Microsoft AI-102 Practice Test

AI-102 practice test: what's covered

• Azure AI Engineer Associate

Free AI-102 sample questions

1. A retail company deploys a containerized Azure AI Language sentiment model in an on-premises Kubernetes cluster that has no inbound internet. What must the container still be able to do to remain in a supported, compliant state?

   • A. Send periodic billing and metering telemetry to the Azure endpoint for the resource
   • B. Download the model weights fresh from the cloud before each inference request
   • C. Stream every analyzed document back to Azure Storage for retraining purposes
   • D. Maintain a permanent open WebSocket tunnel to the Azure portal dashboard
   Show answer

   Correct: A. Azure AI containers run disconnected for inference but must periodically report usage metering to Azure for billing, so outbound access to the billing endpoint is mandatory. Downloading weights per request is incorrect because the image already contains the model. Streaming documents back is not required and would break data-residency, unlike the metering call. A permanent portal tunnel is fictional and not part of the container contract.

2. An app team must call an Azure AI multi-service account without storing any secret keys in code, using Microsoft Entra ID. Which steps are required to enable this token-based authentication? (Choose TWO)

   • A. Configure a custom subdomain name on the Azure AI services resource
   • B. Assign an appropriate Azure RBAC role such as Cognitive Services User to the identity
   • C. Regenerate both account keys and embed key1 in the application settings
   • D. Disable the resource endpoint and route all traffic through Azure Front Door
   • E. Switch the resource pricing tier from Standard to the Free F0 tier
   Show answer

   Correct: A and B. Microsoft Entra ID (token) auth requires a custom subdomain on the resource and an RBAC role like Cognitive Services User granted to the managed identity or principal. Embedding key1 is the opposite of keyless auth and is incorrect. Disabling the endpoint would break access, not enable it. The F0 tier choice is unrelated because authentication mode is independent of pricing tier.

3. Your Azure OpenAI resource sits inside a virtual network and must never be reachable over the public internet, yet a web app in another VNet needs to call it. Which configuration achieves private, name-resolvable connectivity?

   • A. Create a private endpoint and link a Private DNS Zone, then disable public network access
   • B. Add the web app outbound IP to the resource firewall allowlist over public access
   • C. Enable a service endpoint on the subnet and leave public network access enabled
   • D. Generate a shared access signature token scoped to the model deployment path
   Show answer

   Correct: A. A private endpoint plus a Private DNS Zone gives the resource a private IP and correct name resolution, and disabling public access enforces isolation. IP allowlisting still uses the public endpoint, so it is incorrect for a no-public-internet requirement. Service endpoints keep the public endpoint reachable, unlike private endpoints. SAS tokens are a Storage concept, not an Azure OpenAI network control, whereas private endpoints are.

4. A regulated bank requires that all data stored at rest by its Azure AI services resource be encrypted with a key the bank controls and can revoke. Which capability should the engineer enable?

   • A. Customer-managed keys backed by a key stored in Azure Key Vault
   • B. Transparent service-side keys rotated automatically by Microsoft only
   • C. Client-side hashing of payloads before each request is submitted
   • D. A shared access signature with a short expiry on the endpoint
   Show answer

   Correct: A. Customer-managed keys (CMK) in Azure Key Vault let the bank own, rotate, and revoke the encryption key for data at rest, satisfying the control requirement. Microsoft-managed keys are the default and do not give the customer revocation control, so they are incorrect here. Client-side hashing is not encryption at rest and is irrelevant. A SAS token controls access, not at-rest key ownership, unlike CMK.

5. After a production incident on an Azure AI Vision resource, the team wants to capture detailed request logs and metrics for later analysis in a workspace. Which actions support this monitoring goal? (Choose TWO)

   • A. Create a diagnostic setting that routes logs to a Log Analytics workspace
   • B. Review platform metrics such as total calls and latency in Azure Monitor
   • C. Enable the Free F0 tier so that logging quotas are automatically lifted
   • D. Delete and recreate the resource to reset its internal telemetry counters
   • E. Store the account key inside the request body to tag each log entry
   Show answer

   Correct: A and B. Diagnostic settings send resource logs to a Log Analytics workspace, and Azure Monitor exposes platform metrics like call volume and latency, together giving full observability. The F0 tier does not lift logging quotas and is incorrect. Recreating the resource destroys history rather than analyzing it. Putting the key in the body is a security anti-pattern and does nothing for logging, unlike diagnostic settings.

Last updated: 2026-10-19

AI-102 practice test FAQ

Related practice tests

• Microsoft DP-600 practice test
• AWS AIF-C01 practice test
• AWS MLA-C01 practice test
• Google Cloud Generative AI Leader practice test
• Databricks Generative AI Engineer Associate practice test
• Azure AZ-104 practice test