Microsoft Azure AI Cloud Developer (AI-200) Exam Questions 2026
Microsoft Azure AI Cloud Developer (AI-200) Exam Questions 2026
Visit Official SkillCertPro Website :-
For a full set of 600 questions. Go to
https://skillcertpro.com/product/microsoft-azure-ai-cloud-developer-ai-200-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.
Question 1:
Your AI agent needs to access sensitive tenant-specific data in an Azure SQL Database. You want to ensure that the agent can only access rows belonging to the current user‘s organization. Which database feature should you implement?
A.Transparent Data Encryption
B.Always Encrypted
C.Dynamic Data Masking
D.Row-Level Security (RLS)
Answer: D
Explanation:
Correct
D. Row-Level Security (RLS): This is the correct answer. RLS enables you to control access to rows in a database table based on the characteristics of the user executing a query (such as their organization ID or tenant ID). By implementing RLS, you define security predicates that automatically filter the result set, ensuring the AI agent can only retrieve or modify data that belongs to the specific organization it is currently servicing.
Incorrect:
A. Transparent Data Encryption (TDE): Incorrect. TDE is a "data at rest" encryption technology. It protects the physical files (database files, log files, backups) from unauthorized access by encrypting them at the storage level. It does not control access to specific data rows based on user identity or organizational context.
B. Always Encrypted: Incorrect. Always Encrypted is designed to protect sensitive data (like credit card numbers or government IDs) so that even database administrators cannot see the plaintext values. While it enhances security, it does not provide the row-level filtering logic needed to restrict a user's access to only a subset of organizational records.
C. Dynamic Data Masking (DDM): Incorrect. DDM limits the exposure of sensitive data by masking it in the result set for non-privileged users (e.g., showing only the last four digits of a phone number). While it prevents users from seeing the full data, it does not prevent them from accessing the row itself, nor does it provide the logic to filter rows based on a specific organizational ID.
Question 2:
Your AI agent is running in a private VNet. You need to ensure that the agent can send its telemetry to Application Insights without using the public internet. What should you configure?
A.An NSG ‘Allow‘ rule for port 80
B.A Site-to-Site VPN
C.A Public IP address
D.A Private Link for Azure Monitor (AMPLS)
Answer: D
Explanation:
Correct
D. A Private Link for Azure Monitor (AMPLS): This is the correct answer. Azure Monitor Private Link Scope (AMPLS) allows you to connect your Azure resources—such as your AI agent's environment—to your Application Insights workspace over a private endpoint. By doing this, all telemetry data is transmitted exclusively via the Microsoft backbone network, ensuring that traffic never traverses the public internet, which is a critical requirement for private VNet architectures.
Incorrect:
A. An NSG ‘Allow‘ rule for port 80: Incorrect. A Network Security Group (NSG) rule is a filter for traffic, but simply allowing port 80 does not change the destination of the traffic. Traffic routed to Application Insights would still attempt to communicate with the public service endpoint, effectively bypassing the goal of keeping traffic off the public internet.
B. A Site-to-Site VPN: Incorrect. A Site-to-Site VPN is designed to connect your on-premises network to an Azure VNet. While it provides secure connectivity between two points, it does not provide a private connection between your VNet and the specific Azure Platform-as-a-Service (PaaS) resource (Application Insights).
C. A Public IP address: Incorrect. Assigning a Public IP address to your agent is the opposite of the requirement. It would expose the agent to the public internet, violating the principle of keeping the agent and its communication path private.
Question 3:
Your AI search solution is returning results that are conceptually correct but outdated. You want the search results to prioritize newer documents while still maintaining semantic relevance. Which feature of Azure AI Search should you implement?
A.Synonym Maps
B.Semantic Ranker
C.Freshness Scoring Profile
D.Indexer Schedule
Answer: C
Explanation:
Correct
C. Freshness Scoring Profile: This is the correct answer. Azure AI Search allows you to define "Scoring Profiles" to influence the relevance score of search results. You can use a freshness function within a scoring profile, which utilizes a DateTime field (such as a publication or modification date) to boost the score of newer documents, ensuring they appear higher in the result set while still respecting the underlying search relevance.
Incorrect:
A. Synonym Maps: Incorrect. Synonym maps are used to expand search queries to include related terms (e.g., mapping "laptop" to "notebook"). While they improve recall, they have no mechanism for measuring or prioritizing the recency of documents.
B. Semantic Ranker: Incorrect. The Semantic Ranker uses deep learning models to improve the precision of search results by understanding the context and intent of the user’s query. While it is excellent for relevance, it is not a feature for time-based document prioritization.
D. Indexer Schedule: Incorrect. An indexer schedule controls when the search index is updated with new data from your data source. It ensures the index contains current information, but it does not influence the ranking or ordering of those documents once the search query is executed.
Question 4:
You want to monitor the performance of your AI application‘s API calls and track the ‘Time to First Token‘ (TTFT). Which Azure tool provides the best custom telemetry and dashboarding for this?
A.Azure Blueprints
B.Azure Advisor
C.Application Insights
D.Azure Policy
Answer: C
Explanation:
Correct
B. Compass or a standard MongoDB shell: This is the correct answer. Because the vCore-based Azure Cosmos DB for MongoDB is wire-compatible with native MongoDB, it supports standard MongoDB commands and drivers. Developers manage vector indexes (such as creating the vectorSearch index) using native MongoDB commands like createSearchIndex via the mongosh shell or graphical management tools like MongoDB Compass. This is the standard operational procedure for index management in this environment.
Incorrect:
A. Azure CLI with the ‘cosmosdb‘ extension: Incorrect. While the Azure CLI is excellent for managing Azure infrastructure (e.g., creating the database cluster, scaling throughput, or managing VNet settings), it is not designed to interact with the internal schema, collection metadata, or vector indexing logic inside the MongoDB database.
C. Azure Data Factory: Incorrect. Azure Data Factory is a cloud-based data integration service used for orchestrating data movement and transformations between different storage sources. It is not an administrative tool for database index management.
D. Azure Storage Explorer: Incorrect. Azure Storage Explorer is a tool designed to manage Azure Blob Storage, Tables, Queues, and Files. It does not provide the interface or command-line capability to manage MongoDB-specific vector indexes.
Question 5:
Your AI agent is experiencing high latency. You suspect the bottleneck is the ‘Vector Search‘ step in Azure AI Search. Which metric in Azure Monitor should you check to confirm the time spent on queries?
A.Search Latency (msec)
B.Indexer Status
C.Document Count
D.Throttled Requests
Answer: A
Explanation:
A. Search Latency (msec): This is the correct answer. In Azure AI Search, Search Latency is a built-in platform metric in Azure Monitor that specifically tracks the average time (in milliseconds) it takes for a search query to complete. If your AI agent is experiencing high latency, this metric provides the direct evidence needed to confirm if the bottleneck is occurring within the search service itself.
Incorrect:
B. Indexer Status: Incorrect. The Indexer Status metric (or status codes) tells you whether the data ingestion process succeeded or failed. While indexer health is important for keeping your index up to date, it does not provide information on the performance or duration of active search queries.
C. Document Count: Incorrect. The document count simply tells you how many items are in your index. While a massive index could theoretically impact performance, this metric is a measure of data volume, not a measure of query execution time or latency.
D. Throttled Requests: Incorrect. Throttled requests (often monitored via the Throttled Search Queries Percentage metric) tell you that your service is overwhelmed and rejecting queries because it has reached its capacity limits. While throttling causes high latency for the user (due to retries or dropped requests), it is a different signal than "Search Latency," which measures the execution speed of the queries that do get processed.
For a full set of 600 questions. Go to
https://skillcertpro.com/product/microsoft-azure-ai-cloud-developer-ai-200-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.
Question 6:
Your AI solution on AKS is experiencing intermittent network timeouts when calling an external API. You want to capture a packet trace from the pod to see the raw network traffic. Which tool is best for this?
A.The ‘kubectl debug‘ node with a packet capture tool
B.Azure Monitor Metrics
C.The Azure Portal Console
D.Azure Activity Log
Answer: A
Explanation:
Correct
A. The ‘kubectl debug‘ node with a packet capture tool: This is the correct answer. When debugging network timeouts in AKS, you need to see the actual TCP/IP handshake and payload packets as they leave and enter the container. kubectl debug allows you to create a temporary, privileged ephemeral container attached to your running pod's network namespace. You can then use command-line utilities like tcpdump or tshark within that container to capture raw traffic, which is essential for diagnosing intermittent network timeouts.
Incorrect:
B. Azure Monitor Metrics: Incorrect. While Azure Monitor Metrics can show you that your application is experiencing errors (like 5xx status codes or dropped connections), it provides aggregated data at the platform level. It cannot show you the contents of the packets, the TCP retransmission counts, or the specific network handshake failures required to diagnose a timeout.
C. The Azure Portal Console: Incorrect. The standard Azure Portal console (e.g., Azure Cloud Shell) allows you to interact with the Azure API, but it does not have the necessary low-level access to the specific pod’s network interface or the ability to run packet capture tools directly on an AKS node.
D. Azure Activity Log: Incorrect. The Activity Log records "control plane" events in your Azure subscription (e.g., who created a resource, when a VM was scaled, or when a cluster was deleted). It does not contain network-level data for traffic flowing through a pod.
Question 7:
Your AI agent needs to call a secure internal API. You want to use a Managed Identity to authenticate. Which header must the agent include in the HTTP request after requesting a token from the local identity endpoint?
A.Content-Type: application/json
B.X-API-KEY
C.Authorization: Bearer
D.Cookie: sessionid
Answer: C
Explanation:
Correct
C. Authorization: Bearer: This is the correct answer. When your AI agent retrieves an access token from the local Managed Identity endpoint (typically the IMDS endpoint at [http://169.254.169.254](http://169.254.169.254)), the token is returned as a JSON Web Token (JWT). To authenticate successfully with a protected Azure API, the agent must include this token in the HTTP header of the request using the Authorization header followed by the Bearer scheme (e.g., Authorization: Bearer <token>). This is the standard OAuth 2.0 pattern for token-based authentication.
Incorrect:
A. Content-Type: application/json: Incorrect. While this header is necessary to inform the API that your request body is formatted as JSON, it has no role in the authentication or authorization process.
B. X-API-KEY: Incorrect. An API Key is a static, shared secret used for authentication, usually provided by the service owner. Managed Identity uses short-lived, dynamic tokens rather than static keys; therefore, this header is not used in this workflow.
D. Cookie: sessionid: Incorrect. Cookies are generally used for session state management in web browsers. They are not the standard mechanism for machine-to-machine authentication when using Azure Managed Identities and Bearer tokens.
Question 8:
Your AI application requires high-performance caching for frequently accessed vector results. You decide to use Azure Managed Redis. Which eviction policy should you select to ensure the most recently used data stays in memory when the cache is full?
A.allkeys-random
B.allkeys-lru
C.noeviction
D.volatile-ttl
Answer: B
Explanation:
Correct
B. allkeys-lru: This is the correct answer. The LRU (Least Recently Used) algorithm tracks access patterns and evicts the keys that haven't been accessed for the longest time. When you select allkeys-lru, Redis applies this logic across the entire keyspace. This ensures that the data you are accessing most frequently (your "hot" vector results) remains in memory, while older, unused data is removed to make space when the cache reaches its memory limit.
Incorrect:
A. allkeys-random: Incorrect. This policy removes keys at random when the memory limit is reached. It does not consider the access history of the data, so you risk evicting frequently used vector results that your AI agent needs to maintain low latency.
C. noeviction: Incorrect. This policy prevents the cache from evicting any keys when the memory limit is reached. Instead, it returns an error for any command that would add new data. This would cause your AI application to fail or stop caching new results once the limit is hit, which is not suitable for a high-performance cache.
D. volatile-ttl: Incorrect. This policy only evicts keys that have a Time-To-Live (TTL) value set, specifically targeting those with the shortest remaining time. It does not prioritize the "most recently used" data, and if your cached vector results do not have explicit TTLs, this policy would fail to evict anything at all.
Question 9:
Your AI solution uses Azure App Service. You want to implement ‘Blue/Green‘ deployments for your AI models to ensure zero downtime when updating the system prompt. Which feature of App Service should you use?
A.App Service Environment
B.Scaling Plans
C.WebJobs
D.Deployment Slots
Answer: D
Explanation:
Correct
D. Deployment Slots: This is the correct answer. Deployment Slots allow you to maintain separate environments for your application. You can deploy your updated AI model and system prompt to a "staging" (green) slot, perform testing to ensure the model performance is as expected, and then perform a "swap" operation with the "production" (blue) slot. This swap is virtually instantaneous, ensuring zero downtime and providing an easy path to roll back if the new model version behaves unexpectedly.
Incorrect:
A. App Service Environment (ASE): Incorrect. An App Service Environment is a premium, isolated hosting tier for running App Service apps in a high-scale, private network configuration. While it supports deployment slots, the ASE itself is an infrastructure resource, not the feature that enables the deployment-swapping mechanism.
B. Scaling Plans: Incorrect. Scaling plans (or App Service Plans) define the physical resources (CPU, RAM) and the number of instances allocated to your application. They are used for managing load and capacity, not for managing deployment lifecycles or version switching.
C. WebJobs: Incorrect. WebJobs are used for running background tasks, scripts, or programs within the context of your App Service. They are not intended for managing the traffic routing or deployment lifecycle of the primary web application or AI API endpoints.
Question 10:
Your AI solution uses an Azure Function to call an external LLM. The LLM occasionally takes 2 minutes to respond, which exceeds the default timeout of the function. Which hosting plan should you switch to for longer execution times?
A.Consumption Plan (Windows)
B.Free Tier
C.Premium Plan
D.Basic Tier
Answer: C
Explanation:
C. Premium Plan: This is the correct answer. The Azure Functions Premium plan is designed for scenarios that require longer execution times. While the default timeout for the Consumption plan is 5 minutes (and can be configured up to 10 minutes), the Premium plan allows for "unbounded" execution duration (though it is recommended to configure them to run for up to 30 minutes to prevent runaway processes). For an LLM integration that reliably takes longer than the default limits, the Premium plan provides the necessary infrastructure to avoid timeouts.
Incorrect:
A. Consumption Plan (Windows): Incorrect. The Consumption plan is the serverless, pay-per-use model. While it has a configurable timeout (up to 10 minutes), it is inherently designed for short-lived, event-driven functions. It is not the recommended choice for stable, long-running AI inference tasks, and if your logic requires extended or deterministic execution beyond its limits, the Premium plan is the architectural requirement.
B. Free Tier: Incorrect. There is no "Free Tier" for hosting Azure Functions in the context of production-grade AI solutions; functions are generally run on Consumption, Premium, or Dedicated (App Service) plans.
D. Basic Tier: Incorrect. The "Basic" tier refers to an App Service Plan (Dedicated). While App Service plans can be used to host functions and do allow for longer timeouts, in the context of Azure Functions specific architecture and scaling for AI workloads, the Premium plan is the optimized hosting choice because it offers "Always Ready" instances to avoid "cold starts," which is a critical performance factor for AI agents.
For a full set of 600 questions. Go to
https://skillcertpro.com/product/microsoft-azure-ai-cloud-developer-ai-200-exam-questions/
SkillCertPro offers detailed explanations to each question which helps to understand the concepts better.
It is recommended to score above 85% in SkillCertPro exams before attempting a real exam.
SkillCertPro updates exam questions every 2 weeks.
You will get life time access and life time free updates
SkillCertPro assures 100% pass guarantee in first attempt.