https://www.braindump2go.com/ai-200.html https://www.braindump2go.com/ai-200.html https://www.braindump2go.com/ai-200.html QUESTION 1 Hotspot Question You are implementing semantic retrieval in Redis. The solution must support low-latency, approximate nearest neighbor (ANN) vector similarity search for large-scale AI retrieval workloads. You need to select the appropriate vector schema settings. Which configuration values should you select? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: Vector The correct field type for storing and querying embeddings in Redis is VECTOR. Box 2: HNSW index To support low-latency, large-scale approximate nearest neighbor (ANN) vector search in Redis, you should use the HNSW (Hierarchical Navigable Small World) index type with Float32 data type. Reference: https://redis.io/docs/latest/develop/ai/search-and-query/vectors/ https://www.braindump2go.com/ai-200.html QUESTION 2 Drag and Drop Question You are developing a .NET application that uses Azure Cosmos DB for NoSQL to store application data. The application uses the Azure Cosmos DB for NoSQL SDK to interact with the database account. The application must perform the following tasks: - Initialize the connection by using the account endpoint and key. - Define shared throughput. - Perform create, read, update, and delete (CRUD) operations on items stored in a container. You need to implement the SDK components required for the application to access and manage data in Azure Cosmos DB for NoSQL. Which SDK components should you use? To answer, move the appropriate components to the correct requirements. You may use each component once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: CosmosClient To initialize the connection to an Azure Cosmos DB for NoSQL account using the account endpoint and key, you must use the CosmosClient class. Box 2: Database The database SDK component should be used to define shared throughput. In Azure Cosmos DB, shared throughput (provisioned Request Units per second or RU/s) is configured at the database level. When throughput is provisioned on a database, that capacity is shared among all the containers created within that specific database. Box 3: Container To perform item create, read, update, and delete (CRUD) operations, you should use the Container SDK component In the Azure Cosmos DB for NoSQL SDK for .NET, individual JSON documents (items) live inside a container. The Container class exposes the specific methods required to execute CRUD operations on these items. Reference: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-dotnet-get-started QUESTION 3 Drag and Drop Question You are developing a new page for a website that uses Azure Cosmos DB for data storage. The feature uses documents that have the following format: You must display data for the new page in a specific order. You create the following query for the page: You need to configure an Azure Cosmos DB policy to support the query. How should you configure the policy? To answer, drag the appropriate JSON segments to the correct locations. Each JSON segment may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. https://www.braindump2go.com/ai-200.html Answer: Explanation: Box 1: compositeIndexes Azure Cosmos DB requires a defined composite index for any query utilizing an ORDER BY clause with multiple properties. Box 2: descending In an ORDER BY clause, properties without an explicit direction default to ascending order. Your query ORDER BY p.name, p.city DESC translates to an ascending sort on /name and a descending sort on /city. Reference: https://docs.azure.cn/en-us/cosmos-db/index-policy QUESTION 4 An ACA app processes messages from an Azure Storage queue. The app must scale automatically based on messages in a specific Azure Storage queue by using a Kubernetes Event-driven Autoscaler (KEDA) custom scale rule. You need to configure the required scale rule values. Which two values should you configure? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Queue name B. Polling interval C. Trigger type D. Maximum replicas Answer: AC Explanation: [A] QeueName: The exact name of the specific Azure Storage queue your app is polling is required. [C] Why Trigger Type is Required When configuring a custom scale rule in Azure Container Apps (ACA), the platform utilizes KEDA underneath. Because a custom rule can connect to many different event sources (such as Kafka, Redis, or Azure Storage), you must explicitly define the Trigger type (e.g., azure-queue) so KEDA knows which specific scaler to initiate. https://www.braindump2go.com/ai-200.html Reference: https://techcommunity.microsoft.com/blog/fasttrackforazureblog/container-apps-a-practical-scaling-with-azure-queue-scale- rule/3722075 QUESTION 5 You have an Event Grid subscription that triggers an Azure Function. You need to prevent loss of events in case the endpoint returns an HTTP 400 response. Which action should you perform? A. Implement optimistic batching. B. Implement asynchronous handshake validation. C. Configure a dead - letter destination. D. Configure a retry policy. Answer: C Explanation: Configuring a dead-letter destination is exactly the right step to take. By default, when an endpoint returns an HTTP 400 (Bad Request) or HTTP 413 (Payload Too Large) response, Azure Event Grid immediately stops delivery attempts and drops the message. It treats these specific errors as non-transient, client-side issues, meaning it skips its standard 24-hour retry policy. Configuring a dead-letter destination ensures that these dropped events are safely preserved for future troubleshooting and reprocessing. Reference: https://turbo360.com/blog/azure-event-grid-dead-letter-monitoring QUESTION 6 You are developing an AI API deployed to ACA. The API requires database credentials that are stored in Key Vault. Key Vault is configured to use Azure RBAC for access control. The database credentials are rotated periodically by the security team. The application must always use the latest version of each credential without being redeployed and without exposing secrets in code or configurations. You need to implement a secure secret access strategy that prevents credential exposure and fetches the latest version of each secret at runtime without redeploying the container. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. A. Configure a Key Vault RBAC role assignment. B. Configure a Key Vault access policy. C. Export the secret during deployment. D. Assign a system - assigned managed identity. E. Retrieve the secret at runtime by using the SDK. Answer: ADE Explanation: Step-by-Step Implementation Guide 1. Assign a System-Assigned Managed Identity 2. Configure Key Vault RBAC Role Assignment Role Selection: Assign the Key Vault Secrets User role to the container app's managed identity. Scope Limitation: Limit the scope of this assignment to the specific Key Vault or individual secrets rather than the entire resource group. 3. Retrieve the Secret at Runtime Using the SDK Reference: https://oneuptime.com/blog/post/2026-02-16-how-to-use-managed-identity-with-azure-container-apps-to-access-azure-services/view QUESTION 7 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You plan to deploy a container to an Azure App Service API app named api1. You host the source code for api1 in a GitHub repository. The container uses the API key at runtime to connect to a backend service. The container must be able to retrieve the API key at runtime without exposing it in the source repository or Git commit history. You need to ensure that the API key remains outside of Git commit history and is available to the container at runtime. Solution: Store the API key as a GitHub repository secret. Does the solution meet the goal? https://www.braindump2go.com/ai-200.html A. Yes B. No Answer: B Explanation: Correct: * Store the API key in Azure Key Vault and reference it from an App Service application setting. Storing the API key in Azure Key Vault and referencing it via App Service application settings is the recommended, secure approach. This strategy completely removes sensitive credentials from your GitHub repository and Git commit history while injecting them safely into your container environment at runtime. Incorrect: * Embed the API key as a hardcoded environment variable in the Dockerfile. * Store the API key as a GitHub repository secret. Reference: https://www.qservicesit.com/full-stack-applications-on-azure QUESTION 8 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You plan to deploy a container to an Azure App Service API app named api1. You host the source code for api1 in a GitHub repository. The container uses the API key at runtime to connect to a backend service. The container must be able to retrieve the API key at runtime without exposing it in the source repository or Git commit history. You need to ensure that the API key remains outside of Git commit history and is available to the container at runtime. Solution: Embed the API key as a hardcoded environment variable in the Dockerfile. Does the solution meet the goal? A. Yes B. No Answer: B Explanation: Correct: * Store the API key in Azure Key Vault and reference it from an App Service application setting. Storing the API key in Azure Key Vault and referencing it via App Service application settings is the recommended, secure approach. This strategy completely removes sensitive credentials from your GitHub repository and Git commit history while injecting them safely into your container environment at runtime. Incorrect: * Embed the API key as a hardcoded environment variable in the Dockerfile. * Store the API key as a GitHub repository secret. Reference: https://www.qservicesit.com/full-stack-applications-on-azure QUESTION 9 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You plan to deploy a container to an Azure App Service API app named api1. You host the source code for api1 in a GitHub repository. The container uses the API key at runtime to connect to a backend service. The container must be able to retrieve the API key at runtime without exposing it in the source repository or Git commit history. You need to ensure that the API key remains outside of Git commit history and is available to the container at runtime. Solution: Store the API key in Azure Key Vault and reference it from an App Service application setting. Does the solution meet the goal? A. Yes B. No Answer: A Explanation: Correct: * Store the API key in Azure Key Vault and reference it from an App Service application setting. Storing the API key in Azure Key Vault and referencing it via App Service application settings is the recommended, secure approach. https://www.braindump2go.com/ai-200.html This strategy completely removes sensitive credentials from your GitHub repository and Git commit history while injecting them safely into your container environment at runtime. Incorrect: * Embed the API key as a hardcoded environment variable in the Dockerfile. * Store the API key as a GitHub repository secret. Reference: https://www.qservicesit.com/full-stack-applications-on-azure QUESTION 10 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You are preparing a production deployment for an Azure Function app. The app will run across multiple environments. The solution must support environment-specific configuration and prevent secrets from being stored in source control. You need to develop the solution. Solution: Store connection strings in the Function app application settings configured in the Azure Portal. Does the solution meet the goal? A. Yes B. No Answer: B Explanation: Correct: * Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity. This is an industry-standard best practice architectural pattern. Using Azure App Configuration combined with Azure Key Vault references completely satisfies your compliance requirements. It centralizes feature flags and non-sensitive configurations, keeps sensitive data safely out of source control, handles multi-environment deployments cleanly, and eliminates credentials via a passwordless Managed Identity. Incorrect: * Store connection strings in the Function app application settings configured in the Azure Portal. * Store production secrets in environment variables set by the Dockerfile. Reference: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references QUESTION 11 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You are preparing a production deployment for an Azure Function app. The app will run across multiple environments. The solution must support environment-specific configuration and prevent secrets from being stored in source control. You need to develop the solution. Solution: Store production secrets in environment variables set by the Dockerfile. Does the solution meet the goal? A. Yes B. No Answer: B Explanation: Correct: * Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity. This is an industry-standard best practice architectural pattern. Using Azure App Configuration combined with Azure Key Vault references completely satisfies your compliance requirements. It centralizes feature flags and non-sensitive configurations, keeps sensitive data safely out of source control, handles multi-environment deployments cleanly, and eliminates credentials via a passwordless Managed Identity. Incorrect: * Store connection strings in the Function app application settings configured in the Azure Portal. * Store production secrets in environment variables set by the Dockerfile. Reference: https://www.braindump2go.com/ai-200.html https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references QUESTION 12 Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear on the review screen. You are preparing a production deployment for an Azure Function app. The app will run across multiple environments. The solution must support environment-specific configuration and prevent secrets from being stored in source control. You need to develop the solution. Solution: Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity. Does the solution meet the goal? A. Yes B. No Answer: A Explanation: Correct: * Use App Configuration with Key Vault references to store environment-specific settings and secrets, accessed from the function app by using a managed identity. This is an industry-standard best practice architectural pattern. Using Azure App Configuration combined with Azure Key Vault references completely satisfies your compliance requirements. It centralizes feature flags and non-sensitive configurations, keeps sensitive data safely out of source control, handles multi-environment deployments cleanly, and eliminates credentials via a passwordless Managed Identity. Incorrect: * Store connection strings in the Function app application settings configured in the Azure Portal. * Store production secrets in environment variables set by the Dockerfile. Reference: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references QUESTION 13 Hotspot Question You are developing several microservices to run on Azure Container Apps. External HTTP ingress traffic has been enabled for the microservices. A deployed microservice must be updated to allow users to test new features. You have the following requirements: - Enable and maintain a single URL for the updated microservice to provide to test users. - Update the microservice that corresponds to the current microservice version. You need to configure Azure Container Apps. Which features should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer: https://www.braindump2go.com/ai-200.html Explanation: Box 1: Revision label You should use the revision labels feature in Azure Container Apps. This feature allows you to assign a dedicated, permanent URL to a specific version (or revision) of your microservice. Box 2: Revision mode The application's Revision mode must be configured to Multiple. This allows the existing (current) microservice version to remain active and serve production traffic concurrently while you spin up the updated revision for the test users to access safely. Reference: https://learn.microsoft.com/en-us/azure/container-apps/microservices QUESTION 14 Hotspot Question You deploy a private container image from Azure Container Registry (ACR) to App Service. App Service must authenticate to ACR to pull the image. The solution must NOT store static registry credentials. You need to configure the secure image pull authentication. Which configurations should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: Assign the Container Registry Reader role to a managed identity. To securely deploy a private container image from Azure Container Registry (ACR) to an Azure App Service without managing passwords, you should configure a Managed Identity on the App Service and grant it the AcrPull role on the ACR. Box 2: Use managed identity with role assignment. you should use a Managed Identity combined with an Azure Role-Based Access Control (RBAC) role assignment to meet the requirement. Reference: https://www.braindump2go.com/ai-200.html https://medium.com/@miketobicarter/deploying-a-net-app-to-azure-using-docker-acr-app-service-and-github-actions-step-by-step- 3ed6ae8a4d0b QUESTION 15 Hotspot Question You deploy a Linux container image to App Service. The container requires the following environment variables at runtime: - A non-sensitive configuration value named MODEL_VERSION - A database password that must remain secure You need to configure App Service to provide these environment variables at runtime. Which configurations should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: App setting with plain text value To provide a non-sensitive environment variable named MODEL_VERSION to a Linux custom container deployed to Azure App Service, you should configure it as an Application Setting (App Setting). In Azure App Service, any custom configuration defined within the Application Settings is automatically injected into Linux containers as an environment variable at runtime. Box 2: Key Vault reference syntax You should configure the database password as an Azure Key Vault reference inside App Service Application Settings. This prevents the secret from being stored in plaintext in the app configuration and injects it securely into the container as an environment variable at runtime. Reference: https://learn.microsoft.com/en-us/azure/app-service/tutorial-custom-container?tabs=azure-cli&pivots=container-linux QUESTION 16 Hotspot Question You plan to deploy a web app to App Service on Linux. You create an App Service plan. You create and push a custom Docker image that contains the web app to Azure Container Registry. You need to access the console logs generated from inside the container in real-time. How should you complete the Azure CLI command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. https://www.braindump2go.com/ai-200.html Answer: Explanation: Box 1: config Modifies the logging configuration settings for the specified Web App. Box 2: --docker-container-logging --docker-container-logging: The explicit parameter that defines where or how Docker container console logs are saved (e.g., filesystem). Configure Logging: az webapp log config --name ContosoWeb --resource-group ContosoDevRg --web-server-logging filesystem Box 3: webapp webapp specifies the group identifier within the az CLI execution context. Box 4: tail tail: Initiates a live, real-time diagnostic log stream directly from the active Linux container. Reference: https://learn.microsoft.com/en-gb/answers/questions/2225551/mis-show-azure-container-app-logs QUESTION 17 Hotspot Question A Python web API uses OpenTelemetry for tracing. The call_downstream_service function makes an outbound HTTP request by using the requests library. The following code is the only OpenTelemetry configuration in the application: For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. https://www.braindump2go.com/ai-200.html Answer: Explanation: Box 1: Yes This code will successfully create a local span for the process_request function, but it will not automatically create or propagate spans for the outbound HTTP request made by the requests library. Box 2: No Manual tracing only: Your current configuration only creates a span for the code wrapped inside the with tracer.start_as_current_span(...) context manager. Box 3: Yes Missing instrumentation: The standard requests library does not natively know about OpenTelemetry. It requires an external instrumentation package to hook into its network calls. Reference: https://learn.microsoft.com/en-us/python/api/overview/azure/core-tracing-opentelemetry-readme QUESTION 18 Hotspot Question You are using Python SDK to develop a containerized AI application that retrieves the value of a runtime setting stored in an Azure App Configuration resource. The application will run in Azure in the security context of a managed identity. The application must work in a local development environment without any code changes. You need to complete the code that implements the retrieval. How should you complete the code? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: DefaultAzureCredential This class from the azure-identity library provides an automated, sequenced token authentication flow. When running locally, it automatically falls back to your local development environment credentials (such as Azure CLI, environment variables, or VS Code https://www.braindump2go.com/ai-200.html login). Once deployed to Azure, it seamlessly switches to the environment's managed identity without requiring any code changes. Box 2: get_configuration_setting This method belongs to the AppConfigurationClient in the azure-appconfiguration SDK. It is used to fetch a specific configuration key- value pair using its key name ("FeatureX") and an optional label. Reference: https://learn.microsoft.com/en-us/azure/developer/python/tutorial-containerize-deploy-python-web-app-azure-04 QUESTION 19 Hotspot Question You are reviewing the Python tracing configuration for an application that must send distributed traces to Azure Monitor. The following code configures OpenTelemetry tracing: For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: Yes Yes, the code configures the tracer provider before any spans are created. While the tracer provider initialization sequence is structurally correct, no spans can be captured yet at the moment the tracer instance is fetched because the processor and exporter are attached too late in the execution flow. Box 2: No No, this configuration does not export traces synchronously. The code utilizes BatchSpanProcessor, which batches completed spans and exports them asynchronously on a background thread to prevent telemetry collection from blocking your main application code. Box 3: Yes Yes, this configuration successfully enables the export of distributed traces to Azure Monitor. The code provided correctly initializes and wires up the native OpenTelemetry SDK components with the official Azure Monitor exporter library. Reference: https://learn.microsoft.com/en-us/python/api/overview/azure/monitor-opentelemetry-exporter-readme QUESTION 20 Hotspot Question A company uses Azure Monitor Application Insights to monitor application behavior, including incoming requests and dependencies. You must identify failed requests from the last hour. You must also calculate the average duration of failed request dependency calls, grouped by operation name. You need to analyze telemetry in Application Insights. Which operators should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. https://www.braindump2go.com/ai-200.html Answer: Explanation: Box 1: where Filter telemetry rows The where operator filters a table to rows that satisfy a specific predicate. Both box 1 and box 2 require filtering telemetry data to the last hour (timestamp > ago(1h)). Box 2: where In the Kusto Query Language (KQL), the where operator filters a table to rows that satisfy a specific predicate or condition. Inside the inner subquery, you need to filter the dependencies telemetry table to only include records from the last hour (timestamp > ago(1)) Box 3: summarize Aggregate calculated data The summarize operator produces a table that aggregates the content of the input table. It is used here with the avg() aggregation function to calculate the average duration grouped by the operation_Name. Reference: https://tryhackme.com/room/kqlkustobasicqueries QUESTION 21 Drag and Drop Question A Python API retrieves a document from Azure Database for PostgreSQL by using a SQL statement. The API accepts the document ID from user input. The current implementation inserts the document ID directly into the SQL statement. You need to secure the SQL statement execution by minimizing the possibility of SQL injection. How should you modify the current implementation? To answer, move the appropriate configurations to the correct requirements. You may use each configuration once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. https://www.braindump2go.com/ai-200.html Answer: Explanation: Box 1: Use a parameterized query To secure your SQL statement against SQL injection, you must replace direct string insertion with parameterized queries (also known as prepared statements). Box 2: Pass the ID as an argument The current implementation inserts the document ID directly into the SQL statement. Box 3: Supply the parameter tuple to the SDK method Supply parameter tuples: Pass the user input as a separate tuple or list argument into your database driver's execution method (e.g., cursor.execute(query, (document_id,))). Reference: https://www.stackhawk.com/blog/finding-and-fixing-sql-injection-vulnerabilities-in-flask-python/ QUESTION 22 Drag and Drop Question You are deploying an Azure Function app that retrieves secrets from Key Vault by using a managed identity. The deployment must ensure that identity and secret configuration are in place before the function code is deployed. You need to deploy the function app securely. In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order. Answer: Explanation: Step 1: Create the function app You must first provision the underlying Azure Functions infrastructure before you can bind an identity or configuration settings to it. Step 2: Assign a managed identity to the function app Turning on the managed identity (such as a system-assigned identity) creates a distinct security principal in Microsoft Entra ID for the resource. Step 3: Grant access to Key Vault Use the managed identity's principal ID to create an access policy or RBAC role assignment in Key Vault, allowing the app to read secrets. Step 4: Add Key Vault references to application settings. https://www.braindump2go.com/ai-200.html Configure the Function App’s applic ation settings to point to the Key Vault secret URIs (@Microsoft.KeyVault(...)), which can now be securely resolved by the identity. Step 5: Deploy the function code Finally, deploy the application code. This ensures that when the code initializes and executes, all environment variables and secrets are already active and accessible, preventing application startup failures. Reference: https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references QUESTION 23 Drag and Drop Question You are developing a serverless Java application on Azure. You create a new Azure Key Vault to work with secrets from a new Azure Functions application. The application must meet the following requirements: - Reference the Azure Key Vault without requiring any changes to the Java code. - Dynamically add and remove instances of the Azure Functions host based on the number of incoming application events. - Ensure that instances are perpetually warm to avoid any cold starts. - Connect to a VNet. - Authentication to the Azure Key Vault instance must be removed if the Azure Functions application is deleted. You need to grant the Azure Functions application access to the Azure Key Vault. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer: Explanation: Step 1: Create the Azure Functions app with a Premium plan type Perpetually Warm & VNet: The Premium plan type is the only serverless-scale hosting option that satisfies requirement 3 (keeping instances warm to eliminate cold starts) and requirement 4 (native regional VNet integration). The Consumption plan type does not keep instances warm and does not support VNet injection. Event-Driven Scaling: It fulfills requirement 2 by dynamically adding and removing host instances using the event-driven scale controller. Step 2: Create a system-assigned managed identity for the application Lifecycle Coupling: It directly satisfies requirement 5. A system-assigned managed identity is tied strictly to the lifecycle of the Azure Functions resource. If the Functions application is deleted, Azure automatically removes the identity and its authentication token, ensuring that access to the Key Vault is immediately revoked. A user-assigned identity exists as an independent resource and would persist after the application's deletion. Step 3: Create an access policy in Azure Key Vault for the application identity Granting Permissions: This step completes the access requirements. By adding an access policy (or an Azure RBAC role assignment) in Azure Key Vault specifically for the created system-assigned managed identity, you grant the runtime environment the necessary permissions to retrieve secrets. No Code Changes: Combining the managed identity with an App Setting configured as an Azure Key Vault Reference allows the Functions platform to fetch secrets automatically at runtime, keeping your Java source code unchanged Reference: https://learn.microsoft.com/en-us/azure/azure-functions/functions-best-practices QUESTION 24 Drag and Drop Question A Python API running in ACA must send distributed traces to Azure Monitor. The API creates spans. However, no traces appear in Azure Monitor. You need to configure the OpenTelemetry SDK pipeline to export traces to Azure Monitor. What should you do? To answer, move the appropriate actions to the correct requirements. You may use each action once, more than https://www.braindump2go.com/ai-200.html once, or not at all. You may need to move the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer: Explanation: Box 1: Create the Azure Monitor component that sends trace data To register a global TracerProvider in OpenTelemetry, you must call the SetTracerProvider method on the global tracer provider object, passing in your fully configured TracerProvider instance. Box 2: Configure a span processor to send spans to the exporter To export OpenTelemetry traces to Azure Monitor using the Python SDK, you must configure a span processor (such as BatchExportSpanProcessor), pass your initialized Azure Monitor trace exporter to it, and register that span processor with your global tracer provider. Box 3: Initialize the application's TracerProvider for tracing Box 4: Call tracer.start_as_current_span() Acquire your tracer and create spans. Example code (continued from box 2 above): tracer = trace.get_tracer(__name__) with tracer.start_as_current_span("hello-aca-span") Reference: https://learn.microsoft.com/en-us/azure/durable-task/sdks/durable-task-scheduler-opentelemetry-tracing https://learn.microsoft.com/en-us/python/api/overview/azure/monitor-opentelemetry-exporter-readme QUESTION 25 You are building a RAG (retrieval-augmented generation) solution using Azure AI Foundry. The knowledge base consists of 50,000 PDF documents stored in Azure Blob Storage. You need to make the document content searchable by the language model with minimal custom code. What should you use? A. Azure AI Search integrated vectorization with a skillset B. Azure Cognitive Service for Language custom text classification C. Azure Functions to manually chunk and embed each document D. Azure Table Storage with full - text indexing Answer: A Explanation: Azure AI Search's integrated vectorization feature lets you point a skillset directly at a blob data source, and it handles chunking, embedding generation (via an Azure OpenAI embedding model), and indexing automatically -- minimizing custom code compared to manually building a chunking/embedding pipeline. QUESTION 26 You deploy a GPT-4o model in Azure AI Foundry. Users report inconsistent completions for the same prompt. You need to make outputs more deterministic without changing the prompt. What should you do? A. Increase the max_tokens parameter B. Set temperature to a low value such as 0 C. Increase the top_p parameter D. Enable content filtering Answer: B Explanation: Temperature controls randomness in token selection. Setting it near 0 makes the model consistently choose the highest-probability next token, producing more deterministic and repeatable output for identical prompts. https://www.braindump2go.com/ai-200.html QUESTION 27 You are developing an application that must extract structured field data (invoice number, total, vendor name) from scanned invoices in multiple layouts. You need a solution that requires no custom model training. What should you use? A. Azure AI Vision Read API B. Azure AI Document Intelligence prebuilt invoice model C. Azure AI Language custom named entity recognition D. Azure AI Document Intelligence custom neural model Answer: B Explanation: The prebuilt invoice model in Azure AI Document Intelligence is trained to recognize common invoice fields (vendor, total, line items, invoice number) out of the box across varied layouts, requiring no training data or custom model. QUESTION 28 Your chat application calls Azure OpenAI Service. You need to prevent the model from returning content that promotes self-harm, even if the prompt is crafted to bypass instructions. What should you configure? A. A system message instructing the model to refuse harmful topics B. Azure AI Content Safety filters on the Azure OpenAI resource C. A lower max_tokens value D. Azure AI Search semantic ranking Answer: B Explanation: System messages can be circumvented by adversarial prompting. Content Safety filters operate independently of the model and inspect both input and output, blocking harmful categories (including self-harm) regardless of prompt engineering. QUESTION 29 You need to give an Azure OpenAI-based agent the ability to call a company's internal REST API to check order status during a conversation. What should you implement? A. Prompt flow variant testing B. Function calling (tools) with a defined JSON schema C. Fine - tuning the model on order data D. Azure AI Search vector index over order records Answer: B Explanation: Function calling lets you describe available functions/tools with a JSON schema; the model decides when to invoke them and with what arguments, and your application executes the actual API call and returns results to the model. QUESTION 30 You are choosing an embedding strategy for a RAG solution. Documents range from 2 to 200 pages. You need to preserve semantic coherence while staying within embedding model token limits. What should you do? A. Embed each entire document as a single vector B. Chunk documents into smaller overlapping segments before embedding C. Use only document titles for embedding D. Convert documents to images and use image embeddings Answer: B Explanation: Embedding models have token limits, and embedding an entire long document as one vector dilutes semantic meaning. Chunking into smaller, slightly overlapping segments preserves context at chunk boundaries and keeps each chunk within model limits while improving retrieval relevance. QUESTION 31 You are deploying a model in Azure AI Foundry and must ensure the endpoint can handle unpredictable bursts of traffic while keeping cost l