Exam AI-200: Developing AI Cloud Solutions on Azure includes the Develop containerized solutions on Azure domain, worth 20–25% of the exam. It tests how you build container images, configure hosting, manage deployments, and diagnose runtime problems. These AI-200 practice questions cover container hosting and scaling across Azure Container Registry, App Service, Container Apps, and AKS.
This is the first set in our Azure AI Cloud Developer Associate AI-200 series (Questions 1-10). It focuses on the infrastructure that runs containerized AI back-end services. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Separate image-building decisions from runtime configuration. For Container Apps, also distinguish settings that create a new revision from settings that apply across revisions.
Question 1: Build from a Restricted Workstation
A developer has a Dockerfile and source files for an AI scoring API. The developer can use Azure CLI, but company policy prohibits installing a local Docker Engine. An existing Azure container registry must receive the built image. Which command meets these requirements with the least setup?
A) Use az acr import to import the source directory.
B) Use az acr build with the source directory as context.
C) Use az acr login with the source directory as context.
D) Use az acr task logs to process the source directory.
👁 Reveal Answer
Correct Answer: B
Explanation: B runs an ACR quick task that sends the build context to Azure, builds the image, and pushes it to the registry by default. A local Docker Engine is not required. A imports an existing container image rather than building source files. C authenticates to a registry but does not build an image. D retrieves task logs; it does not execute a build.
Reference: Automate container builds with Azure Container Registry tasks
Question 2: Keep Replicas on One Release
An AI API deploys from an Azure container registry to several compute instances. A pipeline currently overwrites the same release tag after every build. New replicas sometimes run a different build from existing replicas. Which tagging strategy best prevents this inconsistency while preserving a link to pipeline logs?
A) Deploy a major-version tag and overwrite it after each build.
B) Deploy the latest tag and overwrite it after each release.
C) Deploy a branch-name tag and overwrite it after each commit.
D) Deploy a unique build-ID tag and never reuse that tag.
👁 Reveal Answer
Correct Answer: D
Explanation: D gives each deployment a unique image tag tied to a specific pipeline build. Keeping that tag unchanged lets new replicas pull the same release and makes its logs easy to locate. A uses a mutable major-version tag. B also points to changing content. C reuses a branch tag, so a later commit can change what newly started replicas receive.
Reference: Image tag best practices for Azure Container Registry
Question 3: Supply a Runtime Endpoint
A Python API runs in a custom Linux container on Azure App Service. Its existing code reads the nonsecret database hostname from the DB_HOST environment variable. Operations must change the hostname without rebuilding the image or changing application code. What should operations configure?
A) An App Service app setting named DB_HOST.
B) An App Service resource tag named DB_HOST.
C) An image build argument named DB_HOST.
D) A container registry image tag named DB_HOST.
👁 Reveal Answer
Correct Answer: A
Explanation: A supplies the value through App Service configuration. App Service injects app settings into the running application process as environment variables, which matches the existing Python code. B adds management metadata to the Azure resource, not a process environment variable. C affects image construction and would require a build workflow change. D identifies a container image; it does not supply the database hostname.
Reference: Configure a custom container in Azure App Service
Question 4: Pull an Image Without a Password
An App Service app must pull a private image from Azure Container Registry without storing registry passwords. The registry uses RBAC Registry Permissions mode, allows ARM audience tokens, and is reachable from the app. Which configuration provides image access with the least privilege?
A) Give the app identity Reader and enable managed-identity pulls.
B) Give the app identity AcrPush and enable managed-identity pulls.
C) Give the app identity AcrPull and enable managed-identity pulls.
D) Give the deployment user AcrPull and disable identity-based pulls.
👁 Reveal Answer
Correct Answer: C
Explanation: C grants the app’s managed identity the AcrPull role at the registry scope and configures App Service to use that identity for image pulls. This avoids stored registry passwords. A permits management-plane reading but not image pulling. B includes image-push permissions that the app does not need. D gives access to the deployment user rather than the runtime identity that pulls the container image.
Reference: Use managed identity to pull an image from Azure Container Registry
Question 5: Test a Release with Limited Traffic
An HTTP inference API runs in Azure Container Apps. Its team wants the existing version to receive 90% of requests and a new version to receive 10% through the same application URL. Both versions must remain active during testing. Which configuration meets the requirement without creating another container app?
A) Use single revision mode and set two replica counts.
B) Use single revision mode and change the ingress port.
C) Use multiple revision mode and assign traffic weights.
D) Use multiple revision mode and deactivate the old revision.
👁 Reveal Answer
Correct Answer: C
Explanation: C keeps both revisions active and splits requests to the application URL according to configured percentages. This supports a controlled rollout within one container app. A does not provide concurrent version traffic splitting in single revision mode. B changes networking, not version allocation. D removes the existing revision from active service, so it cannot receive the required 90% of requests.
Reference: Update and deploy changes in Azure Container Apps
Question 6: Predict a Revision Change
An operations team tracks every new Azure Container Apps revision as a release. The team plans several configuration updates and wants to identify the one that creates a new revision rather than changing application-wide configuration. Which update should be tracked as a new revision?
A) Change the container image configured in the app template.
B) Change traffic weights between two existing active revisions.
C) Change the value of an existing application-level secret.
D) Change the credentials for an existing private image registry.
👁 Reveal Answer
Correct Answer: A
Explanation: A changes container configuration in the revision-scoped template, which creates a new immutable revision. B changes ingress traffic allocation at application scope. C changes an application-scoped secret and does not itself create a revision; affected revisions must restart to recognize new secret values. D updates private registry credentials at application scope rather than creating a new container template revision.
Reference: Azure Container Apps revision and application change types
Question 7: Wake a Queue Worker
A long-running worker in Azure Container Apps processes an Azure Service Bus queue. It has no HTTP ingress and can tolerate startup delay. The team wants zero running replicas when idle and automatic activation when messages arrive, without writing a polling scheduler. Which configuration should it use?
A) Set minimum replicas to zero and use an HTTP concurrency rule.
B) Set minimum replicas to zero and use a CPU utilization rule.
C) Set minimum replicas to one and use a memory utilization rule.
D) Set minimum replicas to zero and use a Service Bus KEDA rule.
👁 Reveal Answer
Correct Answer: D
Explanation: D uses the external queue as the scaling signal, allowing Container Apps to activate workers when messages arrive and return to zero when idle. Configure the scaler’s queue metadata and authentication, and use single revision mode for this non-HTTP event rule. A has no incoming HTTP requests to trigger activation. B has no running worker to generate CPU load at zero replicas. C keeps a replica running and scales on memory instead of queue demand.
Reference: Scaling in Azure Container Apps
Question 8: Inspect One Failing Replica
An Azure Container Apps API has two active revisions, each with several replicas and containers. A developer needs the live application log output from one identified container in one failing replica, not platform lifecycle messages. Which Azure CLI log selection should the developer use?
A) Environment logs with --follow for the hosting environment.
B) Console logs with revision, replica, container, and --follow.
C) System logs with --follow for the whole container app.
D) Console logs with --tail 50 for the selected container.
👁 Reveal Answer
Correct Answer: B
Explanation: B uses az containerapp logs show with --type console, --revision, --replica, --container, and --follow. It selects the exact application container and streams new output. A streams environment system messages. C streams container app system messages rather than application console output. D returns recent messages but does not continuously follow new output, which the scenario requires.
Reference: View log streams in Azure Container Apps
Question 9: Deploy from a Fresh Shell
A developer signs in to Azure CLI on a workstation that has kubectl installed but no cluster context. An existing AKS cluster is ready, and the developer has deployment permissions and a reviewed application manifest. Which sequence configures access, checks connectivity, and then deploys the application?
A) Run az aks get-credentials, kubectl get nodes, then kubectl apply -f app.yaml.
B) Run kubectl get nodes, kubectl apply -f app.yaml, then az aks get-credentials.
C) Run az aks get-credentials, kubectl get nodes, then kubectl get -f app.yaml.
D) Run az aks get-credentials, kubectl get nodes, then kubectl delete -f app.yaml.
👁 Reveal Answer
Correct Answer: A
Explanation: A first configures kubectl credentials and cluster context. Listing nodes then verifies connectivity before applying the manifest’s desired state. Supply the target cluster name and resource group to the credentials command. B tries to contact a cluster before configuring any context. C reads objects described by the manifest but does not deploy them. D deletes those objects instead of creating or updating the application.
Reference: Deploy an AKS cluster and application using Azure CLI
Question 10: Match the Service to the Listener
A public AKS API uses a Kubernetes Service of type LoadBalancer. The service selector already matches the API pods, and network policies allow traffic. The application listens on port 8080, but clients must connect to service port 80. Which service port configuration routes requests to the correct application listener?
A) Set port: 8080 and targetPort: 80.
B) Set port: 80 and targetPort: 80.
C) Set port: 80 and targetPort: 8080.
D) Set port: 8080 and targetPort: 8080.
👁 Reveal Answer
Correct Answer: C
Explanation: C exposes port 80 on the Service and forwards requests to port 8080 on the selected pods, where the application listens. A reverses the required frontend and backend ports. B exposes the requested service port but forwards to a port where the application is not listening. D reaches the correct backend port but exposes service port 8080 instead of the required port 80.
Reference: AKS application manifest and LoadBalancer service example
Study Tips for Container Hosting and Scaling
- Build versus run. ACR Tasks build images in Azure; runtime app settings supply values without rebuilding those images.
- Release identity. Use a unique, unreused tag for each deployed build so new replicas do not silently receive a different release.
- Revision scope. Container images and scale rules create new Container Apps revisions; traffic weights and secret values are application-scoped changes.
- Scaling signals. Match the trigger to actual demand, such as Service Bus queue messages for a worker without HTTP ingress.
Keep Practicing for Azure AI Cloud Developer
Review these AI-200 practice questions alongside small container deployment labs. The next set, Questions 11-20, will cover Cosmos DB and PostgreSQL retrieval, including embeddings, indexing, change feeds, and vector search.