Secure, monitor, troubleshoot Azure solutions (20–25%)

Microsoft Certified: Azure AI Cloud Developer Associate · 50 questions

• A city Container App must load model API keys at runtime without baking them into the image. What should the team use?
• The RAG indexer Function’s shared service principal secret must rotate on a schedule without downtime. Which approach fits?
• Only the permits API identity should read the Cosmos key secret in Key Vault. What control enforces that?
• Production agent credentials live in Key Vault and must survive accidental deletion. Which protection should be enabled?
• An App Service hosting the clerk assistant should resolve secrets without copying values into app settings. What pattern should be used?
• The city wants to enable a new summarizer prompt version citywide without redeploying every service. Where should the toggle live?
• Non-secret model endpoints and temperature defaults for all 311 AI services should be centralized. Which service fits?
• Clerk assistant settings must differ between staging and production without separate key names for every value. What App Configuration feature helps?
• Parks bots must pick up new content-safety thresholds without redeploying containers. What capability is required?
• During an incident, outbound agent tools for the resident assistant must be disabled quickly. What control fits?
• Ops must follow one resident request across the API gateway, an Azure Function, and Cosmos DB. What should they implement?
• Trace context from the public chat UI must continue into Service Bus consumers that finish the work. What is required?
• Latency must be broken down across embedding, retrieval, and generation for the housing RAG path. How should instrumentation look?
• Container Apps running the transit assistant must send traces into Azure Monitor for analysis. What should the team configure?
• Council-night traffic spikes flood traces for the meeting assistant, but errors must still be captured. Which approach fits?
• During an outage, analysts must find Function failures tied to one Cosmos partition for the health records assistant. What should they use?
• Leaders need p95 latency of the permits chatbot API by Container Apps revision. Which technique applies?
• Ops suspect Cosmos RU exhaustion on the knowledge store after seeing client errors. What should a KQL investigation look for?
• Dead-letter count on the summarization queue must page on-call when it exceeds a threshold. How should that be implemented?
• A hard-to-reproduce agent bug needs Application Insights requests joined to container stdout. What correlation key should ops use?
• Staging identities must not read production secrets for the courts assistant. What Key Vault design fits?
• Internal agent-tool services need mutual TLS using a certificate the city manages centrally. Where should the certificate live?
• The transit RAG API needs both model temperature defaults and database connection secrets. How should they be split?
• After Key Vault rotation, the embedding worker fails with authorization errors. What is the most likely fix path?
• Diagnostics need a non-PII department id on traces for the multi-department resident portal. What OpenTelemetry mechanism fits?
• A city's 311 Container Apps revision starts returning errors after deploy. What KQL approach best diagnoses the bad revision?
• A parks permitting API emits custom token-count metrics. How should ops monitor generative cost proxies?
• A transit AKS cluster must retrieve secrets without exposing Key Vault to the public internet. What should the city implement?
• Staging App Configuration for a clerk RAG assistant is verified. How should settings move to production safely?
• After tuning KEDA for a housing caseworker queue, how should the team verify queue latency improved?
• Event Grid–triggered Functions for emergency notifications show intermittent failures. What should KQL highlight first?
• Court e-filing integration keys in Key Vault are approaching expiration. What operational practice should the clerk AI team follow?
• A water-utility agent pipeline uses Service Bus. How should send and receive be traced with OpenTelemetry?
• A civic RAG API intermittently fails talking to Azure Database for PostgreSQL. What should a KQL query surface?
• Internal agent services read App Configuration. How should the city harden networking?
• A permitting agent fails on secret get. How should ops correlate the failure?
• City AI microservices emit traces with inconsistent naming. What OpenTelemetry practice should leadership standardize?
• Production AI logs may contain case metadata. Who should be allowed to run KQL against that workspace?
• A new tool endpoint for library holds will roll out gradually. How should App Configuration and monitoring work together?
• Traces break between Azure Functions and Container Apps in a multi-hop civic agent path. What should the team investigate?
• After a deploy, managed identities for a housing AI API fail Key Vault gets. What alert should ops configure?
• Departments need different model deployment names without redeploying code. Where should those names live?
• Service Bus dead-letters pile up for a grants-processing AI job. How should KQL help?
• Resident PII sometimes appears in custom log dimensions. What balance should the city strike?
• Ops wants a health view for a multi-service permitting AI back end. What should the dashboard emphasize?
• A multi-agent workflow outage spanned messaging and Functions. How should post-incident analysis use KQL?
• A compromised secret version was disabled. How should the parks AI app retrieve secrets afterward?
• Citywide AI platforms depend on App Configuration reads. What availability consideration applies?
• AI workers consume Service Bus jobs for inspections. Which OpenTelemetry metrics help ops most?
• Embedding dimension mismatches start failing vector upserts citywide. How should KQL help find the pattern?