Microsoft Azure AI Engineer Associate Practice Test (AI-102)

Authenticating the az CLI through a service principal exposed in an Azure DevOps service connection avoids embedding the resource's primary or secondary keys in source control or pipeline variables. Granting the principal the Cognitive Services Contributor role on the target resource provides the least-privilege access needed to run az cognitiveservices account deployment create. When the secret, certificate, or workload-identity federation for the service principal is rotated, the service connection is updated independently of the YAML file, so the pipeline continues to work. The other approaches either store long-lived secrets directly in the pipeline, cannot be rotated transparently, or rely on user credentials rather than a dedicated principal, violating the stated policies.

Azure AI Search (formerly Azure Cognitive Search) is purpose-built for knowledge mining scenarios. It can crawl a variety of data sources, apply an enrichment pipeline that includes pre-built and custom cognitive skills to extract structure from unstructured content, and then index the results to provide rich, full-text and faceted search experiences. Azure AI Document Intelligence can extract fields from individual documents but does not provide scalable indexing and search. Azure OpenAI Service focuses on large language models, and Azure Databricks with Delta Lake offers analytics but no turnkey enrichment and search capabilities.

Running the Custom Vision runtime container on an edge device keeps all inference on-premises, eliminates the need for constant Internet connectivity, and provides sub-second latency. Publishing to the cloud prediction endpoint or to an AML managed endpoint still requires outbound connectivity and adds network latency. Azure OpenAI cannot host vision models, so that option is not applicable.

Azure Developer CLI (azd) looks for a file named azure.yaml at the project root. The azure.yaml manifest contains services and resources nodes that declaratively list every Azure resource the project needs (such as an AI Foundry hub, Storage, Key Vault, and Application Insights). When you run azd up or azd provision, the CLI reads azure.yaml and generates/executes the underlying Bicep or ARM templates to provision all listed resources in the chosen resource group. Other YAML files-such as environment.yml (Python package environment) or flow.dag.yaml (prompt-flow definition)-configure runtime components but do not drive initial infrastructure deployment, and there is no supported foundry.yaml file in the Azure AI Foundry toolchain.

Apply Azure AI Content Safety to the user input in the inbound stage. An llm-content-safety policy (or a direct call to the text:analyze endpoint) lets you set category thresholds-Hate ≥ 2 and Sexual ≥ 2-and turn on shield-prompt=true. The policy blocks the request if the content exceeds the configured severity or if a prompt attack is detected, ensuring the model never sees disallowed content. Relying only on completion filters is too late, system-messages can be ignored, and batch reviews are not real-time.

The detailed, per-request information you require is emitted by the Azure AI Services platform as RequestLogs. By creating a diagnostic setting on the contoso-ai resource and selecting the RequestLogs (or AllLogs) category, you can stream those logs directly to an Azure Monitor Log Analytics workspace. Once the diagnostic setting is in place, every call-including its operation name, response code, and the key used-is recorded and becomes immediately queryable with Kusto queries. Exporting the subscription's activity log would only provide control-plane events, not request-level data. Connection Monitor tests and Application Insights dependency tracking would require additional configuration on every client and do not automatically capture the platform-level fields requested.

To call an Azure AI service with Azure AD, the calling identity must be granted a role that allows invocation of the service's inference operations. The least-privileged built-in role for this purpose is Cognitive Services User. It provides permissions to read and execute API calls against the resource while denying management actions. Cognitive Services Contributor would also work but grants unnecessary create, update, and delete rights. Reader permits only viewing resource metadata, and Managed Identity Operator is unrelated to Azure AI permissions. Assigning the Cognitive Services User role enables token-based access without exposing excess privileges.

The recommended client library for Azure AI Document Intelligence in .NET is distributed as the Azure.AI.DocumentIntelligence NuGet package. This package contains the DocumentIntelligenceClient class and related types that let you invoke layout, prebuilt, and custom models such as the prebuilt-invoice model. Azure.AI.FormRecognizer remains available for backward compatibility but targets the earlier Form Recognizer SDK; Microsoft.Azure.CognitiveServices.FormRecognizer is an even older management-plane SDK and lacks the new Document Analysis APIs. Azure.AI.TextAnalytics is for natural-language processing tasks and cannot analyze documents, so only Azure.AI.DocumentIntelligence meets the requirement.

Azure AI Language (formerly the Cognitive Service for Language) offers built-in capabilities for language detection, sentiment analysis, entity recognition, and extractive summarization. It also allows you to train and deploy custom multi-label text classification models, so all of the required tasks can be performed by one service. Azure AI Document Intelligence focuses on extracting structured data from documents, not general NLP. Azure AI Speech targets speech-to-text and related audio scenarios. Azure OpenAI Service provides powerful generative models but is not optimized for turnkey sentiment analysis, language detection, or custom text classification workflows that the Language service supplies out of the box.

Azure OpenAI provides a built-in content safety system that can be configured per deployment. By enabling the content filtering policy and setting the Violence and Sexual categories to the block severity threshold, the runtime will automatically refuse or safe-complete requests that include disallowed content while still allowing benign requests. Web application firewalls and generic text analytics profanity filters do not inspect model generations deeply enough for Responsible AI compliance, and a private endpoint only secures network access-it does not moderate content.

Azure AI Speech exposes a single real-time endpoint (for example, wss://.stt.speech.microsoft.com/speech/universal/v2) that can receive live audio, convert it to text, and simultaneously translate the recognized text into one or more target languages. The Translator service handles only text input, Azure AI Language works with already-transcribed text, and Azure Live Video Analytics focuses on video processing without built-in speech recognition.

GPT-4o supports a 128k-token context window-enough for a 100,000-token document-and is engineered to run roughly twice as fast and at lower cost per token than GPT-4 Turbo. This makes it the best balance of large context, performance and price for the scenario. GPT-4-Turbo-128k also supports the needed context but is slower and more expensive. GPT-3.5-Turbo-16k cannot accept the required prompt length, and the Ada embedding model is not a generative language model, so it cannot directly perform summarization.

Azure AI Document Intelligence is purpose-built for extracting structured data from documents such as invoices, receipts, and contracts. It offers pre-built and customizable models that can be trained with a small set of sample files and exposes the results through REST and SDK endpoints. Azure AI Vision focuses on image classification and object detection, Azure AI Language provides capabilities like question answering and sentiment analysis, and Azure AI Speech to Text converts spoken audio to text-none of which natively extract tabular and field information from invoices.

Deploying the hub with an Azure Resource Manager (ARM) or Bicep template meets both requirements. A template is fully declarative, so you can repeatedly deploy the same hub definition to any subscription. The template can include the hub plus its dependent resources (Azure Storage account, Azure Key Vault, Azure Application Insights, and optionally an Azure Container Registry and Azure AI Services account). When the hub is created with these dependencies, every new project you create under the hub automatically reuses those resources. Creating the hub manually or by using an ad-hoc PowerShell script is not idempotent across subscriptions, and project-level CLI commands cannot run until a hub already exists.

The Read operation in Azure AI Vision (formerly the Computer Vision service) is a pre-built optical character recognition (OCR) capability that extracts printed and handwritten text from images and documents in more than 160 languages. It returns text lines and their bounding boxes but does not attempt to parse the document into key-value pairs or tables, making it ideal when you only need raw text. Azure AI Document Intelligence (Form Recognizer) targets structured extraction and would be more complex than necessary. Azure Custom Vision is intended for training image classification or object-detection models, not text extraction. Azure Video Indexer focuses on audio and video insights rather than still-image OCR.

Phi-2 is a 2.7-billion-parameter open-weight language model published by Microsoft. Because the weights can be downloaded from the Azure AI model catalog, the model can be executed completely offline and even on a single consumer-class GPU, making it suitable for edge scenarios that lack network connectivity. GPT-4 and GPT-3.5-Turbo are only available as hosted Azure OpenAI endpoints, so they require cloud access and cannot be run locally. DALL-E 3 is an image generation model, not a text-generation model, and also relies on a hosted service.

Azure AI Document Intelligence (formerly Form Recognizer) provides prebuilt and custom models for extracting key-value pairs, tables, and line items from documents such as invoices, receipts, and contracts. It supports heterogeneous layouts, can learn from a small labeled sample set, and outputs structured JSON. Azure Cognitive Search focuses on full-text indexing and search, not detailed field extraction. Conversational Language Understanding targets dialog intents, and Speech to Text transcribes audio, so neither meets the document information-extraction scenario.

When you call the OpenAI Python SDK against an Azure OpenAI endpoint you must let the library know that it is talking to Azure and reference the model by its deployment name, not by the base model name. Setting the environment variable OPENAI_API_TYPE=azure switches the SDK into Azure mode, and replacing the model parameter with deployment_id="gpt4-prod" points the request to the existing GPT-4 deployment. The other options either omit the required API type setting, rely on a deprecated parameter, or use a different client library that would still require the same Azure-specific configuration.

Azure OpenAI Service is the appropriate choice because it provides hosted large language models such as GPT-4, supports prompt engineering and fine-tuning, and is delivered entirely within the Azure compliance boundary. Form Recognizer focuses on document information extraction, Speech Service handles speech capabilities, and Custom Vision is intended for image classification or object detection-none of which supply the required generative text functionality.

Monitoring Reader grants read-only access to all monitoring data, including metrics and the ability to create private workbooks. The role includes only */read control-plane actions and therefore does not permit operations such as Microsoft.CognitiveServices/accounts/listkeys/action that would expose or rotate the resource keys. Cognitive Services User and Cognitive Services Contributor both include the list-keys action, while Cognitive Services Data Reader can read Cognitive Services data but cannot access Azure Monitor metrics or workbooks. Therefore, Monitoring Reader best meets the requirement.