Q01 - Question
You create an Azure Monitor Workbook for incident investigation. A dropdown parameter named ServiceName is populated by a KQL query that returns distinct cloud_RoleName values. You configure the parameter to allow multi-select so engineers can compare the extraction and moderation services. Which filter should the query steps use?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. | where cloud_RoleName in ({ServiceName})
- B. | where cloud_RoleName == {ServiceName}
- C. | where cloud_RoleName startswith {ServiceName}
- D. | where cloud_RoleName != {ServiceName}
A is correct.
Explanation: When a dropdown parameter allows multi-select, the parameter value becomes a comma-separated list. Use the in operator to filter by multiple values so the query returns data for all selected services.
B is incorrect: The == operator compares to a single value. It doesn't match a comma-separated list of selected services.
C is incorrect: The startswith operator matches the beginning of a single string. It doesn't filter by a list of values.
D is incorrect: The != operator excludes a value instead of filtering to the selected services.
Q02 - Question
You add a new document classification stage to an AI pipeline. If the stage generates inaccurate labels, an operator must be able to disable it from the Azure portal and have the running Python app skip the stage without a restart or redeployment. Which two actions should you take? Each correct answer presents part of the solution.
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Multiple choice
- A. Create a Production-labeled key named Pipeline_Classification_Prod and add code that checks which environment is active before it reads the key.
- B. Load configuration with feature_flags_enabled=True and feature_flag_refresh_enabled=True, and gate the stage with FeatureManager.is_enabled().
- C. Rely on updates to the Sentinel key to refresh feature flags, and omit the feature_flag_refresh_enabled parameter.
- D. Call config.refresh() in the application loop or request handler.
B and D are correct.
Explanation: A feature flag used as a kill switch lets an operator disable the stage at runtime. You load flags with feature_flags_enabled=True, turn on flag refresh with feature_flag_refresh_enabled=True, and check the flag with FeatureManager.is_enabled(). The app picks up the new flag state only when you call refresh() on the configuration object.
A is incorrect: Embedding environment names in key names and adding environment checks in code is the pattern that labels and feature flags replace, and it doesn't give operators a runtime toggle.
C is incorrect: Feature flag refresh is independent of configuration setting refresh. A change to the Sentinel key doesn't refresh feature flags, so you must set feature_flag_refresh_enabled=True.
Q03 - Question
Users report that some requests to a RAG application take longer than five seconds. The services are instrumented with the Azure Monitor OpenTelemetry Distro, and telemetry arrives in Application Insights. You need to identify which downstream calls contribute to the latency of these slow requests. Which two actions should you take? Each correct answer presents a complete solution.
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Multiple choice
- A. Select a slow request in the Performance pane and review the waterfall chart in the end-to-end transaction view.
- B. Run a KQL query that joins the requests table with the dependencies table on cloud_RoleName.
- C. Run a KQL query on the traces table to compare the durations of the downstream dependency calls.
- D. Run a KQL query that filters requests by duration and joins the requests table with the dependencies table on operation_Id.
A and D are correct.
Explanation: The end-to-end transaction view shows a waterfall chart of all spans in a single trace, with the duration of each operation, so you can see which child span takes most of the request time. A KQL join on operation_Id links each slow request to the dependency calls in the same distributed trace, because operation_Id corresponds to the OpenTelemetry trace ID.
B is incorrect: cloud_RoleName identifies the service, not the trace. A join on this column matches dependencies from unrelated requests handled by the same service, so it does not show which calls belong to a specific slow request.
C is incorrect: The traces table contains log records. Client, internal, and producer spans for downstream calls are stored in the dependencies table.
Q04 - Question
You set a 90-day expiration on an Azure OpenAI API key that is stored in Azure Key Vault. You need to generate and store a new credential before the key expires, without a manual step by an operator. What should you configure?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. An Event Grid subscription to the SecretNearExpiry event that triggers an Azure Function. The function generates a new credential with the target service and stores it as a new secret version.
- B. The expires_on property only, so that Key Vault blocks retrieval of the old key when it expires and applications switch to a new key.
- C. An Event Grid subscription to the SecretExpired event that triggers an Azure Function to generate and store a new credential.
- D. An Event Grid subscription to the SecretNewVersionCreated event that triggers an Azure Function to generate and store a new credential.
A is correct.
Explanation: The SecretNearExpiry event fires thirty days before a secret's expiration date. Event Grid delivers the event to an Azure Function that generates a new credential and stores it as a new secret version. This flow automates rotation before the secret expires.
B is incorrect: Expiration is informational. Expired secrets still exist and get_secret() can still retrieve them, so expires_on alone doesn't block access or create a new credential.
C is incorrect: The SecretExpired event fires when the current version's expiration date passes. It doesn't meet the requirement to rotate before the key expires.
D is incorrect: SecretNewVersionCreated fires after someone stores a new version. Use it to invalidate cached secrets, not to start rotation before expiration.
Q05 - Question
Your AI pipeline needs three settings: Pipeline:BatchSize, OpenAI:DeploymentName, and Storage:AccountKey. The storage account key must rotate on a schedule, and you need an audit trail of each access. The app must retrieve all three settings through a single load() call. Which design should you use?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. Store all three settings as direct values in App Configuration, and use labels to separate environments.
- B. Store Pipeline:BatchSize and OpenAI:DeploymentName as direct values in App Configuration, and store the account key in Key Vault with a Key Vault reference in App Configuration.
- C. Store all three settings in Key Vault, and read them with the Key Vault SDK.
- D. Store the account key in both App Configuration and Key Vault as independent values, so the app can read either copy.
B is correct.
Explanation: Values that grant access to a resource belong in Key Vault, which provides rotation, expiration policies, and per-object audit logging. Nonsensitive values such as batch sizes and deployment names belong in App Configuration. A Key Vault reference keeps App Configuration as the single entry point, so one load() call returns all three settings.
A is incorrect: App Configuration doesn't provide per-object audit logging, HSM-backed encryption, expiration policies, or automated rotation for the account key.
C is incorrect: Key Vault has stricter throttling limits and doesn't support labels, feature flags, or snapshots for nonsensitive settings. This design also doesn't use a single load() call.
D is incorrect: Independent copies in two services can drift apart, and the app might read a stale value. A Key Vault reference stores only a pointer, so there's one source of truth.
Q06 - Question
Your client requires two monitoring outcomes for the content moderation pipeline. First, the team must be notified when the 95th-percentile response time for any service exceeds three seconds. Second, the team must be notified about gradual performance degradation that might never exceed a fixed threshold. No one watches the monitoring views continuously. Which two solutions should you implement? Each correct answer presents part of the solution.
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Multiple choice
- A. A metric alert rule on average server response time with a threshold of three seconds.
- B. A log search alert rule that runs a KQL query returning services where percentile(duration, 95) exceeds 3000.
- C. A dashboard tile that renders p50, p95, and p99 latency as a time chart.
- D. Smart detection performance anomaly detection in Application Insights.
B and D are correct.
Explanation: A log search alert can use any KQL query, including percentile calculations, so it enforces the specific three-second p95 threshold. Smart detection learns the normal behavior of your application and detects performance that is worse than its historical norm, including gradual degradation that never exceeds a fixed number.
A is incorrect: An average response time can stay within acceptable limits even when a significant percentage of requests is slow. It doesn't enforce a p95 requirement.
C is incorrect: A dashboard tile shows latency, but it requires someone to be watching. It doesn't notify the team.
Q07 - Question
You add error handling to a Python service that calls get_secret() on a SecretClient. You want the service to retry only failures that might resolve without operator intervention. Missing secrets and missing RBAC role assignments must fail immediately so that operators can diagnose them. Which exception type should trigger a retry?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. ResourceNotFoundError
- B. HttpResponseError
- C. ServiceRequestError
- D. Any exception that get_secret() raises
C is correct.
Explanation: ServiceRequestError indicates a network-level problem, such as a DNS resolution failure or a timeout. This type of failure might resolve on retry.
A is incorrect: ResourceNotFoundError means that the secret name doesn't exist in the vault. This is a configuration error that requires operator intervention, so a retry won't resolve it.
B is incorrect: HttpResponseError covers authentication and authorization failures, such as an identity that lacks the required RBAC role. Retrying doesn't fix a missing role assignment.
D is incorrect: Retrying every exception also retries configuration and authorization errors. These errors won't resolve on their own, and retries delay diagnosis.
Q08 - Question
Your document processing pipeline sends telemetry to Application Insights. An operations engineer opens the Log Analytics workspace directly from the Azure portal, not from the Application Insights resource. The engineer needs to write a KQL query that returns failed incoming HTTP requests for the classification service. Which table should the query start with?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. requests
- B. AppExceptions
- C. AppRequests
- D. AppDependencies
C is correct.
Explanation: Query scope determines the table names you use. When you query a Log Analytics workspace directly, you use the workspace table names. Incoming HTTP requests are stored in AppRequests.
A is incorrect: requests is the Application Insights table name. Use it when you open logs from the Application Insights resource, not when you query the workspace directly.
B is incorrect: AppExceptions stores errors and exceptions with stack traces. It doesn't store incoming HTTP requests with duration and success status.
D is incorrect: AppDependencies stores outbound calls to databases, HTTP endpoints, and other services. It doesn't store incoming requests.
Q09 - Question
Operators often change several related settings in Azure App Configuration at the same time, such as Pipeline:BatchSize and Pipeline:RetryCount. The Python app must use the new values without a restart, and operators must control when the changes take effect so that the app doesn't apply a partial update. What should you implement?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. Configure load() with refresh_on set to WatchKey("Sentinel") and a refresh_interval, call config.refresh() in the request handler, and update the Sentinel key after you change the other settings.
- B. Configure load() with a refresh_interval only, and rely on the provider to push updated values to the app without calling refresh().
- C. Call load() once at startup and restart the app after operators finish changing the settings.
- D. Create a new label for each set of changes, and redeploy the app with a new label_filter value in its SettingSelector.
A is correct.
Explanation: With the sentinel key pattern, operators change the settings first and then update the Sentinel key. When the provider detects the change to the watched key, it reloads the entire configuration, so the app receives all changes together on the next refresh cycle.
B is incorrect: The provider doesn't push values. You must call refresh() explicitly, and you need refresh_on to define the sentinel key to watch.
C is incorrect: A restart doesn't meet the requirement to pick up changes without restarting the app.
D is incorrect: Redeploying the app for each change removes the benefit of updating configuration without redeployment.
Q10 - Question
You are building a document processing pipeline that runs in Azure Container Apps. The app must read settings from an Azure App Configuration store. A security review requires that the app store no connection strings and receive only the permissions it needs. Developers must also run the same code locally without changing the authentication code. What should you do?
Domain: Secure, monitor, and troubleshoot Azure solutions (20–25%) Type: Single choice
- A. Store the App Configuration connection string in an environment variable and pass it to the provider at startup.
- B. Use DefaultAzureCredential with the app's managed identity, and assign the App Configuration Data Owner role to that identity.
- C. Use DefaultAzureCredential with the app's managed identity, and assign the App Configuration Data Reader role to that identity.
- D. Write conditional authentication logic that uses a connection string in production and Azure CLI credentials in local development.
C is correct.
Explanation: DefaultAzureCredential uses managed identity on Azure-hosted services such as Container Apps and uses the Azure CLI or Visual Studio Code credential in local development, so one credential class covers both environments. The App Configuration Data Reader role grants read-only access to key-value pairs, feature flags, and Key Vault references, which follows the principle of least privilege.
A is incorrect: A connection string grants full access to the store and must be managed and rotated, which conflicts with the requirement to store no connection strings.
B is incorrect: The App Configuration Data Owner role allows creating and modifying settings. Assign it to operators or CI/CD pipelines, not to an app that only reads settings.
D is incorrect: DefaultAzureCredential removes the need for conditional authentication logic, and using a connection string in production still violates the security requirement.