Free Microsoft AI-200 Practice Exam with Questions & Answers | Set: 2

Detailed Explanation: For Cosmos DB Always Encrypted, the key hierarchy starts with a customer-managed key held in Azure Key Vault. The data encryption key used by the client is protected by that customer-managed key. Microsoft’s setup sequence therefore begins by preparing Key Vault and the CMK before creating DEKs or an encryption policy. Creating a managed identity, a container policy, or a DEK can be necessary later, but none precedes establishing the CMK that protects the client-side encryption key material.

Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.

Official Microsoft Learn References: AI-200 Study Guide | Always Encrypted for Azure Cosmos DB

View console logs from a container in near real-time: Log streaming

Debug the microservice from inside the container: Container console

For near-real-time troubleshooting, use Log streaming . Azure Container Apps supports streaming both system logs and container console logs directly through the Azure portal or Azure CLI. Microsoft documents that container console logs originate from the application ' s stdout and stderr streams, and the log-streaming feature can display them in near real time. This is the correct feature when developers need immediate visibility into container output without waiting for log ingestion into a monitoring workspace.

To debug the application from inside the running container , use the Container console . Azure Container Apps allows operators to connect interactively to a container by using the portal console or the az containerapp exec command. From there, they can run commands through shells such as bash or sh, inspect files, test network connectivity, examine environment variables, and troubleshoot runtime behavior directly in the container context.

Azure Monitor metrics are appropriate for aggregated performance measurements rather than interactive container debugging. Azure Monitor Log Analytics is useful for historical queries and centralized analysis, but Microsoft notes that ingested logs can have a delay of several minutes, so it is not the best choice for near-real-time console output.

Study Guide references: Azure Container Apps → Log streaming; Container console; observability; Azure Monitor integration; interactive troubleshooting.

Detailed Explanation: GitHub Actions is the correct orchestration mechanism among the options because the case requires an automated, version-controlled pipeline and Bicep-based declarative deployment. Microsoft documents GitHub Actions as a supported way to deploy Bicep and automate Azure resource deployment. Local Git, Azure Functions Core Tools, and Azure CLI can participate in development or scripted deployment, but they do not by themselves satisfy the stated requirement for a repository-driven, repeatable CI/CD pipeline.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Deploy Bicep with GitHub Actions | Automate Function app resource deployment

Detailed Explanation: Azure Key Vault references in App Service settings satisfy the requirement to keep secrets out of container images, source control, and directly stored application configuration. App Service resolves the referenced secret at runtime by using the app identity, so the application can consume the value as a normal setting without embedding credentials in the image. GitHub secrets are build/deployment secrets rather than a runtime App Service secret-delivery mechanism. Dockerfile ENV instructions would place secret material in the image configuration and violate the case requirements.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Use Key Vault references for App Service and Functions | Managed identities for Azure resources

The correct solution is to implement connection pooling , ideally by using the built-in PgBouncer capability in Azure Database for PostgreSQL Flexible Server. Connection pooling allows many concurrent application requests to share and reuse a smaller set of established PostgreSQL server connections instead of repeatedly opening and closing database sessions. Microsoft notes that creating a new PostgreSQL connection for each operation consumes server resources because each connection involves its own backend process. Reusing pooled connections therefore reduces connection overhead, lowers CPU and memory consumption, and improves throughput for high-concurrency workloads.

This directly matches Fabrikam ' s stated requirement that database connections support high concurrency with minimal latency through connection optimization . PgBouncer can efficiently multiplex large numbers of client connections onto fewer PostgreSQL connections, particularly in transaction pooling mode.

Increasing max_connections is not the preferred solution because each additional PostgreSQL connection consumes memory and other resources; Microsoft explicitly recommends PgBouncer instead when more concurrent connections are required. Increasing shared_buffers addresses caching and memory allocation rather than connection-management overhead. Read replicas can scale read workloads, but they do not optimize the application ' s connection lifecycle.

Study Guide references: Azure Database for PostgreSQL Flexible Server → connection pooling; PgBouncer; connection management and high-concurrency performance.

Service fails to communicate with another service: Inspect Kubernetes service endpoints.

Pod restarts repeatedly: Inspect container logs.

Readiness probe failures are observed: Inspect Pod descriptions.

For a service-to-service communication failure , first inspect the Kubernetes service endpoints . Microsoft’s AKS troubleshooting guidance recommends verifying that the destination pod IP address and application port appear as endpoints for the Kubernetes Service. An empty or incorrect endpoint list commonly indicates a selector/label mismatch, incorrect port configuration, or unavailable backend pods.

For a pod that restarts repeatedly , inspect the container logs , including the previous container instance when necessary. Microsoft specifically recommends kubectl logs < pod > --previous for workloads that repeatedly restart because it exposes application errors and termination messages from the container immediately before the restart.

For readiness probe failures , inspect the Pod description by using kubectl describe pod. The description exposes the configured health probes, pod conditions, container state, and associated probe-failure events, allowing you to determine whether the probe path, port, timing, or application readiness behavior is incorrect. Microsoft recommends reviewing kubectl describe output when pods are not Ready or health probes are failing.

Therefore, the correct mapping is service endpoints → container logs → Pod descriptions .

Study Guide references: AKS troubleshooting; Kubernetes Services and endpoints; container logging; Pod health; readiness/liveness probes; kubectl describe and kubectl logs.

Use GitHub Actions because Proseware requires an automated, version-controlled deployment pipeline and explicitly prohibits local and command-line deployments. Microsoft documents GitHub Actions as a supported CI/CD mechanism for Azure Functions: a workflow stored under .github/workflows can build and deploy Function app code automatically in response to repository events such as pushes or pull requests. The Azure Functions deployment action can deploy the application package directly to the target Function app.

GitHub Actions also satisfies the infrastructure requirement. Microsoft provides first-class support for deploying Bicep templates through GitHub Actions , enabling Azure resources to be provisioned declaratively from the same source-controlled pipeline. A pull-request workflow can perform validation or Bicep what-if analysis before changes are merged, while a main-branch workflow can perform the actual deployment after approval. This provides repeatability, auditing, and separation from individual developer machines.

Azure Functions Core Tools and Azure CLI are commonly used for interactive/local deployments, which directly conflicts with the requirement to eliminate command-line deployment. Local Git deployment also fails the requirement for a centrally automated Bicep-based deployment process.

Study Guide references: Azure Functions CI/CD; GitHub Actions; infrastructure as code with Bicep; automated Azure deployments; version-controlled deployment workflows.

Verified Answer: 1) Instrument the application code with the OpenTelemetry SDK; 2) configure an Azure Monitor trace exporter in the OpenTelemetry SDK; 3) redeploy the instrumented services.

Detailed Explanation: Trace correlation requires the application to create OpenTelemetry spans and an exporter to send those spans to Azure Monitor. Instrumentation must therefore be present before the updated service is deployed. The previous Application Insights SDK instrumentation does not satisfy the case-study requirement that all tracing use OpenTelemetry. Configuring an OpenTelemetry view is unrelated to basic distributed-trace export, and calling TrackEvent is an Application Insights SDK pattern rather than the required OpenTelemetry approach.

Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.

Official Microsoft Learn References: AI-200 Study Guide | Enable Azure Monitor OpenTelemetry