Free Microsoft Certified: Azure AI Cloud Developer Associate (AI-200) Sample Questions

Correct answer: B — azure-servicebus

• A. Incorrect. The azure-eventhub scaler is designed for scaling based on Azure Event Hubs metrics (such as checkpointed offsets). It cannot monitor or scale based on Azure Service Bus queue length.
• B. Correct. The azure-servicebus scaler is specifically designed for scaling based on Azure Service Bus queue or topic metrics. It can monitor message counts and trigger scaling actions, including scaling out as the queue length increases and scaling down to zero when the queue is empty.
• C. Incorrect. The azure-storage-queue scaler is used for scaling based on Azure Storage Queue metrics. Although both are messaging services, Azure Storage Queues and Azure Service Bus Queues require different scalers.
• D. Incorrect. The rabbitmq scaler is used for scaling based on RabbitMQ queue lengths. It is not compatible with Azure Service Bus.

Correct answer: B — RollingUpdate

• A. The Recreate strategy terminates all existing pods before starting new ones. This leads to a service interruption and downtime during the update process, which does not meet the requirement.
• B. RollingUpdate is the default strategy in Kubernetes. It replaces pods incrementally, ensuring that some instances remain running while new ones are brought up. This ensures zero or minimal downtime during deployment updates in AKS.
• C. BlueGreen is a deployment pattern rather than a built-in strategy type specified in the standard Kubernetes Deployment manifest. It typically involves running two identical production environments and shifting traffic, which is not a direct value for the strategy field.
• D. Canary is a deployment approach used to roll out updates to a small subset of users. In AKS, this is typically implemented using service meshes or ingress controllers rather than being a native '.spec.strategy.type' option in a standard Deployment manifest.

Correct answer: A — True

• A. The statement is true because Azure Container Apps includes native support for HTTP scaling, which allows the platform to scale replicas based on the number of concurrent HTTP requests without requiring the user to define a custom KEDA scaler.
• B. The statement is false because Azure Container Apps provides built-in HTTP scaling as a native capability, meaning a custom KEDA scaler is not necessary for scaling on concurrent requests, although KEDA is used for other specialized event-driven scaling needs.

Correct answer: A — Managed Identity

• A. Correct. Managed Identity (System-assigned or User-assigned) provides an identity in Microsoft Entra ID for the Azure Container App. This enables the app to authenticate to Azure Key Vault securely without requiring the developer to manage or store credentials like client secrets or certificates in the application code or configuration.
• B. Incorrect. Although a Service Principal is an identity for an application, it generally necessitates the use of a client secret or certificate. These credentials must be stored and rotated, which adds management overhead and security risks compared to using a Managed Identity.
• C. Incorrect. A Shared Access Signature (SAS) provides secure, delegated access to resources specifically within an Azure Storage account. It is not a mechanism used for authenticating an application to Azure Key Vault.

Correct answer: A — Store the secret in Azure Key Vault and use a Key Vault reference in the App Service Application Settings.

• A. Correct. Azure Key Vault is the recommended secure store for secrets. App Service supports Key Vault references within Application Settings (e.g., @Microsoft.KeyVault(...)). This allows the platform to fetch the secret and inject it into the container as an environment variable at runtime, ensuring the secret is never stored in the image, the Dockerfile, or displayed in plain text in the Azure portal.
• B. Incorrect. Mounting an Azure Files share containing a .env file is less secure and more difficult to manage than Key Vault. It does not provide the same level of auditing or native platform integration, and storing secrets in files is generally discouraged in cloud-native security patterns.
• C. Incorrect. ACR Task secrets are used during the build process. Injecting secrets during the build often results in them being baked into the image layers or build logs, which violates the policy that secrets must not be stored in the ACR image.
• D. Incorrect. Using the Docker CMD instruction to fetch secrets at runtime requires custom scripts and the installation of the Azure CLI or SDKs within the container. This increases image size and complexity compared to the native App Service Key Vault reference mechanism.

Correct answer: A — An ACR retention policy

• A. Correct. Azure Container Registry (ACR) provides a built-in retention policy feature (currently available in the Premium service tier) designed specifically to automatically delete untagged manifests after a defined number of days, directly addressing the requirement.
• B. Incorrect. While an Azure Automation runbook can be used to automate cloud management tasks via custom scripts, it is not a native registry feature and is less efficient than using built-in ACR manifest management tools.
• C. Incorrect. Although ACR Tasks with timer triggers can execute the `acr purge` command to clean up images (and are a common alternative for registries not on the Premium tier), the Retention Policy is the native, specific configuration setting designed for untagged manifest cleanup.
• D. Incorrect. Azure Blob Storage lifecycle management rules are used to manage blobs within standard storage accounts. They cannot be used to manage the internal manifests or image structures of an Azure Container Registry.

Correct answer: B — ACR Private Endpoints on a Premium SKU registry

• A. Incorrect. Service endpoints extend a Virtual Network identity to the registry service, but they still utilize the service's public endpoint. Furthermore, network restriction features and Private Link capabilities are not supported on the Basic SKU; they require a higher tier (typically Premium for Private Link).
• B. Correct. Private Endpoints use Azure Private Link to assign a private IP address from your Virtual Network to the Azure Container Registry. This ensures that traffic between the VNet and the registry remains entirely on the Microsoft backbone network and never traverses the public internet. This feature specifically requires the Premium SKU of ACR.
• C. Incorrect. Azure Front Door with WAF is designed for global HTTP/HTTPS traffic acceleration and web application security. It is not the appropriate solution for providing private, internal network connectivity for pulling images from a container registry.
• D. Incorrect. Network Security Groups (NSGs) are used to filter traffic to and from resources within an Azure Virtual Network at the subnet or NIC level. They cannot be applied 'directly' to the Azure Container Registry managed service itself and do not provide the private link connectivity required.

Correct answers: A, C — App Service on Linux using Docker Compose; App Service on Linux using a Kubernetes Pod YAML file

• A. Correct. Azure App Service on Linux supports multi-container applications by using Docker Compose. This is a standard and supported method to run multiple containers together, such as a Node.js application alongside an Nginx reverse proxy.
• B. Incorrect. Multi-container support for Azure App Service is currently limited to the Linux-based service; App Service on Windows does not support multi-container deployments via Docker Compose.
• C. Correct. Azure App Service on Linux (specifically Web App for Containers) supports multi-container applications using a Kubernetes Pod YAML definition. This is one of the two native configuration formats supported for multi-container orchestration on the platform.
• D. Incorrect. Service Fabric is an independent Azure service for distributed applications and microservices. It is not a configuration or deployment model for Azure App Service.
• E. Incorrect. While you can technically merge multiple processes into a single Dockerfile (using process managers like Supervisor), this creates a single-container deployment. It does not utilize the multi-container orchestration capabilities of Azure App Service, which is the focus of this scenario.

Correct answer: B — HNSW

• A. The FLAT index type performs an exhaustive, brute-force search by scanning all vectors. While this guarantees 100% accuracy, its complexity is O(N), which does not scale well to large datasets. For 50 million items, it would be impossible to meet sub-millisecond latency requirements.
• B. HNSW (Hierarchical Navigable Small World) is a graph-based index designed for fast approximate nearest neighbor (ANN) search. It is highly optimized for performance, capable of achieving sub-millisecond search latency even at massive scales (like 50 million items) by trading off a small amount of accuracy for significant gains in speed.
• C. IVF (Inverted File) indexes divide vectors into clusters to narrow the search space. While faster than FLAT, IVF generally requires a training phase and often provides higher latency or lower recall compared to HNSW for dense vector search in Redis environments at this specific scale.
• D. HASH is not a supported vector index type for semantic similarity search within the Azure Managed Redis vector search capability. Semantic search requires nearest-neighbor algorithms like HNSW or FLAT to interpret the distance between high-dimensional embeddings.

Correct answer: B — SearchIndex

• A. RedisClient is generally used for basic connection management or lower-level Redis operations. While it facilitates communication with the server, it is not the class responsible for schema-driven index creation or vector search in the RedisVL library.
• B. SearchIndex is the primary class in the Redis Vector Library (RedisVL) used to interact with Azure Managed Redis. It accepts an IndexSchema and provides methods to create the index, load data, and execute vector searches.
• C. VectorStore is a common abstraction used in other frameworks like LangChain, but in the context of the specific RedisVL library, the correct class name for managing the lifecycle of an index is SearchIndex.
• D. RediSearch refers to the underlying Redis module that provides search and indexing capabilities. It is the engine that RedisVL interacts with, but it is not a Python class within the RedisVL library itself.

Correct answer: A — True

• A. The statement is true because the FLAT index type in RediSearch utilizes an exhaustive, brute-force search method. It calculates the distance between the query vector and every other vector stored in the index, ensuring 100% recall and providing exact nearest neighbor results, which distinguishes it from approximate methods like HNSW.
• B. The statement is false because the FLAT index specifically avoids approximate search structures or hierarchies. Its primary function is to perform a comprehensive comparison against the entire dataset to ensure precision, rather than using heuristics to speed up retrieval at the cost of accuracy.

Correct answer: B — 1536

• A. Incorrect. 512 is not the embedding size produced by the text-embedding-ada-002 model. Setting the DIM value too low would fail to match the vector length generated by the model, preventing correct storage or similarity search operations.
• B. Correct. The text-embedding-ada-002 model consistently produces embeddings with exactly 1536 dimensions. In Azure Managed Redis or other vector stores, the DIM parameter in the schema must match this value to ensure the stored vectors align with the model's output.
• C. Incorrect. 4096 is larger than the output dimension of the text-embedding-ada-002 model. Using an incorrect dimension in the vector field schema would make the schema incompatible with the actual embedding vectors produced by the API.

Correct answer: A — ReadItemAsync

• A. ReadItemAsync performs a point read, which is the most efficient way to retrieve a single item in Azure Cosmos DB. If the item is 1 KB or smaller, a point read costs exactly 1 RU. It bypasses the query engine entirely, making it cheaper than any query operation.
• B. GetItemQueryIterator is used to execute SQL queries. Even if a query is scoped to a single partition and filters by ID, it still involves the query engine overhead and will always consume more RUs than a direct point read.
• C. ReadManyItemsAsync is designed to retrieve a list of documents based on a collection of ID and partition key pairs. While efficient for batch operations, it is not the optimal choice for retrieving a single specific document.
• D. ExecuteQueryAsync is used for running queries. Queries are logically different from point reads and involve higher RU costs because they require the query engine to parse and execute the request, even when targeting a single document.

Correct answers: B, C — {"path": "/age", "order": "descending"}; {"path": "/score", "order": "ascending"}

• A. Incorrect. The query sorts by age in descending order. In Azure Cosmos DB, for queries with multiple order-by properties, the composite index must match the specified order of the query or be the exact inverse for all properties. An ascending index on /age does not align with the primary sort requirement of this query.
• B. Correct. The first property in the ORDER BY clause is c.age DESC. To optimize the query performance and ensure efficient indexing, the composite index definition must include /age with a descending order as its leading path.
• C. Correct. The second property in the ORDER BY clause is c.score ASC. To fully support the multi-property sort and avoid high Request Unit (RU) charges associated with unindexed sorting, the composite index must include /score with an ascending order following the first property.
• D. Incorrect. The query requires c.score to be in ascending order. Including a descending order for /score in the composite index (when paired with /age DESC) would not match the specific sorting sequence requested by the query.
• E. Incorrect. The query does not perform any sorting or filtering based on the 'id' field. Including /id in the composite index would not help optimize this specific ORDER BY operation.

Correct answers: A, B, C — Enable the vector search feature at the Cosmos DB account level.; Define a vector embedding policy in the container properties.; Define a vector index in the container's indexing policy.

• A. Vector search must be enabled at the Azure Cosmos DB account level before vector-specific capabilities can be utilized. This is a primary prerequisite to allow the account and its containers to support vector operations.
• B. A vector embedding policy must be defined in the container properties. This policy informs Azure Cosmos DB which document properties are treated as vectors and specifies their dimensions, data type, and distance metric.
• C. A vector index must be explicitly defined within the container's indexing policy. This index (such as DiskANN or QuantizedFlat) is necessary for the query engine to efficiently perform similarity searches using the VectorDistance function.
• D. Azure Cosmos DB vector search functionality is independent of the account's consistency level. Setting the consistency to Strong is not required for executing vector similarity queries.
• E. The client's connection mode (Gateway vs. Direct) does not impact the ability to perform vector searches. Vector search is enabled through data modeling and indexing configuration, not network connection settings.

Correct answers: A, B, C — A monitored container that holds the data being tracked.; A lease container that coordinates state across workers.; A delegate function that processes the batch of changes.

• A. Correct. The monitored container is the source database container that contains the data from which the change feed is generated. Any inserts or updates to the monitored container are reflected in the change feed.
• B. Correct. The lease container acts as a state storage and coordinates processing of the change feed across multiple workers. It manages leases to ensure that each partition is processed by only one worker at a time and maintains the checkpoint position.
• C. Correct. The delegate (or callback) is the code that receives and handles the batches of changes sent by the Change Feed Processor. This is where you implement the custom logic to push updates to Azure AI Search.
• D. Incorrect. A dead-letter container is not a mandatory component of the Cosmos DB Change Feed Processor pattern. While error handling for poison messages is a best practice, it is not strictly required to initialize or run the processor.
• E. Incorrect. A vector index is used for similarity searches in AI applications and is not used to coordinate or process change feed events. The Change Feed Processor inherently processes changes in the order they occur (sorted by LSN) within each partition.

Correct answer: A — vector(1536)

• A. Correct. The pgvector extension introduces the 'vector' data type specifically for storing and querying high-dimensional vectors. Since the OpenAI text-embedding-ada-002 model generates embeddings with 1536 dimensions, 'vector(1536)' is the correct data type to enable specialized similarity search operators and vector-specific indexing (such as HNSW or IVFFlat).
• B. Incorrect. While PostgreSQL supports fixed-size arrays, 'array[1536]' is not the native data type for the pgvector extension. It does not provide the specialized vector indexing and similarity operators (like <-> or <=>) required for efficient semantic search.
• C. Incorrect. The 'jsonb' data type is designed for semi-structured JSON storage. It is not suitable for storing numerical embeddings for vector operations as it lacks support for mathematical distance calculations and vector-optimized indexing.
• D. Incorrect. While 'float8[]' can store an array of double-precision floating-point numbers, it is not compatible with the pgvector extension's native functions. To leverage pgvector for similarity searches and optimized indexing, you must use the 'vector' type.

Correct answer: A — shared_buffers

• A. Correct. The shared_buffers parameter determines the amount of memory used by the database server for its internal buffer cache. For vector workloads using HNSW indexes, performance is highly dependent on the index being memory-resident. Since the index (16 GB) is larger than the current cache (8 GB), the system is experiencing 'thrashing' (high disk I/O as pages are swapped). Increasing shared_buffers allows more of the index to be stored in RAM, directly reducing disk I/O and improving query latency.
• B. Incorrect. max_connections limits the number of concurrent connections to the database. Increasing it does not address I/O bottlenecks and can actually increase memory pressure on the server.
• C. Incorrect. work_mem is used for per-query memory operations like complex sorts and hash joins. While it helps with query execution speed for non-indexed operations, it does not control the caching of the HNSW index itself.
• D. Incorrect. effective_cache_size is a hint used by the PostgreSQL query planner to estimate the total size of the disk cache (including the OS cache). While it helps the planner decide whether an index scan is likely to be faster than a sequential scan, it does not actually allocate or provide memory. Since high disk I/O is already occurring during index usage, the physical cache (shared_buffers) is the actual bottleneck.

Correct answer: B — SELECT id, text FROM documents WHERE tenant_id = '123' ORDER BY embedding <=> '[...]' LIMIT 5;

• A. Incorrect. This query uses invalid SQL syntax. The FILTER clause is specifically used for aggregate functions in PostgreSQL, not for row-level filtering. Additionally, the ordering and limiting must occur after the filtering logic.
• B. Correct. This query follows standard SQL structure by first applying the metadata filter (tenant_id) via the WHERE clause. It correctly uses the pgvector operator '<=>' for cosine distance, orders the results, and limits the output to the top 5 matches.
• C. Incorrect. This query performs a radius search by checking if the distance is less than 0.5. It does not guarantee the 'top 5' results and lacks the ORDER BY and LIMIT clauses required by the specification.
• D. Incorrect. This query has two major issues: the WHERE clause is placed after the LIMIT clause, which is invalid SQL syntax, and it uses the '<->' operator, which represents Euclidean distance rather than the requested cosine distance.

Correct answer: B — Configure a SubjectBeginsWith filter on the Event Grid subscription.

• A. Event filtering is not configured on the topic itself. Topics broadcast all events; the filtering logic must be applied at the subscription level to determine which events are routed to a specific endpoint.
• B. Azure Event Grid subscriptions support subject-based filters, specifically the SubjectBeginsWith and SubjectEndsWith properties. This allows you to filter events by a prefix (like '/models/vision/') so that only relevant events trigger the Azure Function, optimizing performance and cost.
• C. While this approach functions logically, it is inefficient. The Azure Function would still be invoked for every event, consuming execution time and incurring costs for events that are immediately discarded. Server-side filtering at the subscription level is the best practice.
• D. Service Bus SQL filters are used to filter messages within Azure Service Bus topics and subscriptions. They are not compatible with or applicable to Azure Event Grid.

Correct answer: A — Configure a Dead-letter destination to an Azure Storage blob container.

• A. Configuring a Dead-letter destination to an Azure Storage blob container is the standard mechanism in Event Grid to ensure that events are not lost when delivery attempts fail. Event Grid writes the event payload to the dead-letter location after it exhausts all retry attempts, allowing for later inspection, analysis, and manual processing.
• B. Enabling Event Grid diagnostic logs is useful for monitoring, auditing, and troubleshooting delivery failures by providing metadata about the events. However, diagnostic logs do not capture and store the actual event payload for later replay or recovery.
• C. The Event Time to Live (TTL) determines how long the event is valid for delivery. Setting it to 0 would cause the event to expire immediately if not delivered on the first try, which increases the likelihood of data loss rather than preventing it.
• D. While Service Bus has its own internal dead-lettering mechanism, Event Grid subscriptions specifically support dead-lettering to an Azure Storage blob container. You cannot directly configure an Event Grid subscription to use a Service Bus Dead-letter queue as its native dead-letter destination.

Correct answers: A, C — Receive and delete the messages from the DLQ.; Peek at the messages in the DLQ to inspect their contents.

• A. Receive and delete (or receiving and completing) is a valid operation for any Service Bus queue, including the DLQ. This allows you to retrieve the message for processing or cleanup, removing it from the DLQ once handled.
• B. Azure Service Bus does not have a built-in feature to automatically route dead-lettered messages back to the main queue after a timeout. This process must be handled manually or via custom code.
• C. Peeking is a non-destructive action that allows you to inspect the message payload and system properties (such as DeadLetterReason and DeadLetterErrorDescription) without removing the message from the DLQ, making it ideal for investigation.
• D. Service Bus messages are immutable once they are enqueued. You cannot modify the payload of a message while it resides in the DLQ; you would instead need to receive it, create a new message with modified content, and send the new message.
• E. The sequence number is a unique 64-bit integer assigned by the Service Bus broker when a message is accepted. It is a read-only system property and cannot be changed by the user.

Correct answer: B — Message Sessions

• A. Incorrect. Duplicate Detection ensures that duplicate messages (based on MessageId) are not enqueued within a specific time window. While it helps maintain data integrity, it does not manage message grouping or ensure that messages from a stream are processed sequentially by a single consumer.
• B. Correct. Message Sessions allow for the grouping of related messages using a SessionID. This feature guarantees first-in, first-out (FIFO) delivery and ensures that only one consumer can lock and process all messages belonging to a specific session at a time, which is the required mechanism for ordered stream processing.
• C. Incorrect. Partitioning increases scalability and throughput by distributing messages across multiple message brokers. However, it does not guarantee that related messages are serialized and locked for a single consumer; in fact, partitioning can make strict ordering more complex to enforce without sessions.

Correct answer: A — A system-assigned managed identity for the Function App

• A. Correct. A system-assigned managed identity allows the Function App to authenticate to Azure Key Vault without storing any credentials in application settings. Managed identities provide an automatic and secure way to authenticate services that support Azure AD authentication, which is the recommended approach for Azure resources.
• B. Incorrect. A shared access signature (SAS) token is used for granting limited access to Azure Storage resources, not for authenticating a service to Azure Key Vault. Additionally, a SAS token is itself a secret that would require management and storage, defeating the purpose of the requirement.
• C. Incorrect. While Key Vault access policies define what an identity can do, using a human user's Azure AD credentials is not appropriate for automated server-side scenarios. The Function App should use its own identity (Managed Identity) rather than relying on interactive user credentials.
• D. Incorrect. Azure AD B2C is used for customer identity and access management (CIAM) for external-facing applications. It is not the mechanism used for internal service-to-service authentication between an Azure Function and Key Vault.

Correct answer: B — 0 30 2 * * 1-5

• A. Incorrect. Azure Functions timer triggers use a six-field NCRONTAB format: {second} {minute} {hour} {day} {month} {day-of-week}. This expression only contains five fields and is therefore invalid for Azure Functions.
• B. Correct. This NCRONTAB expression is valid and correctly specifies the schedule: 0 (seconds), 30 (minutes), 2 (hours/2 AM), * (every day of the month), * (every month), and 1-5 (Monday through Friday). This matches the requirement of 2:30 AM every weekday.
• C. Incorrect. While this follows the correct six-field format, the day-of-week range 0-4 corresponds to Sunday through Thursday in Azure Functions NCRONTAB, where 0 and 7 both represent Sunday.
• D. Incorrect. Using an asterisk (*) in the seconds field would cause the function to execute every second during the minute of 2:30 AM. For a single daily execution, the seconds field should be a specific value, typically 0.

Correct answer: B — 10 minutes

• A. Incorrect. While 5 minutes is the default timeout for functions on a Consumption plan, it is not the maximum limit. Users can increase this value by modifying the host.json configuration.
• B. Correct. For Azure Functions running on the Consumption plan, the default timeout is 5 minutes, and the maximum configurable execution time is 10 minutes. If a function requires more than 10 minutes, it should be moved to a Premium or Dedicated (App Service) plan.
• C. Incorrect. 30 minutes is the default timeout for functions running on Premium or Dedicated (App Service) plans, but it is not a configurable limit for the Consumption plan.
• D. Incorrect. The Consumption plan has a hard limit for execution duration to ensure platform scalability. Unlimited execution time is only available on Premium or Dedicated plans, where the limit is effectively unbounded.

Correct answer: B — False

• A. The statement is false because the default execution timeout for an Azure Function on the Consumption plan is 5 minutes, although it can be manually increased to a maximum of 10 minutes via the host.json configuration file.
• B. The statement is false because 10 minutes is the maximum allowable timeout for the Consumption plan, while the default duration is actually 5 minutes.

Correct answer: B — Sentinel Key

• A. Feature Management is used to dynamically enable or disable application features via feature flags. It is not the pattern used to watch one specific key as a trigger for reloading the rest of the configuration.
• B. The Sentinel Key pattern involves designating a specific key that the application monitors for changes. When a change is detected in this sentinel key, the application triggers a reload of the entire configuration. This pattern optimizes performance by reducing the total number of requests sent to Azure App Configuration.
• C. A Point-in-time Snapshot allows you to retrieve the state of your configuration as it existed at a specific moment in the past. This is a versioning and recovery feature, not a mechanism for ongoing dynamic refresh.
• D. Key Vault Reference is a feature that allows Azure App Configuration to store references to secrets stored in Azure Key Vault. It manages secret retrieval but does not define the refresh strategy for application settings.

Correct answer: A — Azure RBAC allows you to grant access to individual secrets, whereas Vault Access Policies only grant access at the vault level.

• A. Correct. One of the primary advantages of Azure RBAC for Key Vault is granularity. It allows permissions to be scoped to individual secrets, keys, or certificates. In contrast, Vault Access Policies are legacy mechanisms that apply permissions to the entire vault level.
• B. Incorrect. While Azure RBAC is used for management plane operations (like creating the vault), it is now also a fully supported and recommended model for data plane operations (like reading or writing secrets) when the vault is configured for Azure RBAC authorization.
• C. Incorrect. Azure RBAC is the system that integrates with Azure Custom Roles. Vault Access Policies are a separate, Key Vault-specific authorization mechanism that does not utilize Azure RBAC role definitions.
• D. Incorrect. Soft delete is a data protection feature that is independent of the access control model. Azure RBAC does not require disabling soft delete; in fact, soft delete is now enabled by default on all new Key Vaults for security purposes.

Correct answer: A — SecretUri=...

• A. Correct. The syntax `@Microsoft.KeyVault(SecretUri=...)` is the standard format for referencing a specific secret in Azure App Service. It allows the application to resolve the secret value at runtime using the app's managed identity.
• B. Incorrect. While `VaultName` is used in an alternative syntax, it must be paired with `SecretName` (e.g., `@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)`). On its own, `VaultName=...` is incomplete and invalid syntax.
• C. Incorrect. `ConnectionString` is not a valid parameter within the `@Microsoft.KeyVault(...)` reference syntax. While you might store a connection string inside a Key Vault secret, the App Service reference must use `SecretUri` or the VaultName/SecretName pair to retrieve it.

Correct answer: C — 90

• A. Incorrect. 30 days is not the default retention period for soft-deleted secrets in Azure Key Vault. While the retention period can be configured between 7 to 90 days, the default setting is higher.
• B. Incorrect. 60 days is not the default retention period for Azure Key Vault. Although the retention period is configurable, a newly created vault uses the maximum default unless modified.
• C. Correct. By default, Azure Key Vault has soft-delete enabled for all new vaults. The default retention period for soft-deleted objects (keys, secrets, and certificates) is 90 days. During this period, the secret can be recovered before it is permanently purged.

Correct answer: B — percentile(duration, 95)

• A. Incorrect. While similar, the `percentiles()` function (plural) is typically used to calculate and return multiple percentile values at once (e.g., 50th, 90th, and 95th) as a dynamic object or multiple columns. For a single percentile calculation, the singular function is the standard choice.
• B. Correct. The `percentile()` function in Kusto Query Language (KQL) is the specific aggregation function used to calculate a single percentile value, such as the 95th percentile. It is used within a `summarize` operator to group results, for example: `summarize percentile(duration, 95) by name`.
• C. Incorrect. Calculating 95% of the average value (`avg * 0.95`) is a simple mathematical scaling of the mean and does not represent the 95th percentile. Percentiles are statistical measures indicating the value below which a given percentage of observations in a group of observations fall.
• D. Incorrect. This is not valid KQL syntax. While KQL includes a `top` operator to retrieve specific rows, it is not an aggregation function for calculating statistical percentiles.

Correct answer: A — azure-monitor-opentelemetry-exporter

• A. Correct. The azure-monitor-opentelemetry-exporter package provides the specific exporter functionality required to send OpenTelemetry traces, metrics, and logs from Python applications directly to Azure Monitor (Application Insights).
• B. Incorrect. While opentelemetry-exporter-otlp is the standard package for exporting data using the OpenTelemetry Protocol, it is used for generic OTLP-compatible backends or a collector. It does not provide the direct Azure Monitor integration that the dedicated Azure exporter package provides.
• C. Incorrect. applicationinsights-python is the legacy SDK for Azure Application Insights. It is not compatible with the OpenTelemetry-based instrumentation approach described in the question.
• D. Incorrect. azure-core-tracing is an internal package used by Azure SDK client libraries to provide tracing support for network calls. It is not an exporter for sending application telemetry data to Azure Monitor.

Correct answer: A — extend ErrorRate = todouble(FailedRequests) / TotalRequests * 100

• A. Correct. In Kusto Query Language (KQL), the `extend` operator is used to add new calculated columns to an existing result set. The `todouble()` function ensures that the division is performed as a floating-point operation (preventing integer truncation), and multiplying the result by 100 correctly calculates the percentage.
• B. Incorrect. In KQL, the `%` operator is used for the modulo operation (finding the remainder of a division), not for calculating percentages.
• C. Incorrect. KQL does not have a built-in `percentage()` function for this purpose. Calculations must be performed using standard arithmetic operators after values have been summarized.
• D. Incorrect. `calculate` is not a valid KQL keyword for defining columns; it is a keyword used in DAX (Data Analysis Expressions) for Power BI and Analysis Services. Additionally, integer division without casting to double could result in inaccurate (zeroed) values.

Correct answer: A — True

• A. The statement is true because OpenTelemetry utilizes context propagation to link spans across service boundaries, using the W3C Trace Context headers as the standardized mechanism for transporting this context. This allows the tracing system to correlate distributed requests into a single end-to-end trace.
• B. The statement is false because distributed trace correlation relies on context headers being passed between services; without proper propagation of the W3C Trace Context, each service would treat the incoming request as a new, independent trace rather than continuing the existing one.