Q1.You are building a knowledge-search application over internal documents on Azure OpenAI.
So that users can easily verify the answers, you want every generated answer to always include citations (sources) that point to the specific source documents used as evidence.
Which implementation should you adopt?
Show answer
To attach sources to answers, the retrieval step extracts each document’s metadata (source name, page, or section), returns it alongside the generated result, and the prompt explicitly instructs the model to cite it.
This is an implementation pattern that combines a RAG pipeline with prompt design, and it cannot be achieved by adjusting sampling parameters such as top_p or by changing the content filter.
Using only the base model with no retrieval (C) cannot reference any evidence documents in the first place, so it cannot attach sources.
Therefore, the correct answer is B.
Overview of Azure OpenAI On Your Data
Q2.You are developing an expense-processing application for the accounting team, and you need to extract structured field data (invoice number, total amount, vendor name) from several kinds of scanned invoices that have different layouts.
The solution must not require training any custom model whatsoever.
Which service should you use?
Show answer
The prebuilt invoice model (prebuilt-invoice) is already trained to recognize common invoice fields such as vendor, total, line items, and invoice number out of the box, so it requires no training data of your own and no creation of a custom model.
It also handles several kinds of invoices with different layouts, so it satisfies the “no training required” requirement.
The Read API (A) performs only text reading (OCR) and does not return field structure.
Custom NER (C) and a custom neural model (D) assume that you train them yourself, so they violate the requirement.
Invoice model – Document Intelligence
Q3.You are developing an AI API deployed to Azure Container Apps (ACA).
This API requires database credentials, which are stored in Key Vault, and Key Vault is access-controlled with Azure RBAC.
The credentials are rotated periodically by the security team.
The app must always use the latest version of the credentials without being redeployed and without exposing secrets in code or configuration.
You need to implement a secure access method that retrieves the latest secret at runtime and prevents credential leakage.
Which three actions should you perform? (Each correct answer is part of the solution.)
*Each correct answer is worth one point.
Show answer
To use the latest credentials after rotation without embedding secrets in code or configuration and without redeploying, first grant the ACA app a system-assigned managed identity (D), assign that identity a Key Vault RBAC role (Key Vault Secrets User) (A), and retrieve the secret at runtime with the SDK (E).
This lets you reference the latest version dynamically without exposing the credentials.
Because Key Vault is configured with RBAC, access policies (B) are not used.
Exporting at deployment time (C) exposes the secret and cannot follow rotation, so it is inappropriate.
Use managed identities in Container Apps
Q4.You deploy a private container image from Azure Container Registry (ACR) to App Service.
App Service must authenticate to ACR in order to pull (retrieve) the image.
In this configuration, you must not store static registry credentials.
You need to configure secure image-pull authentication.
Select the appropriate option in the answer area.
*Each correct answer is worth one point.
Show answer
To securely pull a private image from ACR without storing static credentials, configure a managed identity on App Service and assign that identity the Container Registry Repository Reader role that permits pulling images.
Authenticating with a managed identity and a role assignment lets you pull securely without holding any password.
Enabling the admin user or storing the registry password in app settings would retain static credentials, which violates the requirement.
A webhook is a mechanism for event notification and is not used to authenticate an image pull.
Pull images from ACR with a managed identity
Q5.You configure ACR Tasks to automate image builds.
You must rebuild the container image in the following cases.
◆When an application update occurs.
◆When the base image (such as the underlying OS image) is updated.
◆When a periodic, scheduled rebuild is required.
You need to configure ACR Tasks to support automatic rebuilds.
Which three triggers should you configure? (Each correct answer is part of the solution.)
*Each correct answer is worth one point.
Show answer
The three requirements correspond to the three types of ACR Tasks triggers respectively.
Scheduled runs use the timer trigger (A), application updates (commits) use the source code commit trigger (B), and base image updates use the base image update trigger (D) to rebuild automatically.
The registry event trigger (C) and the webhook notification trigger (E) are mechanisms for external notification and integration, and do not match the rebuild-trigger requirements asked here.
Overview of ACR Tasks
Q6.You are developing a .NET app that stores application data in Azure Cosmos DB for NoSQL.
The app must use the Cosmos DB for NoSQL SDK to operate on the database account and perform the following operations.
◆Initialize the connection using the account endpoint and key.
◆Define shared throughput.
◆Perform create, read, update, and delete (CRUD) operations on items in a container.
Match the appropriate SDK component to each requirement.
*Each correct answer is worth one point.
Drag each option to the matching requirement’s drop zone, or tap to place it. Click a filled zone to send it back. (The same option may be used more than once.)
Database
Container
Indexing policy
Show answer
In the Cosmos DB for NoSQL SDK, classes are separated by role.
Connection initialization uses CosmosClient, shared throughput (RU/s) is configured at the database level so it uses Database, and item CRUD operations use the Container class.
Shared throughput shares the capacity set on the database across all containers under it.
It is Container that exposes the CRUD methods for items (JSON documents).
Indexing policy is a component that defines the indexing strategy; it does not match any of these three requirements, so it is unused (a distractor).
Get started with the Cosmos DB for NoSQL .NET SDK
Q7.You are provisioning and configuring a Service Bus processor for an AI batch job.
The processor must connect to an existing queue, register handlers for message processing and error handling, and then begin receiving messages.
Arrange the four actions that must be performed in sequence into the correct order.
*Each correct answer is worth one point.
Drag (or tap) the required number of items from the “Options” on the left into the “Answer area” on the right. Within the answer area, drag to reorder them.
- Register the message handler and the error handler
- Create the Service Bus client
- Send failed messages to the dead-letter queue
- Start the message processor
- Create the Service Bus processor for the queue
- Drag here
Show answer
First, create the Service Bus client using a connection string or an Azure Identity credential, and from that client generate a processor that targets the queue.
Next, register handlers to define the behavior when a message arrives and when an error occurs, and finally call the method that begins receiving, which starts the internal loop.
The correct order is create the client → create the processor → register the handlers → start the processor, and the processor stays in a waiting state until the start method is called.
“Send failed messages to the dead-letter queue” is an option not needed in this initialization sequence.
Get started with Service Bus queues (.NET)
Q8.From a Python API running on ACA, you need to send distributed traces to Azure Monitor.
The API is creating spans, but no traces appear in Azure Monitor.
You need to configure the OpenTelemetry SDK pipeline to export traces to Azure Monitor.
Match the appropriate action to each requirement.
*Each correct answer is worth one point.
Drag each option to the matching requirement’s drop zone, or tap to place it. Click a filled zone to send it back. (The same option may be used more than once.)
Configure a span processor to send spans to the exporter
Initialize the app’s TracerProvider
Call tracer.start_as_current_span()
Enable log sampling
Show answer
No traces appear because the export pipeline, which includes the exporter and the span processor, is not configured.
Create an exporter component that sends to Azure Monitor, and configure a span processor such as BatchSpanProcessor to send spans to that exporter.
Register and initialize this on the TracerProvider, and finally generate spans with tracer.start_as_current_span(); then traces are sent to Azure Monitor.
“Enable log sampling” is an option not needed for this configuration.
Enable Azure Monitor with OpenTelemetry
Q9.You are designing an Azure Functions app that exposes a public API.
The solution must satisfy the following.
◆Validate the data of incoming requests and return the result to the caller immediately.
◆Support Microsoft Entra ID authentication.
◆Guarantee idempotent processing even if the same request is retried.
◆Scale automatically in response to load variation.
◆Avoid duplicate processing.
You need to implement a trigger.
Which trigger should you implement?
Show answer
The core of the requirements is a synchronous response that returns the result to the caller immediately, plus Entra ID authentication and automatic scaling.
An HTTP trigger performs synchronous request/response, and it can validate the payload and immediately return 200 or 400.
You can build in Entra ID token validation with App Service Authentication (Easy Auth), and it scales automatically with traffic on the Consumption/Premium plan.
Idempotency and duplicate avoidance are achieved by combining Durable Functions or a backing store.
Service Bus, Event Grid, and Queue storage are for asynchronous processing and are not suited to an immediate response to the caller.
HTTP trigger for Azure Functions
Q10.You plan to develop an Azure Functions app with an HTTP trigger.
The app must support the following capabilities.
◆Event-driven scaling
◆The ability to use a custom Linux image to run the functions
You need to identify the app’s hosting plan and the maximum time the function can take to respond to an incoming request.
Select the appropriate values in the answer area.
*Each correct answer is worth one point.
Show answer
The plan that satisfies both event-driven scaling and a custom Linux container image is the Premium (Elastic Premium) plan.
It supports dynamic scale-out by the scale controller and scales down to 0 instances when idle.
Unlike the Consumption plan, it can run a custom Linux image.
Also, regardless of the host.json setting, HTTP-trigger functions have a 230-second response limit that comes from the underlying Azure Load Balancer, and the connection is dropped beyond it.
Therefore, the hosting plan is Premium and the timeout value is 230 seconds.
Azure Functions hosting options