenticate an Application to Access Azure Service Bus Entities
   • Azure built-in roles
2. Question 2Connect to and consume Azure services

   Margie's Travel exposes a trip recommendation API through Azure API Management. During marketing campaigns, short bursts from a single client overload the backend. The gateway must reject requests after 600 calls per subscription in each 60-second window before forwarding to the backend. Which policy should be applied?

   • AAdd a `rate-limit-by-key` policy with the counter key based on the subscription identifier.
   • BAdd a `quota-by-key` policy with the counter key based on the subscription identifier.
   • CAdd a `validate-jwt` policy that requires a valid Microsoft Entra token.
   • DAdd a `cache-lookup-value` policy that stores responses by subscription identifier.

   Show answer and explanation

   Correct answer

   • Add a `rate-limit-by-key` policy with the counter key based on the subscription identifier.

   Explanation

   Use `rate-limit-by-key` with a counter key such as context.Subscription.Id to enforce a short-term request rate per subscription at the gateway. API Management returns a throttling response before sending excess calls to the backend.

   • `quota-by-key` is intended for longer-term call or bandwidth quotas and is less appropriate for smoothing short bursts.
   • `validate-jwt` validates caller tokens but does not throttle request volume.
   • `cache-lookup-value` can reduce backend calls for cached data, but it does not enforce a per-subscription call rate.

   References:

   • Azure API Management policy reference
   • Azure API Management Policy Reference
   • Azure API Management policy reference
3. Question 3Connect to and consume Azure services

   Telemetry from factory sensors arrives in Azure Event Hubs with four partitions. Multiple .NET worker instances must share partitions in a consumer group and checkpoint offsets to Blob Storage so processing resumes after restarts. Which client should the workers use?

   • A`EventProcessorClient` with a Blob Storage checkpoint store
   • B`EventHubProducerClient` with a partition key
   • C`EventHubConsumerClient` without a checkpoint store
   • D`ServiceBusProcessor` with automatic message completion

   Show answer and explanation

   Correct answer

   • `EventProcessorClient` with a Blob Storage checkpoint store

   Explanation

   For .NET workers that need partition load balancing and checkpointing, use `EventProcessorClient` with a Blob Storage checkpoint store. The processor coordinates ownership of partitions across instances in a consumer group and persists checkpoints.

   • EventHubProducerClient sends events to Event Hubs; it does not consume or checkpoint events.
   • EventHubConsumerClient can read events, but it does not provide the same processor-based partition ownership and checkpoint coordination by itself.
   • ServiceBusProcessor is for Azure Service Bus queues and subscriptions, not Event Hubs partitions.

   References:

   • Partition load balancing for event processing
   • Event Hubs features and terminology
4. Question 4Develop AI solutions by using Azure data management services

   To reduce storage costs for raw video frames used in model training, a team will keep files online only during the initial training window. After that window, the files are rarely accessed, and a restore time of several hours is acceptable. Which two actions meet the requirement?

   • AStore the frames as block blobs in a Standard general-purpose v2 storage account that supports blob access tiers.
   • BConfigure a lifecycle management rule that moves the base blobs to the archive tier after the training window.
   • CMove the frames to a Premium block blob storage account and configure lifecycle tiering to the archive tier.
   • DSet the storage account default access tier to archive so newly uploaded blobs are archived immediately.
   • EEnable blob soft delete with a retention period that matches the training window.

   Show answer and explanation

   Correct answers

   • Store the frames as block blobs in a Standard general-purpose v2 storage account that supports blob access tiers.
   • Configure a lifecycle management rule that moves the base blobs to the archive tier after the training window.

   Explanation

   For standard block blobs, Azure Storage supports blob access tiers and lifecycle policies. A lifecycle rule can move blobs to the archive tier after the training window, which minimizes capacity cost but requires rehydration before the data can be read.

   • Premium block blob storage accounts are optimized for low latency and are not the right choice for archive-tier cost optimization.
   • The archive tier is applied at the blob level; setting the storage account default tier to archive is not the way to place new blobs directly in archive.
   • Blob soft delete protects from accidental deletion, but it does not tier data or reduce the capacity cost of retained blobs.

   References:

   • Access tiers for blob data
   • Azure Blob Storage lifecycle management overview
   • Premium block blob storage accounts
5. Question 5Develop AI solutions by using Azure data management services

   During an AI prototype review, the architecture team must choose Azure storage services for a corpus of unstructured PDF, image, and text files that will be indexed for retrieval-augmented generation. Which two services are appropriate persistent stores for the source documents?

   • AAzure Blob Storage
   • BAzure Data Lake Storage Gen2
   • CAzure Event Grid
   • DAzure Key Vault
   • EAzure Cache for Redis

   Show answer and explanation

   Correct answers

   • Azure Blob Storage
   • Azure Data Lake Storage Gen2

   Explanation

   Azure Blob Storage is designed for large amounts of unstructured object data. Azure Data Lake Storage Gen2 builds on Blob Storage and adds hierarchical namespace capabilities that are commonly used for analytics and AI data lakes.

   • Azure Event Grid routes events; it is not a document store.
   • Azure Key Vault stores secrets, keys, and certificates; it is not intended for document corpora.
   • Azure Cache for Redis can cache application data, but it is not the durable source repository for large unstructured document collections.

   References:

   • Introduction to Blob (object) Storage
   • Azure Data Lake Storage overview
6. Question 6Develop AI solutions by using Azure data management services

   For a retrieval-augmented generation application, developers need a managed Azure service that can index grounding documents and support full-text search, filtering, semantic ranking, and vector search over embeddings. Which service should they use?

   • AAzure AI Search
   • BAzure AI Document Intelligence
   • CAzure Event Hubs
   • DAzure Cache for Redis

   Show answer and explanation

   Correct answer

   • Azure AI Search

   Explanation

   Azure AI Search is the managed search service for indexing and querying content, including full-text search, filters, semantic ranking, and vector search scenarios used in retrieval-augmented generation.

   • Azure AI Document Intelligence extracts text, tables, and structure from documents, but it is not the search index and query engine.
   • Azure Event Hubs is an event ingestion service, not a searchable document index.
   • Azure Cache for Redis provides an in-memory cache and data structure store, not a managed full-text and vector search index for document retrieval.

   References:

   • Introduction to Azure AI Search
   • Vector Search Overview
7. Question 7Develop AI solutions by using Azure data management services

   Omni Insurance is building an Azure AI Search index from PDFs and HTML files in Azure Blob Storage. The indexing pipeline must crack documents, split long text into model-sized chunks, generate vector embeddings during indexing by using Azure OpenAI, and store the vectors in the search index. The team wants to avoid a separate embedding batch job. Which Azure AI Search configuration should be used?

   • AAttach a skillset that includes a Text Split skill and an Azure OpenAI Embedding skill to the blob indexer, and map the vector outputs to vector fields.
   • BEnable semantic ranker on the search service and add semantic configuration fields for title, content, and keywords.
   • CCreate a synonym map for insurance terminology and associate the synonym map with searchable text fields.
   • DEnable a knowledge store projection for the blob indexer and store enriched documents in Azure Table Storage.
   • EAdd a scoring profile to the index that boosts recent documents and assigns weights to searchable fields.

   Show answer and explanation

   Correct answer

   • Attach a skillset that includes a Text Split skill and an Azure OpenAI Embedding skill to the blob indexer, and map the vector outputs to vector fields.

   Explanation

   Integrated vectorization in Azure AI Search uses an indexer with a skillset. A typical configuration includes document cracking, a Text Split skill to create chunks, and the Azure OpenAI Embedding skill to generate vectors that are mapped into vector fields in the target index.

   • Semantic ranker improves ranking for text queries but does not generate embeddings during indexing.
   • A synonym map expands or normalizes query terms; it does not split documents or call Azure OpenAI.
   • A knowledge store can project enrichments to Azure Storage, but it is not the mechanism that generates and stores vectors in the search index.
   • A scoring profile changes ranking weights; it does not perform document cracking, chunking, or embedding generation.

   References:

   • Integrated Vectorization Overview
   • Azure OpenAI Embedding Skill
   • Text Split Skill
   • Create an Indexer
8. Question 8Develop containerized solutions on Azure

   Proseware is creating a release pipeline for a translation model API packaged as an OCI container image. The pipeline needs a private Azure service to store versioned images and grant pull permissions to deployment identities. Which service should Proseware use?

   • AAzure Container Registry
   • BAzure Blob Storage
   • CAzure Container Apps
   • DAzure Kubernetes Service
   • EAzure Artifacts

   Show answer and explanation

   Correct answer

   • Azure Container Registry

   Explanation

   Azure Container Registry is Azure's private registry service for storing and managing container images and related artifacts. It supports Azure role assignments such as AcrPull and AcrPush for deployment and build identities.

   • Azure Blob Storage can store files, but it is not a container registry with image pull and push semantics.
   • Azure Container Apps runs containerized applications; it does not serve as the image registry.
   • Azure Kubernetes Service runs Kubernetes workloads; it still pulls images from a registry.
   • Azure Artifacts is used for package feeds such as NuGet, npm, and Maven, not as the Azure container image registry service.

   References:

   • Introduction to Azure Container Registry
   • Azure Container Registry Entra permissions and role assignments overview
   • Azure Container Registry Authentication Options Explained
9. Question 9Develop containerized solutions on Azure

   During a release rehearsal, a containerized summarization API on Azure Container Apps must keep the current version serving most traffic while a new image receives a small percentage of production requests. The team wants to change traffic weights without redeploying containers. What should you configure?

   • ASet the Container Apps revision mode to Multiple and configure ingress traffic weights.
   • BIncrease the Container Apps minimum replica count before deploying the new image.
   • CEnable session affinity on the Container Apps ingress configuration.
   • DPush the new image to the same tag in Azure Container Registry and make no Container Apps change.
   • ESet an Azure Container Instances restart policy on the container image.

   Show answer and explanation

   Correct answer

   • Set the Container Apps revision mode to Multiple and configure ingress traffic weights.

   Explanation

   Azure Container Apps revisions represent immutable snapshots of the application. Multiple revision mode allows more than one revision to be active at the same time, and ingress traffic-splitting rules can shift percentages between active revisions without rebuilding or redeploying containers.

   • Increasing minimum replicas improves capacity but does not keep two application revisions active for traffic splitting.
   • Session affinity can keep a client routed consistently, but it does not create canary traffic weights between revisions.
   • Pushing a new image tag to Azure Container Registry does not by itself change Container Apps traffic routing.
   • Azure Container Instances restart policy controls container restarts, not revision-based release traffic.

   References:

   • Update and deploy changes in Azure Container Apps
   • Azure Container Apps overview
   • az containerapp ingress traffic
10. Question 10Secure, monitor, troubleshoot Azure solutions

    For a quarterly audit, security analysts need to run KQL queries that join application traces from a workspace-based Application Insights resource with diagnostic logs from Azure AI services resources. Which Azure Monitor resource provides the query workspace?

    • ALog Analytics workspace
    • BAzure Event Hubs namespace
    • CAzure Storage account with diagnostic log archive
    • DAzure Service Health alert

    Show answer and explanation

    Correct answer

    • Log Analytics workspace

    Explanation

    A Log Analytics workspace stores Azure Monitor Logs data and provides the KQL query environment. Workspace-based Application Insights resources store their telemetry in a Log Analytics workspace, and diagnostic settings can send Azure resource logs to the same workspace for joined queries.

    • Event Hubs is used to stream telemetry to external systems, not to provide the KQL workspace.
    • A Storage account can archive diagnostic logs, but archived logs are not queried directly with Log Analytics KQL unless ingested into a workspace.
    • Azure Service Health alerts report Azure service incidents and planned maintenance; they are not a log analytics store.

    References:

    • Log Analytics workspace overview
    • Log queries in Azure Monitor
    • Diagnostic Settings in Azure Monitor

Membership includes 182 questions and explanations aligned to the AI-200 curriculum, including 8 case studies.

Other Microsoft certifications

Every one of these is included with the same membership as AI-200.

AB-900Microsoft

Microsoft 365 Copilot and Agent Administration Fundamentals

This exam is intended for candidates who are familiar with Microsoft 365, including core services, security, identity and access, data…

161 practice questionsView

AI-900Microsoft

Microsoft Azure AI Fundamentals

This exam measures knowledge of machine learning and AI concepts and related Microsoft Azure services. It is intended for candidates…

193 practice questionsView

AZ-900Microsoft

Microsoft Azure Fundamentals

This exam is intended for technology professionals who want to demonstrate foundational knowledge of cloud concepts and Microsoft Azure.…

170 practice questionsView

AI-200 exam FAQ