Pass the Microsoft Certified: Azure AI Cloud Developer Associate AI-200 Questions and answers with ExamsMirror

Step 1: Create the Azure Functions app with a Consumption plan type.

Use the Consumption plan for serverless.

Step 2: Create a system-assigned managed identity for the application.

Create a system-assigned managed identity for your application.

Key Vault references currently only support system-assigned managed identities. User-assigned identities cannot be used.

Step 3: Create an access policy in Key Vault for the application identity.

Create an access policy in Key Vault for the application identity you created earlier. Enable the " Get " secret permission on this policy. Do not configure the " authorized application " or applicationId settings, as this is not compatible with a managed identity.

Azure Container Apps session affinity, also called sticky sessions , routes requests from the same client to the same container-app replica. Microsoft documents that this functionality is implemented using HTTP cookies , so it requires HTTP ingress rather than raw TCP ingress.

The second requirement is single revision mode . Microsoft explicitly states that session affinity is supported only when the container app is in single revision mode and HTTP ingress is enabled . In single revision mode, all traffic is directed to the latest active revision, allowing the ingress layer to consistently associate a client with a particular replica within that revision.

Multiple revision mode is designed for scenarios such as traffic splitting, blue-green deployments, and A/B testing, where inbound traffic can be distributed among multiple active revisions. That model is incompatible with the documented session-affinity restriction. TCP ingress is also incorrect because sticky-session behavior relies on HTTP cookie affinity rather than generic TCP connection routing.

Therefore, the required configuration is HTTP ingress with single revision mode .

Study Guide references: Azure Container Apps → ingress; sticky sessions/session affinity; revision modes; HTTP routing.

onnection pooling technology: PgBouncer. Pooling mode: Transaction pooling mode.

Detailed Explanation: Azure Database for PostgreSQL Flexible Server supports PgBouncer to reduce connection setup cost and protect the server from excessive client sessions. For a high-concurrency API whose requests do not require a server session to remain pinned between transactions, transaction pooling maximizes reuse by returning the server connection to the pool after each transaction. Session pooling holds a server connection for the lifetime of the client session and therefore provides less multiplexing under the connection-pressure scenario described.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | PgBouncer in Azure Database for PostgreSQL

Detailed Explanation: Azure Container Apps uses KEDA-based scale rules for event-driven workloads. A Service Bus scaler can monitor queue depth and create replicas only when messages are pending. To meet the explicit cost requirement, the scale configuration must permit a minimum replica count of zero so all active replicas can terminate when the queue is empty. Increasing the maximum replica count changes peak capacity, and HTTP ingress concurrency is not the correct scaling signal for a background Service Bus consumer.

Study Guide Alignment: Containerized Azure workloads: registry builds, App Service containers, Container Apps revision/scaling behavior, and AKS deployment choices.

Official Microsoft Learn References: AI-200 Study Guide | Set scaling rules in Azure Container Apps

Use an Azure Event Grid trigger for event-driven processing of new blob uploads. Azure Blob Storage can publish events such as Microsoft.Storage.BlobCreated to Event Grid, which then pushes the event to the subscribed Azure Function or other event handler. This eliminates the need for the application to periodically scan the storage container for changes.

Microsoft distinguishes traditional polling-based Blob triggers from event-driven Blob/Event Grid processing . Event Grid-based processing provides low-latency, near-real-time delivery and supports high-scale workloads. Microsoft specifically notes that the Event Grid source eliminates polling delays and can process newly created blobs within seconds of upload.

A Timer trigger would explicitly introduce polling on a schedule. A Queue Storage trigger requires another component to place a message in a queue when the blob arrives, so it is not the direct event source described. An HTTP trigger requires an external caller to invoke the function and therefore does not automatically react to a Blob Storage creation event.

Therefore, Event Grid is the correct trigger for automatic, low-latency, non-polling blob processing.

Study Guide references: Azure Functions → Event Grid triggers; Azure Blob Storage events; event-driven Blob processing; BlobCreated events; near-real-time processing.

===============

uthenticate App Service to ACR: assign the registry pull role to a managed identity. Avoid static credentials: configure App Service to use that managed identity for the image pull.

Detailed Explanation: App Service can pull a private image from Azure Container Registry by using a managed identity rather than registry username/password credentials. The identity must be granted an appropriate pull-only registry role at the registry scope, preserving least privilege. A webhook does not authenticate an image pull, and enabling the ACR admin account or storing a registry password would introduce static credentials. The managed-identity approach satisfies both secure authentication and credential-elimination requirements.

Study Guide Alignment: Containerized Azure workloads: registry builds, App Service containers, Container Apps revision/scaling behavior, and AKS deployment choices.

Official Microsoft Learn References: AI-200 Study Guide | Configure a custom container for App Service | Managed identities for Azure resources

The applicable Azure OpenAI control is Modified Abuse Monitoring . Microsoft documents that customers processing highly sensitive or confidential information can apply to modify the normal abuse-monitoring process when they cannot permit Microsoft to store or conduct human review of prompts and completions. Approval is subject to Microsoft ' s Limited Access eligibility requirements and must be requested through the designated Microsoft process.

For approved configurations, the abuse-monitoring treatment of prompts and completions is modified so that normal human review does not occur. Microsoft guidance on zero-data-retention scenarios specifically directs eligible customers to request Modified Abuse Monitoring rather than attempting to achieve the requirement by disabling unrelated telemetry services.

Disabling Azure Monitor does not change Azure OpenAI ' s service-side abuse-monitoring policy; it only affects customer-configured operational telemetry. Changing the model version likewise has no direct effect on retention requirements. Storing application data in Cosmos DB controls the application ' s own persistence layer and does not govern Azure OpenAI service processing.

Therefore, among the available choices, A is the required action. More precisely, the relevant request is Modified Abuse Monitoring ; modified content filtering/Guardrails is a separate control unless the organization also requires changes to safety filtering.

Study Guide references: Azure OpenAI → Data privacy and security; Abuse monitoring; Modified Abuse Monitoring; Limited Access requirements.

===============

File name: host.json

Function name: f3

Azure Functions dynamic concurrency is enabled at the function-app host level in the host.json file . The concurrency configuration section contains the dynamicConcurrencyEnabled property. Setting this value to true enables the Functions host to dynamically learn and adjust concurrency levels for supported triggers rather than requiring fixed manual limits.

Although dynamic concurrency is enabled globally, Microsoft explicitly states that the learned concurrency level is managed independently for each individual function . This allows a resource-intensive function to operate at a lower concurrency level while a lightweight function in the same app can execute with greater concurrency, protecting host health while maximizing throughput.

Of the functions listed, f3 , which uses an Azure Queue Storage trigger , supports dynamic concurrency. Microsoft currently documents dynamic concurrency support for Azure Queue Storage, Azure Blob Storage, and Azure Service Bus triggers , subject to the required extension versions. HTTP and Timer triggers do not participate in this dynamic-concurrency model.

Therefore, configure dynamic concurrency in host.json , and f3 is the function whose concurrency will be dynamically managed.

Study Guide references: Azure Functions → Concurrency; Dynamic concurrency; host.json; Queue Storage trigger concurrency.