Design and implement a GenAIOps infrastructure — AI-300 Practice Quiz

Question 1

Your team manages an Azure AI Foundry project using infrastructure-as-code. You author a Bicep template that provisions the Foundry resource, a project, and a model deployment. During CI/CD you must be able to re-run the same deployment repeatedly (for example after adding a new model deployment) without recreating existing resources or causing errors, and the deployment name for each model must be supplied at build time per environment. Which approach best meets these requirements?

Accepted Answer

Deploy the Bicep template with 'az deployment group create' in Incremental mode and pass the model deployment name as a template parameter.

Answer

Deploy the Bicep template with 'az deployment group create' using Complete mode so any drift is corrected on each run.

Answer

Hardcode the model deployment name in the Bicep resource and run 'az deployment group create --confirm-with-what-if' each time.

Answer

Convert the Bicep file to an ARM template and deploy it with 'az group create' passing environment values as tags.

Question 2

Your team maintains a production Azure AI Foundry environment defined entirely in Bicep, including the hub, projects, and model deployments. Before applying an updated Bicep template that changes a serverless model deployment's SKU capacity, the platform lead requires a preview of exactly which resources will be created, modified, or deleted—without actually applying any changes to the live environment. Which Azure CLI command should you run against the resource group deployment?

Accepted Answer

az deployment group what-if --resource-group rg-foundry --template-file main.bicep --parameters main.bicepparam

Answer

az deployment group validate --resource-group rg-foundry --template-file main.bicep --parameters main.bicepparam

Answer

az deployment group create --resource-group rg-foundry --template-file main.bicep --confirm-with-what-if --mode Incremental

Answer

az bicep build --file main.bicep --stdout

Question 3

Your team maintains a non-interactive Azure DevOps pipeline that uses the Azure CLI to deploy Azure AI Foundry resources and model deployments into a subscription. The pipeline currently fails at the deployment step because it cannot authenticate. Security policy forbids storing user credentials or interactive browser sign-in in the pipeline. Which authentication approach should you configure for the Azure CLI in the pipeline?

Accepted Answer

Authenticate 'az login' with a service principal using a workload identity federation (OIDC) service connection

Answer

Run 'az login' interactively and cache the token in the pipeline agent's user profile

Answer

Embed a personal access token for a named engineer in a pipeline variable and use it with 'az login'

Answer

Assign a system-assigned managed identity to the Azure DevOps organization and rely on it for CLI calls

Question 4

Your team runs an Azure AI Foundry project that serves a chat application. The current production deployment uses version 3 of a foundation model on a serverless API endpoint. A newer version 4 has been released, and stakeholders want to validate its response quality against version 3 using the same evaluation dataset before committing to a full cutover, while keeping production traffic entirely on version 3. What is the most appropriate approach?

Accepted Answer

Create a separate deployment for version 4 under the same project and route evaluation traffic to it, leaving the version 3 deployment serving all production requests.

Answer

Update the existing version 3 deployment in place to point to version 4, then roll back if the evaluation results are unsatisfactory.

Answer

Delete the version 3 deployment and create a new deployment for version 4, since only one model version can exist per project.

Answer

Provision reserved provisioned throughput units for version 4 to guarantee that production traffic is unaffected during evaluation.

Question 5

Your team develops prompt flows in Azure AI Foundry and stores the flow definitions (including the flow.dag.yaml and prompt templates) in a Git repository. The team lead wants a repeatable process so that when a validated prompt change is merged into the main branch, the flow is automatically evaluated and deployed to the staging Foundry project without manual portal steps. Which approach best meets this requirement?

Accepted Answer

Configure a CI/CD pipeline (e.g., GitHub Actions) that, on merge to main, uses the Azure CLI/az ml commands to run the flow evaluation and deploy the flow to the staging project

Answer

Have each developer manually export the flow from the Foundry portal and re-import it into the staging project after every merge

Answer

Store the prompt templates as secrets in Azure Key Vault so that the staging project automatically picks up the latest version on merge

Answer

Enable autosave on the authoring flow so changes replicate directly to the staging project in real time

Question 6

Your team deploys a fine-tuned open-source language model to a managed compute endpoint in Azure AI Foundry. During load testing, the endpoint sustains high GPU utilization but throughput plateaus and request latency climbs sharply as concurrent traffic increases. The model must remain always-on for an internal application with steady, predictable demand. You need to increase throughput without changing the model. What should you do first?

Accepted Answer

Scale out the managed compute deployment by increasing the instance count on the same GPU SKU

Answer

Migrate the model to a serverless API endpoint to remove capacity limits

Answer

Purchase provisioned throughput units (PTUs) for the deployment

Answer

Reduce the instance count to force requests to queue and process sequentially

Question 7

You are deploying an Azure AI Foundry project that must call a downstream Azure Key Vault to retrieve API secrets at runtime. Security policy prohibits storing any credentials in application code or configuration files, and the Foundry resource was created with a system-assigned managed identity. What is the correct way to grant the Foundry resource access to the Key Vault secrets?

Accepted Answer

Assign the Foundry resource's system-assigned managed identity the 'Key Vault Secrets User' RBAC role scoped to the Key Vault.

Answer

Generate a service principal client secret and store it as an environment variable in the Foundry project.

Answer

Create a shared access signature (SAS) token for the Key Vault and embed it in the application connection string.

Answer

Add the Key Vault access key to the Foundry project's Bicep parameters file during deployment.

Question 8

Your team deploys a foundation model to a serverless API endpoint in an Azure AI Foundry project. A downstream App Service must call this endpoint. Security policy prohibits storing any long-lived secrets or API keys in application configuration, and all access must be auditable through Microsoft Entra ID. What is the recommended way to configure authentication between the App Service and the Foundry endpoint?

Accepted Answer

Enable a system-assigned managed identity on the App Service, grant it the appropriate Azure RBAC role on the Foundry resource, and authenticate using Microsoft Entra tokens.

Answer

Retrieve the endpoint's primary key and store it in the App Service application settings, rotating it manually every 90 days.

Answer

Store the endpoint API key in Azure Key Vault and reference it from App Service using a Key Vault reference in application settings.

Answer

Configure the App Service to use a shared access signature (SAS) token generated from the Foundry project storage account.

Question 9

Your team is building a document-summarization feature in Azure AI Foundry. Source documents routinely exceed 60,000 tokens and must be summarized in a single pass. The team wants the lowest-cost model available in the model catalog that can accept the full document without chunking. Which criterion should drive your model selection?

Accepted Answer

Choose the model with the largest maximum context window that can hold the full document in one request, then compare per-token pricing among qualifying models.

Answer

Choose the model with the highest MMLU benchmark score regardless of its context window size.

Answer

Choose any chat model and enable provisioned throughput units to expand its context window.

Answer

Choose the model with the fastest time-to-first-token latency, since summarization is latency sensitive.

Question 10

Your team runs a production chat application on an Azure AI Foundry deployment of a GPT model. Compliance requires that any model behavior change be validated in a staging environment before it reaches production. During a quarterly review you discover that the production deployment's underlying model version silently changed, causing subtly different responses that were never tested. When you inspect the deployment, its version update policy is set to allow automatic upgrades. What should you change to ensure the production deployment stays on a validated model version until you explicitly approve an upgrade?

Accepted Answer

Set the deployment's version update policy to 'No auto update' so it stays pinned to the specific model version you selected

Answer

Set the deployment's version update policy to 'Once new default version is available' (auto-update to default)

Answer

Reduce the deployment's provisioned throughput units so upgrades cannot be applied during high load

Answer

Enable a content safety filter on the deployment to block responses from newer model versions

Question 11

Your team is deploying an Azure AI Foundry hub and project for a regulated financial workload. Security policy requires that no data traverses the public internet: both inbound access to the hub and the hub's outbound connections to its dependent Azure resources (Storage, Key Vault, Container Registry) must stay on the Microsoft backbone. You need to configure the Foundry hub's networking so these requirements are met with the least ongoing management overhead. Which configuration should you choose?

Accepted Answer

Configure the hub with a managed virtual network in 'Allow Only Approved Outbound' mode, add private endpoints for inbound access, and create private endpoint outbound rules to the dependent resources.

Answer

Enable a managed virtual network on the hub in 'Allow Internet Outbound' mode and add a private endpoint only for inbound access.

Answer

Leave the hub on public network access, but restrict access using a resource firewall with IP allow-lists for the corporate network ranges.

Answer

Deploy the hub into a customer-managed virtual network and rely on network security group (NSG) rules to block all outbound public traffic.

Question 12

Your team has deployed an Azure AI Foundry hub with a managed virtual network and configured a private endpoint so that all inbound access is restricted to your corporate network. On-premises developers connected through ExpressRoute report that they can reach the Foundry portal by IP address but consistently get name-resolution failures when using the resource's fully qualified domain name. What is the most appropriate action to resolve the connectivity issue?

Accepted Answer

Configure conditional forwarders on the on-premises DNS servers to forward the Foundry public DNS zones to Azure DNS, and ensure the corresponding Azure Private DNS zones are linked to the virtual network.

Answer

Add an inbound network security group (NSG) rule on the private endpoint subnet to allow TCP port 53 from the on-premises network.

Answer

Switch the hub from a private endpoint to a service endpoint so that public DNS resolution is used for the resource.

Answer

Assign a user-assigned managed identity to the hub and grant it the DNS Zone Contributor role on the Private DNS zone.

Question 13

Your organization has an Azure AI Foundry hub that centralizes an Azure OpenAI connection, an Azure AI Search connection, and a storage account. Three separate teams each need their own isolated Foundry project for developing distinct GenAI applications, but all three teams must reuse the same Azure OpenAI connection defined at the hub without redefining credentials in each project. What is the most appropriate way to structure this so that connections are inherited while keeping project-level work isolated?

Accepted Answer

Create three projects under the shared hub; hub-level connections are automatically available to all projects, while each project maintains its own isolated assets and access boundaries.

Answer

Create three separate hubs, each with its own duplicate Azure OpenAI connection, and link them together with a connection group.

Answer

Create a single project and use folders inside it to separate each team's work, since connections cannot be shared across multiple projects.

Answer

Define the Azure OpenAI connection at the project scope in the first project and grant the other two projects Reader access to that project's resources.

Question 14

Your organization is standardizing on Azure AI Foundry. The platform team wants a central place to configure shared networking, connections to Azure OpenAI, and a common security and governance boundary, while individual data science teams each need isolated workspaces for their own model deployments, prompt flows, and code assets. You must implement this with the fewest configuration steps and maximize resource reuse. Which approach should you take when creating the Foundry resources?

Accepted Answer

Create one Foundry hub for the organization and create a separate Foundry project under that hub for each data science team.

Answer

Create one Foundry hub and a single shared project, and separate the teams using folders inside the project.

Answer

Create a separate Foundry hub for each team and one shared project that all hubs reference.

Answer

Create one Foundry project for the organization and add a child hub for each data science team.

Question 15

Your team maintains a chat prompt for a customer-support assistant in Azure AI Foundry. Before merging a proposed prompt change into the main branch, you must objectively measure whether the new prompt produces better answers across a representative set of 500 historical support questions with known ideal answers. You want a repeatable, quantitative comparison rather than manually inspecting individual outputs. Which approach should you use?

Accepted Answer

Run a batch evaluation in prompt flow using the 500-question dataset and an evaluation flow that scores each response against the ground-truth answers, then compare aggregate metrics between the two prompt versions.

Answer

Deploy both prompt versions to separate serverless API endpoints and route production traffic to each, then compare content safety filter logs.

Answer

Manually enter several sample questions into the prompt flow chat interface and visually inspect the differences between the two prompt versions.

Answer

Increase the provisioned throughput units for the deployment so both prompt versions can be tested at higher volume before merging.

Question 16

Your team develops a customer-support chatbot in Azure AI Foundry using a prompt flow. The lead prompt engineer wants each change to the system prompt template to go through a formal code review before it can affect the deployed flow, and wants the ability to trace which exact prompt template produced a given evaluation result. The prompt template files are currently only edited in the Foundry portal's authoring UI and never leave the workspace. What should you do FIRST to meet these requirements?

Accepted Answer

Connect the prompt flow to a Git repository and commit the flow's prompt template files, so changes are made via pull requests that require review before merging.

Answer

Enable diagnostic logging on the Foundry project and export the prompt template contents to a Log Analytics workspace after each edit.

Answer

Create a separate serverless API endpoint for each version of the prompt and switch traffic manually when a new prompt is approved.

Answer

Store the finished prompt templates in Azure Key Vault as secrets and reference them from the flow at runtime.

Question 17

Your team develops prompts for a customer support GenAI application in Azure AI Foundry, storing the prompt flow in a Git repository. Compliance requires that every prompt version deployed to production be traceable to an exact, immutable point in source history, and that auditors can reproduce the deployed prompt months later. The team currently commits prompt changes to a long-lived 'main' branch and deploys the latest commit. What should you implement to meet the traceability and reproducibility requirements?

Accepted Answer

Create an annotated Git tag (for example, prompt-v1.4.0) on the exact commit that is promoted to production, and deploy from that tag reference.

Answer

Enable auto-update on the Foundry deployment so it always reflects the newest commit on the main branch.

Answer

Store each prompt version as a separate file in Azure Blob Storage with a timestamp in the file name.

Answer

Increase the Git repository retention policy so older commits are not garbage-collected.

Question 18

You are refining a customer support summarization prompt in Azure AI Foundry prompt flow. Business stakeholders complain that summaries are inconsistent and occasionally invent details not present in the source ticket. You want to systematically test whether reducing model randomness improves factual consistency while keeping all other prompt wording identical, and you need to compare the results before committing a change. What is the most appropriate first step?

Accepted Answer

Create prompt variants of the same node that differ only in the temperature and top_p sampling parameters, then run a batch evaluation to compare their outputs against a groundedness metric.

Answer

Increase the provisioned throughput units on the deployment so the model has more capacity to produce accurate summaries.

Answer

Deploy each candidate prompt as a separate serverless API endpoint and split production traffic 50/50 to compare live results.

Answer

Rewrite the system prompt to add stricter instructions and immediately merge it to the main branch after a quick manual spot check.

Question 19

A financial services company runs a customer-facing chatbot on Azure AI Foundry using a GPT-4 model deployed to a serverless (pay-as-you-go) API endpoint. During peak trading hours the team observes rising latency and intermittent HTTP 429 responses, and the business now requires a guaranteed, consistent response-time SLA for a predictable high volume of requests. Cost predictability is also a stated goal. Which deployment change best meets these requirements?

Accepted Answer

Provision the model on a Provisioned Throughput Units (PTU) deployment sized to the expected peak load.

Answer

Keep the serverless endpoint and submit a quota increase request to raise the tokens-per-minute limit.

Answer

Deploy multiple serverless endpoints behind a load balancer and distribute requests round-robin.

Answer

Enable autoscale on the serverless endpoint so replicas scale out during peak trading hours.

Question 20

Your team runs a customer-facing chatbot on Azure AI Foundry backed by a GPT-4o deployment using provisioned throughput units (PTUs). Traffic is steady and predictable at high volume 24/7, and finance wants to reduce the monthly PTU spend as much as possible without changing the deployed model or its throughput guarantees. What should you do?

Accepted Answer

Purchase a monthly or yearly PTU reservation for the committed capacity to obtain a discounted hourly rate.

Answer

Migrate the deployment to a serverless (pay-as-you-go) endpoint to eliminate the fixed PTU cost.

Answer

Reduce the number of provisioned throughput units below the required baseline to lower the hourly charge.

Answer

Enable content safety filtering to reduce the number of billable tokens processed by the model.

More AI-300 practice