AI-200 Practice Test
Microsoft Certified: Azure AI Cloud Developer Associate
AI-200 tests how you build the back end behind AI apps — containers, vector data, messaging, and security — not just how you call a model.
Our 500 scenario-based questions cover the full AI-200 blueprint: Container Apps and AKS hosting, vector similarity search in Cosmos DB and PostgreSQL with pgvector, Azure Managed Redis caching, Service Bus and Event Grid integration, Azure Functions, and securing solutions with Key Vault, App Configuration, OpenTelemetry, and KQL. Calibrated to real exam difficulty so test day feels familiar.
Start Free Practice — 40 QuestionsNo credit card required. Upgrade to full 500 questions for $19.99 when ready.
Is this for you?
This is NOT for you if:
AI-200 Exam Details
What to expect on exam day
Questions
40
Duration
100 minutes
Passing Score
700
Exam Cost
$165
Exam Domains Covered
Master all topics tested on the AI-200 exam
Develop containerized solutions on Azure (20-25%)
Develop AI solutions by using Azure data management services (25-30%)
Connect to and consume Azure services (20-25%)
Secure, monitor, troubleshoot Azure solutions (20-25%)
Test Yourself Right Now
Try 5 real practice questions — no signup needed
5 Free AI-200 Questions
See how ready you are for the AI-200 exam. Each question includes a detailed explanation so you learn as you go.
Sample AI-200 Practice Questions
10 real questions from the free AI-200bank. Pick an answer in your head, then open “Show answer” for the explanation.
1. Which kubectl command parses a Kubernetes manifest file and creates the Deployment, Service, and other objects it defines inside an AKS cluster?
- A. kubectl create cluster -f
- B. kubectl apply -f
- C. az aks apply -f
- D. kubectl deploy -f
Show answer
Correct answer: B
kubectl apply -f parses a manifest file and creates or updates the Kubernetes objects it defines against the cluster's desired state. kubectl create cluster and az aks apply are not valid ways to apply a manifest to an existing cluster's workloads, and kubectl deploy is not a real kubectl subcommand.
2. A payments team must deploy a new container image version while (1) guaranteeing zero downtime for existing users and (2) sending only 10 percent of production traffic to the new version before a full cutover. Which Container Apps configuration satisfies both constraints?
- A. Multiple revision mode, using traffic weights to route 10 percent of requests to the new revision alongside revision labels for controlled testing
- B. Single revision mode with the default rollout, which automatically shifts production traffic to the new revision as soon as it becomes healthy
- C. Deploying a second, entirely separate container app and manually repointing DNS once testing finishes
- D. Single revision mode combined with a scheduled maintenance window to gradually shift traffic
Show answer
Correct answer: A
Multiple revision mode with traffic weights and revision labels is the documented blue-green mechanism that lets a percentage of traffic reach a new revision while the stable revision keeps serving the rest, satisfying both the zero-downtime and gradual-rollout constraints. Choice B moves straight to all traffic once the new revision is healthy, violating the 10-percent constraint. Choice C introduces DNS propagation delay and is not a native Container Apps mechanism for partial traffic control, risking the zero-downtime constraint. Choice D, single revision mode, has no built-in mechanism for splitting traffic by percentage between revisions, so it cannot meet the 10-percent constraint.
3. Which underlying technology does Azure Container Apps use to implement declarative, event-driven autoscaling based on triggers such as queue length or HTTP request rate?
- A. Kubernetes Horizontal Pod Autoscaler (HPA) configured directly by the app owner
- B. Azure Automation runbooks polling each container app on a timer
- C. KEDA (Kubernetes Event-driven Autoscaling)
- D. Azure Monitor autoscale settings applied to a virtual machine scale set
Show answer
Correct answer: C
Container Apps uses KEDA under the hood to support scaling rules against a wide range of event sources, including HTTP requests, queue messages, and CPU or memory load. Container Apps abstracts away direct HPA configuration, so choice A does not match how scaling is exposed to app owners. Runbook polling and VM scale set autoscale settings, choices B and D, are unrelated mechanisms tied to different compute platforms.
4. A platform team relies on a geo-replicated Premium registry with automatically triggered ACR Tasks that rebuild images whenever a base image is patched. They want builds to keep succeeding during a home-region outage, without paying for a second full registry. Which documented limitation must they design around?
- A. ACR Tasks always run in the registry's home region and do not execute while that region is unavailable, even though the registry itself is geo-replicated
- B. ACR Tasks automatically fail over to run in the nearest healthy geo-replica region without any configuration
- C. Tasks can be pinned to a specific geo-replica region using the --source-acr-auth-id parameter on az acr build
- D. Once at least two geo-replicas exist, Tasks no longer depend on the home region for execution
Show answer
Correct answer: A
Per Microsoft's reliability guidance, ACR Tasks are bound to the registry's home region and simply do not run during a home-region outage, regardless of how many geo-replicas exist. Choices B and D both incorrectly claim Tasks execution follows the replicas or fails over automatically, which is the opposite of the documented limitation. Choice C misuses --source-acr-auth-id, which specifies the caller identity for ABAC-enabled registry authentication and has nothing to do with pinning a task to a region.
5. A finance team runs AKS clusters in West Europe and Southeast Asia that pull images from a single geo-replicated Premium registry whose home region is North Europe. They need image pulls to keep working from both AKS regions during a North Europe outage, and they also need to know which registry operations remain blocked until North Europe recovers. Which statement correctly reflects both requirements?
- A. Geo-replication keeps both data-plane pulls and control-plane changes, such as network rule updates, fully available across replica regions during a home-region outage
- B. Enabling geo-replication on a Standard SKU registry removes the home-region dependency for control-plane changes during an outage
- C. Geo-replication requires the geo-replicas to sit in Azure paired regions, meaning West Europe and Southeast Asia could not both serve as replicas for the same registry
- D. Data-plane pulls continue from the surviving West Europe and Southeast Asia replicas, but control-plane changes such as network rule updates stay unavailable until North Europe recovers
Show answer
Correct answer: D
Choice D matches the documented reliability behavior: pushes and pulls keep working from surviving geo-replicas, but registry configuration changes are only possible in the home region and are blocked during its outage. Choice A overstates availability by including control-plane operations, which is exactly the constraint it violates. Choice B is wrong because geo-replication is a Premium-only feature and does not fully remove the home-region dependency for control-plane operations even when enabled, which violates the control-plane-blocked constraint. Choice C is wrong because Azure Container Registry geo-replication does not require Azure paired regions; any combination of supported regions can be chosen, which violates the region-flexibility constraint implied by the scenario.
Show 5 more questions
6. A team deploys a custom container to App Service from a private Azure Container Registry. Security policy prohibits storing any long-lived registry password in the app's configuration, but the on-call team also needs Azure to manage the credential's lifecycle so there is nothing to manually rotate. Which authentication approach satisfies both requirements?
- A. Assign a managed identity to the web app, grant it the AcrPull role on the registry, and authenticate pulls with that identity instead of an admin username and password
- B. Store the registry's admin password as an encrypted-at-rest Application Setting on the web app configuration
- C. Disable the registry's admin account and instead store a personal access token inside the app's configuration settings
- D. Continue authenticating with the registry's admin username and password, rotating the stored password by hand on a weekly basis
Show answer
Correct answer: A
A managed identity authenticated through the AcrPull role has no stored password at all, and Azure automatically manages the identity's underlying credentials, satisfying both the no-stored-password and no-manual-rotation requirements. Choice B still stores a password, just encrypted, which violates the no-stored-password policy. Choice C still stores a long-lived secret, the token, and is not the documented mechanism for App Service-to-ACR authentication, so it violates the no-stored-password constraint. Choice D keeps a stored password that someone must manually rotate every week, violating both requirements.
7. A platform team investigates a pod CrashLoopBackOff event that happened three hours ago on an AKS cluster where Container insights has never been enabled, since the team wanted to avoid its ingestion cost. What is the outcome when they try to retrieve that specific event now?
- A. The event is retrievable from the node's local disk at /var/log/containers regardless of Container insights
- B. The event is retrievable if the pod is still currently in the CrashLoopBackOff state, regardless of elapsed time
- C. The event is gone from kubectl get events, since Kubernetes events are kept only one hour unless Container insights stores them longer
- D. The event is still retrievable because Kubernetes events are persisted indefinitely on the API server
Show answer
Correct answer: C
Kubernetes events have no long-term retention mechanism and are only available for one hour after being generated; enabling Container insights is required to store them for longer. Choice A confuses container stdout and stderr logs, a separate concept, with the Kubernetes events API object, and does not override the one-hour events retention limit, so it fails to satisfy the cost-avoidance constraint the team already committed to. Choice B describes a condition unrelated to event retrieval. Choice D is the opposite of the documented one-hour retention behavior.
8. In Azure Container Apps, what triggers the platform to automatically create a new revision of a container app?
- A. Viewing the container app's overview page in the Azure portal
- B. Restarting an already-active revision
- C. A revision scope change, such as updating the container image, an environment variable, or a scale rule
- D. The container app receiving increased HTTP traffic
Show answer
Correct answer: C
A new revision is created whenever a revision-scope change is applied to the app's template, such as a new image, environment variable, or scale rule. Simply viewing the app in the portal or restarting an existing revision does not create a new revision. An increase in traffic triggers scaling within the current revision's replicas, not the creation of a new revision.
9. Which Azure CLI command builds a container image from a local Dockerfile and pushes it to Azure Container Registry, running the build entirely in Azure without requiring a local Docker Engine installation?
- A. docker build
- B. az acr build
- C. az acr import
- D. az acr task create
Show answer
Correct answer: B
az acr build is the ACR Tasks quick task command that uploads the build context to Azure, runs the build natively in the cloud, and pushes the resulting image, all without a local Docker Engine. docker build requires a local Docker installation. az acr import copies an already-built image between registries rather than building one. az acr task create defines an automated, trigger-based task rather than performing a one-time on-demand build.
10. Which Azure Container Registry Tasks feature lets you define an ordered sequence of build, push, and test steps for one or more container images in a single declarative YAML file?
- A. A quick task
- B. A connected registry
- C. Content trust
- D. A multi-step task
Show answer
Correct answer: D
Multi-step tasks use a YAML file to define a sequence of steps, such as building, pushing, and testing multiple containers, in a single task definition. A quick task performs a single on-demand build and push, not a multi-step sequence. A connected registry synchronizes an on-premises or remote replica with a cloud registry. Content trust is an image-signing feature unrelated to defining build pipelines.
AI-200 study resources
Why Practice with MSCertQuiz?
Microsoft Learn teaches concepts. We prepare you for the actual exam.
Deep coverage of the exam's largest domain — vector similarity search and RAG patterns across Cosmos DB, PostgreSQL/pgvector, and Azure Managed Redis
Scenario-based questions on Container Apps, KEDA event-driven autoscaling, and AKS manifest deployments — not just service definitions
Explanations teach the architectural reasoning behind each answer, including which constraint (cost, latency, throughput) rules out each wrong option
Updated for the current AI-200 exam objectives covering back-end AI engineering on Azure
Not sure if you're ready for the AI-200 exam?
Take the free AI-200 Readiness Check →What Our Users Say
88% pass rate — Based on users who completed at least 2 practice exams
“The pgvector and Cosmos DB vector search questions were exactly the kind of depth the real exam demands — nothing else I found covered RAG patterns at this level. Passed AI-200 with 780.”
Ravi D.
AI-200 Certified
“I came in strong on containers but weak on the data-management domain. The Azure Managed Redis and change feed questions closed that gap fast — that domain is over a quarter of the exam.”
Clara M.
Passed AI-200 first try
“The KEDA autoscaling and Service Bus scenarios matched the real exam's difficulty closely. Explanations actually taught the reasoning, not just which letter was correct.”
Samuel O.
Azure AI Cloud Developer Associate
Choose Your Plan
Start free, upgrade when you're ready to get serious
Free
Good for exploring the platform
- 40 practice questions
- Practice mode only
- Progress tracking
- No exam simulation mode
AI-200 Full Access
Best if your exam is in the next 2-4 weeks
- 500 practice questions
- Practice & Exam modes
- Detailed explanations
- Lifetime access
7-day money-back guarantee
Pro — All Certs
Best if you're planning multiple Microsoft exams
- ALL certifications included
- Unlimited questions
- New certs added free
- Cancel anytime
Save 30% vs buying individually
Your AI-200Exam Won't Wait
Candidates who complete at least 2 full mock exams pass at significantly higher rates than those who only study passively.
Don't risk $165 on the real exam without testing yourself first.
Start Free Practice NowNo credit card required • 40 free questions • Upgrade for $19.99 when ready
Official Microsoft Resources
Our practice questions are aligned with official Microsoft exam objectives. We recommend studying with Microsoft Learn first, then using MSCertQuiz to test your readiness.
View Official AI-200 Exam DetailsAI-200 Frequently Asked Questions
Everything you need to know about the AI-200 Azure AI Cloud Developer certification
What is AI-200?
How much does the AI-200 exam cost and how long is it?
What is the passing score for AI-200?
What topics are covered on AI-200?
How hard is AI-200?
How long should I study for AI-200?
What are the prerequisites for AI-200?
Who should take AI-200?
Also Preparing For
Candidates studying AI-200 often prepare for these certifications next.