Operationalizing ML and Generative AI Solutions · 18% of the exam

Design and implement an MLOps infrastructure: free practice questions

5 sample questions from our 45-question bank for this domain — answers and explanations included. These are the same scenario-based style as the real Microsoft exam.

1. A company is designing an Azure Machine Learning workspace with a managed virtual network. The networking team requires that outbound traffic from the workspace's managed network to the internet be completely blocked, but the workspace must still be able to pull base Docker images from Microsoft Artifact Registry (mcr.microsoft.com) to build custom environments. Which managed network outbound rule type should be configured to allow this traffic?

  • A. A service tag outbound rule allowing traffic to the 'MicrosoftContainerRegistry' service tag.
  • B. An FQDN outbound rule allowing outbound traffic to the FQDN 'mcr.microsoft.com'.✓ Correct
  • C. A private endpoint outbound rule to a private endpoint associated with Microsoft Artifact Registry.
  • D. A user-defined route in the managed virtual network that directs traffic to mcr.microsoft.com through an Azure Firewall instance.
Explanation

Azure Machine Learning managed virtual networks support FQDN outbound rules, which allow outbound traffic to specific fully qualified domain names over HTTPS. Adding an FQDN rule for 'mcr.microsoft.com' is the correct and supported way to allow access to Microsoft Artifact Registry from a managed network with internet outbound blocked. Service tag outbound rules (option A) in managed networks are used for Azure service tags that represent Azure service IP ranges, not for container registry FQDN access; additionally, the 'MicrosoftContainerRegistry' service tag covers the data plane of Azure Container Registry, not MCR specifically. Private endpoint outbound rules (option C) are for private endpoints to your own Azure resources, not for public Microsoft endpoints. User-defined routes (option D) are not a concept within the Azure ML managed virtual network — UDRs apply to customer-managed VNets, not the managed network abstraction.

2. A company uses Azure Machine Learning managed online endpoints for model deployment. The MLOps team wants to implement blue-green deployments using traffic splitting. After deploying a new 'green' deployment alongside the existing 'blue' deployment, they want to route 20% of traffic to 'green' and 80% to 'blue'. Using the Azure CLI v2, which command achieves this?

  • A. az ml online-endpoint update --name my-endpoint --traffic "blue=80 green=20" --workspace-name ml-workspace --resource-group ml-rg✓ Correct
  • B. az ml online-deployment update --name green --traffic-weight 20 --endpoint-name my-endpoint --workspace-name ml-workspace --resource-group ml-rg
  • C. az ml online-endpoint create --name my-endpoint --traffic-split blue:80,green:20 --workspace-name ml-workspace --resource-group ml-rg
  • D. az ml online-deployment create --name green --mirror-traffic 20 --endpoint-name my-endpoint --workspace-name ml-workspace --resource-group ml-rg
Explanation

The correct command is 'az ml online-endpoint update' with the '--traffic' flag specifying deployment name/percentage pairs as a space-separated string. This updates the traffic allocation on the endpoint level. Option B is incorrect because traffic weights are managed at the endpoint level, not the deployment level; 'az ml online-deployment update' does not have a '--traffic-weight' flag. Option C is incorrect because 'az ml online-endpoint create' is for initial creation, not updating traffic, and '--traffic-split' is not the correct flag syntax. Option D confuses '--mirror-traffic', which is used for mirroring a percentage of traffic to a deployment for testing purposes without serving it to users, not for live traffic splitting.

3. A team has an Azure Machine Learning workspace in a virtual network with all public network access disabled. A data scientist on the team reports that they cannot connect to the workspace from their local machine using the Azure ML Python SDK. What is the MOST likely reason and the correct resolution?

  • A. The data scientist's Azure AD account lacks the AzureML Data Scientist role on the workspace; assigning the role will fix the issue.
  • B. The workspace does not have a private endpoint provisioned in a virtual network that the data scientist can reach, so traffic cannot traverse the public internet to the workspace.✓ Correct
  • C. The Azure Machine Learning compute cluster inside the workspace needs to be restarted for network changes to take effect.
  • D. The data scientist needs to install the 'azureml-core' package instead of the 'azure-ai-ml' package to connect to network-restricted workspaces.
Explanation

When public network access is disabled on an Azure ML workspace, all SDK and portal connections must route through a private endpoint. If the data scientist's machine is not on a network that can reach that private endpoint (e.g., via VPN, ExpressRoute, or being on the same VNet), the connection will fail. Option A (missing role assignment) would produce an authorization error, not a connectivity failure; also, role assignments are separate from network access. Option C (restarting the compute cluster) has no effect on control-plane connectivity from the data scientist's local machine to the workspace endpoint. Option D is incorrect because the SDK package choice ('azureml-core' vs. 'azure-ai-ml') does not affect whether the workspace is reachable over the network.

4. An MLOps engineer needs to register an Azure Machine Learning datastore that connects to an Azure Blob Storage container. The organization's policy requires that the datastore authenticate using a managed identity rather than account keys or SAS tokens. The workspace has a system-assigned managed identity enabled. Which two steps must the engineer complete to successfully configure this datastore? (Select TWO)

  • A. Grant the workspace's system-assigned managed identity the 'Storage Blob Data Contributor' role on the target Azure Blob Storage account.✓ Correct
  • B. Register the datastore using the Azure ML SDK or CLI with the credential type set to 'none' (identity-based access).✓ Correct
  • C. Upload the storage account's access key to the Azure Machine Learning workspace's associated Key Vault before registering the datastore.
  • D. Assign the 'Contributor' role on the Azure Machine Learning workspace itself to the storage account's service principal.
  • E. Enable the 'Allow Azure services on the trusted services list to access this storage account' firewall setting on the storage account.
Explanation

For identity-based (credential-less) datastore access, two things are required: (1) the workspace's managed identity must be granted an appropriate data-plane role — 'Storage Blob Data Contributor' (or at minimum 'Storage Blob Data Reader') — on the storage account; and (2) the datastore must be registered with credential type 'none' so Azure ML uses the managed identity at runtime instead of a key or SAS token. Uploading an access key to Key Vault (option C) is used for key-based authentication, which contradicts the policy. Assigning 'Contributor' on the workspace to the storage account's service principal (option D) is backwards and irrelevant. Enabling the trusted services firewall exception (option E) may be needed for network access in certain configurations but is not a prerequisite for identity-based datastore authentication in a standard setup.

5. A company has a policy that all Azure Machine Learning datastores must connect to Azure Data Lake Storage Gen2 using credential-less (identity-based) access rather than account key or SAS token authentication. A data engineer registers a new datastore but training jobs fail to read data with an authorization error. The workspace uses a system-assigned managed identity. What is the most likely cause of the failure?

  • A. Identity-based access is not supported for Azure Data Lake Storage Gen2 datastores; account key authentication must be used.
  • B. The workspace's system-assigned managed identity has not been granted a data-plane role (such as 'Storage Blob Data Reader') on the ADLS Gen2 storage account.✓ Correct
  • C. The datastore was not registered using the '--account-key' flag, so authentication is incomplete.
  • D. The training job's compute cluster is in a different region than the ADLS Gen2 account, causing cross-region access to fail.
Explanation

For credential-less (identity-based) access to work, the managed identity that the training job uses (in this case the workspace's system-assigned managed identity, or the compute cluster's identity) must have an appropriate data-plane RBAC role — at minimum 'Storage Blob Data Reader' — on the ADLS Gen2 account. Without this role assignment, the identity cannot read data even though no credential is stored. Identity-based access is fully supported for ADLS Gen2 datastores in Azure ML, so option A is incorrect. Using '--account-key' would add credentials, contradicting the policy requirement and is not the fix. Cross-region access between compute and storage is supported in Azure; while it may have latency implications, it does not cause authorization errors.

40 more questions in this domain

Practice the full bank with instant grading, flashcards, and a timed mock exam.

Start practicing free