You are developing an AI-powered API that retrieves connection strings and API keys from Azure Key Vault.
You must configure a solution that provides the following security functionality:
* The API must authenticate to Key Vault without storing credentials in any application configuration files
* The identity used by the API must have only the minimum permissions necessary to read secrets.
* The configuration must minimize the blast radius if an identity or credential is compromised.
You need to implement a secure access strategy for the API.
Which two actions should you perform? Each correct answer presents part of the solution. Choose two.
NOTE: Each correct selection is worth one point.

• A. Grant the Key Vault Secrets User role at vault scope
• B. Use system assigned managed identity.
• C. Assign the Key Vault Administrator role at subscription scope.
• D. Store a secret value in Azure App Configuration.

Explanation: Only visible for TestPassKing members. You can sign-up / login (it's free).

You are developing an AI application that retrieves database credentials from Key Vault by using the Azure SDK for Python.
The application must use managed identity for authentication.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:

Verified Answer: Yes; Yes; No.
Detailed Explanation: The get_secret call supplies an explicit version value, so it retrieves that particular version of dbPassword. DefaultAzureCredential can authenticate to Key Vault by using the Azure-hosted application's managed identity without embedding a client secret in the application. Because the code requests a fixed version, later secret rotation creates a newer version but subsequent executions of this exact code continue to request the specified old version. To follow the latest version automatically, the version parameter must be omitted.
Study Guide Alignment: Security and operations: Key Vault, App Configuration, managed identity, OpenTelemetry, Azure Monitor, and KQL-based troubleshooting.
Official Microsoft Learn References: AI-200 Study Guide | Managed identities for Azure resources | Use Key Vault references for App Service and Functions

You are developing an Azure Function that calls external APIs by providing an access token for the API. The access token is stored in a secret named token in an Azure Key Vault named mykeyvault.
You need to ensure the Azure Function can access the token. Which value should you store in the Azure Functions app configuration?

• A. KeyVault:mykeyvault;Secret:token
• B. @Microsoft.KeyVault(SecretUri= [https://mykeyvault.vault.azure.net/secrets/token/](https://mykeyvault.vault.azure.net/secrets/token/))
• C. App:Settings:Secret:mykeyvault:token
• D. AZUREKVCONNSTR_ [https://mykeyvault.vault.azure.net/secrets/token/](https://mykeyvault.vault.azure.net/secrets/token/)

You need to troubleshoot connectivity failures between microservices running in AKS.
Which troubleshooting actions should you perform? To answer, move the appropriate action to the correct troubleshooting scenario. You may use each action once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Explanation:
* Service fails to communicate with another service: Inspect Kubernetes service endpoints.
* Pod restarts repeatedly: Inspect container logs.
* Readiness probe failures are observed: Inspect Pod descriptions.
For a service-to-service communication failure , first inspect the Kubernetes service endpoints . Microsoft' s AKS troubleshooting guidance recommends verifying that the destination pod IP address and application port appear as endpoints for the Kubernetes Service. An empty or incorrect endpoint list commonly indicates a selector/label mismatch, incorrect port configuration, or unavailable backend pods.
For a pod that restarts repeatedly , inspect the container logs , including the previous container instance when necessary. Microsoft specifically recommends kubectl logs < pod > --previous for workloads that repeatedly restart because it exposes application errors and termination messages from the container immediately before the restart.
For readiness probe failures , inspect the Pod description by using kubectl describe pod. The description exposes the configured health probes, pod conditions, container state, and associated probe-failure events, allowing you to determine whether the probe path, port, timing, or application readiness behavior is incorrect.
Microsoft recommends reviewing kubectl describe output when pods are not Ready or health probes are failing.
Therefore, the correct mapping is service endpoints # container logs # Pod descriptions .
Study Guide references: AKS troubleshooting; Kubernetes Services and endpoints; container logging; Pod health; readiness/liveness probes; kubectl describe and kubectl logs.

A semantic search application queries Azure Database for PostgreSQL and stores document embeddings and metadata in a table with the following columns:
* embedding (pgvector)
* department
* created_at
The application must return the top five most similar documents for a given query embedding only from the finance department. You need to implement semantic retrieval with metadata filtering.
Which query components should you select? To answer, move the appropriate query components to the correct requirements. You may use each query component once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.

Explanation:

Verified Answer: Filter: `WHERE department = ' finance ' `. Rank/top five: `ORDER BY embedding < = > query_embedding LIMIT 5`.
Detailed Explanation: The metadata predicate must restrict the candidate rows to the Finance department, so the `WHERE department = ' finance ' ` component supplies the required filter. The pgvector cosine-distance operator ` < = > ` orders rows by vector distance to the supplied query embedding, and `LIMIT 5` keeps only the five nearest matches. Ordering by creation date would rank recency rather than semantic similarity, and a wildcard department filter would not satisfy the Finance-only requirement.
Study Guide Alignment: AI data-management workloads: Cosmos DB, PostgreSQL, caching, vector storage, vector retrieval, consistency, and connection optimization.
Official Microsoft Learn References: AI-200 Study Guide | Vector similarity search with Azure PostgreSQL