AI-200 Exam Dumps - Developing AI Cloud Solutions on Azure

Configure an Azure Private Endpoint through Azure Private Link for the Azure OpenAI resource and disable public network access. A private endpoint assigns the Azure OpenAI service a private IP address from the selected virtual-network subnet, enabling workloads inside the VNet—or connected networks with suitable routing and DNS—to reach the service over private Azure networking rather than through its public endpoint. Microsoft explicitly documents private endpoints as the mechanism for accessing an Azure OpenAI resource after public network access is disabled.

For complete network isolation, creating the private endpoint alone is not sufficient if the resource continues accepting public connections. Microsoft security guidance recommends validating private endpoint connectivity and then disabling public network access , ensuring that permitted application traffic flows through Private Link. Private DNS should also be configured so the normal Azure OpenAI hostname resolves to the private endpoint address from within the VNet.

Azure AI Content Safety controls harmful-content detection rather than network accessibility. API key rotation improves credential hygiene but does not prevent public network connectivity. CORS controls browser-origin behavior and is not a network-isolation boundary.

Therefore, the required network architecture is Private Endpoint + Azure Private Link , with public network access disabled.

Study Guide references: Azure OpenAI networking; Azure Private Link; private endpoints; private DNS; public network access controls.

Comply with the authentication policy for database access: Use managed identity authentication.

Support high-concurrency requests with minimal latency: Use a connection pooling library.

Protect database stability during traffic spikes: Configure maximum pool size.

The Recommendation API should use managed identity authentication because Fabrikam explicitly requires service-to-database authentication without long-lived credentials. Azure Container Apps managed identities allow applications to obtain Microsoft Entra tokens at runtime and access supported Azure resources without storing usernames, passwords, or connection secrets in application configuration.

For high-concurrency PostgreSQL access, implement a connection pooling library . Azure Database for PostgreSQL documentation recommends connection pooling because repeatedly opening new database connections creates backend processes and consumes CPU and memory. Reusing existing connections reduces connection-establishment overhead and improves latency and throughput. Azure also provides PgBouncer as a built-in pooling option for Flexible Server.

To protect PostgreSQL during sudden traffic spikes, configure a maximum pool size . An unlimited pool can allow application demand to create excessive concurrent connections, which can exhaust database memory and increase contention. Microsoft warns that increasing connection counts can cause significant performance degradation and recommends conservative connection limits combined with pooling.

Therefore, the optimal configuration combines managed identity + connection pooling + bounded pool size .

Study Guide references: Azure Container Apps managed identities; Azure Database for PostgreSQL connection management; PgBouncer; connection-pool sizing and resource protection.

Trigger scaling based on queue depth: Azure Service Bus scaler

Deallocate instances when the message queue is empty: Minimum replicas = 0

Prevent uncontrolled burst scaling: Maximum replicas = 10

The batch retraining workload must scale according to queue length , so the correct KEDA trigger is the Azure Service Bus scaler . KEDA integrates with Azure Service Bus and monitors queue or subscription metrics, allowing AKS workloads to scale according to the number of pending messages rather than CPU utilization or HTTP request concurrency. Microsoft documents KEDA as the event-driven autoscaling mechanism for AKS and specifically supports Azure-based scalers for queue-driven workloads.

To meet the requirement to deallocate workload instances when no messages remain, configure minimum replicas = 0 . KEDA supports scale-to-zero for event-driven workloads, which is particularly appropriate for intermittent batch or machine-learning processing because no pods need to remain running while the queue is empty. Microsoft specifically identifies scale-to-zero as a KEDA capability and recommends it for sporadic ML workloads where cost optimization is important.

Finally, configure maximum replicas = 10 . A finite maximum replica count establishes an explicit upper scaling boundary, preventing large queue bursts from creating an uncontrolled number of worker replicas and protecting both infrastructure cost and downstream services.

Study Guide references: AKS → KEDA; Azure Service Bus event-driven scaling; minReplicaCount; maxReplicaCount; scale-to-zero; autoscaling limits.

Verified Answer: `az containerapp env create ... --enable-workload-profiles`.

Detailed Explanation: The shared boundary for Container Apps is the managed environment. Apps in one environment can share the environment’s virtual network integration, observability destination, and Dapr-related environment configuration. Enabling workload profiles provides selectable compute profiles and resource sizing options for workloads in that environment. The CLI must therefore create a Container Apps environment and enable workload profiles. Creating an individual container app alone would not establish the common environment-level network, logging, and resource-profile boundary required by the scenario.

Study Guide Alignment: Containerized Azure workloads: registry builds, App Service containers, Container Apps revision/scaling behavior, and AKS deployment choices.

Official Microsoft Learn References: AI-200 Study Guide | Azure Container Apps environments

Detailed Explanation: The proposed partner-topic design does not match the stated need for one publisher endpoint that can fan events into thousands of logically distinct customer topics. Event Grid domains are specifically designed to expose a single publishing endpoint while containing large numbers of topics, with subscriptions and filtering applied at the topic level. Partner topics are intended for partner-published SaaS events and do not substitute for the domain architecture required by this high-scale custom publishing scenario.

Study Guide Alignment: Azure service integration: Service Bus, Event Grid, Azure Functions triggers/bindings, and event-driven processing.

Official Microsoft Learn References: AI-200 Study Guide | Azure Event Grid event domains | Authenticate Event Grid publishing with Microsoft Entra ID

Detailed Explanation: Gradual production rollout requires more than one revision to remain active and a mechanism to divide traffic between them. Multiple revision mode permits concurrent active revisions, and traffic splitting lets a specified percentage of requests flow to the new revision while the remainder stays on the proven revision. This also enables rapid rollback by returning traffic to the prior revision. Increasing replicas or restarting a revision changes capacity or process state, not release traffic distribution.

Study Guide Alignment: Containerized Azure workloads: registry builds, App Service containers, Container Apps revision/scaling behavior, and AKS deployment choices.

Official Microsoft Learn References: AI-200 Study Guide | Azure Container Apps revisions

Detailed Explanation: A semantic-search schema should use the pgvector vector type for embeddings so PostgreSQL can apply vector distance operators and vector indexes. The creation timestamp should use an actual timestamp data type so comparisons, range predicates, ordering, and indexes use date semantics rather than string ordering. Storing vectors or dates as free-form character data would sacrifice type validation and make similarity or date filtering less efficient and less reliable.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Vector similarity search with Azure PostgreSQL

The correct architecture uses an Azure Storage queue as an asynchronous buffer between the HTTP ingestion path and the computationally expensive image-processing workload. The HTTP-triggered function should accept the upload, enqueue a work message, and return promptly rather than waiting for image processing to finish. Microsoft specifically recommends asynchronous patterns for long-running HTTP operations because an HTTP-triggered Azure Function can encounter the Azure Load Balancer response timeout even though the underlying function continues executing.

A queue-triggered function then performs image processing independently. Azure Functions applies target-based scaling to Azure Queue Storage triggers based on queued workload, allowing worker capacity to expand as the backlog increases rather than being directly tied to HTTP arrival processing.

For reliability, Azure Queue-triggered Functions provide retry behavior. The visibilityTimeout setting controls the delay before a failed message becomes available for another attempt, while maxDequeueCount controls how many processing attempts occur before the message is transferred to the < queue-name > -poison queue. The default maximum is five attempts.

C defeats the asynchronous requirement. D can be useful for tracking upload state, but it does not itself provide workload decoupling, retry handling, or queue-driven scaling.

Study Guide references: Azure Functions → Queue Storage triggers and bindings; event-driven scaling; retry/poison queue behavior; asynchronous HTTP processing.