CertifyAIxAce every AI certification.

AI-300 sample questions with answers

10 free practice questions for the Microsoft Certified: Machine Learning Operations Engineer Associate exam. Try each one, then open the answer to see why the right option wins and every other option loses.

Question 1Design and implement an MLOps infrastructure

Security at Relecloud requires that the Machine Learning workspace be unreachable from the public internet, that managed training compute have no public IP address, and that jobs reach only the company's own storage account and container registry. Which two actions should you take? Each correct answer presents part of the solution.

Choose 2.

  1. A.

    Enable the managed virtual network in allow-only-approved-outbound mode, add private endpoint outbound rules for the storage account and container registry, and provision compute without a public IP address.

  2. B.

    Apply a network security group to the workspace resource that denies all inbound traffic from the internet service tag.

  3. C.

    Enable the managed virtual network in allow-internet-outbound mode and rely on storage account firewall rules.

  4. D.

    Replace the workspace private endpoint with a service endpoint for Microsoft.MachineLearningServices on the subnet.

  5. E.

    Create a private endpoint for the workspace and set public network access on the workspace to disabled.

  6. F.

    Assign public IP addresses to the compute cluster nodes and restrict them with an Azure Firewall rule collection.

Show answer

Answer: A, E

Inbound isolation comes from a workspace private endpoint with public access disabled; outbound isolation comes from the managed virtual network in approved-outbound mode with private endpoint rules and no public IP compute.

  • A. Approved-outbound managed network with private endpoint outbound rules limits job egress to the named resources, and no-public-IP compute removes the public address.
  • B. Network security groups apply to subnets and network interfaces, not to a platform service such as a workspace, so this cannot be configured.
  • C. Allow-internet-outbound permits general egress and a storage firewall does nothing about compute public IP addresses.
  • D. A service endpoint keeps traffic on the backbone from a subnet but gives the workspace no private address and does not disable its public endpoint.
  • E. A private endpoint plus disabled public network access is the supported way to make the workspace reachable only from the virtual network.
  • F. Giving nodes public IP addresses contradicts the explicit requirement that managed compute have none.
Question 2Design and implement an MLOps infrastructure

An external modelling partner must submit training jobs and read registered data assets in the Litware workspace for six weeks. The partner must not be able to create compute, change workspace settings, or delete registered models. You must use the fewest assignments and the least privilege. What should you do?

  1. A.

    Assign the AzureML Data Scientist role at the workspace scope and add a deny assignment for compute.

  2. B.

    Create a custom role scoped to the workspace that grants the job, data and model read and write actions the partner needs, but omits compute and model delete actions, and assign it to the partner.

  3. C.

    Assign the Contributor role at the workspace scope and rely on an Azure Policy to block compute creation.

  4. D.

    Assign the AzureML Compute Operator role at the workspace scope and the Reader role at the resource group scope, which lets the partner submit jobs while keeping their permissions narrow.

Show answer

Answer: B

No built-in role matches the exact set of allowed actions, so a custom role scoped to the workspace is the least-privilege way to grant job submission and data reads while withholding compute creation and model deletion.

  • A. Data Scientist still allows deleting registered models, and deny assignments cannot be authored directly by a workspace administrator.
  • B. A custom role at workspace scope is the supported way to grant exactly the required actions when no built-in role matches the permission set.
  • C. Contributor grants far more than required, and Azure Policy governs resource configuration rather than revoking workspace asset actions such as model deletion.
  • D. This grants compute management, which is explicitly forbidden, and Reader alone cannot submit training jobs.
Question 3Design and implement an MLOps infrastructure

An engineer removed an obsolete storage account from the Bicep file and deployed with the mode set to complete. The deployment succeeded, but it also deleted the container registry that the workspace uses, which had been created outside the template, and the workspace is now inoperative. You must prevent a recurrence. Which two actions should you take? Each correct answer presents part of the solution.

Choose 2.

  1. A.

    Set the deployment mode to complete only on the nested template that contains the storage account.

  2. B.

    Use a deployment stack and its actionOnUnmanage setting whenever resources genuinely have to be removed.

  3. C.

    Assign the pipeline identity the Reader role on the resource group so that it is unable to delete resources.

  4. D.

    Deploy in incremental mode, the default, so that resources in the resource group that are absent from the template are left unchanged.

  5. E.

    Run az deployment group validate instead of az deployment group create so that no resource can ever be deleted.

  6. F.

    Add the container registry to the dependsOn array of the workspace resource in the template.

Show answer

Answer: B, D

Incremental mode leaves untemplated resources alone, and deployment stacks are the supported way to delete resources, so complete mode is not needed at all.

  • A. Only root-level templates support complete mode; linked and nested templates must use incremental mode.
  • B. Deployment stacks provide a supported, reviewable deletion mechanism through actionOnUnmanage, which is what complete mode was being misused for.
  • C. Reader cannot deploy either, so the pipeline would fail on every run rather than deploy safely.
  • D. Incremental mode leaves resources that exist in the resource group but are absent from the template untouched.
  • E. Validate performs checks but never deploys, so the pipeline would stop provisioning infrastructure altogether.
  • F. dependsOn orders operations inside one deployment and gives a resource no protection from complete-mode deletion.
Question 4Design and implement an MLOps infrastructure

Contoso maintains three near-identical GitHub Actions workflow files, one per environment, that differ only in the environment name and the parameter file passed to the deployment. A change to the deployment steps has to be made three times, and one copy has already fallen out of step with the others. What should you do?

  1. A.

    Move the deployment steps into a reusable workflow and call it once per environment with inputs for the environment name and parameter file.

  2. B.

    Replace the three files with three composite actions in the same repository, one for each environment.

  3. C.

    Combine the three workflows into a single file and guard every step with an if condition that selects the correct environment at run time.

  4. D.

    Keep the three files and add a scheduled workflow that compares them and opens an issue whenever they differ.

Show answer

Answer: A

A reusable workflow holds the deployment steps once and is called per environment with inputs, so a change is made in one place.

  • A. A reusable workflow holds the steps once and takes the per-environment differences as inputs, so changes are made in one place.
  • B. Three per-environment composite actions reproduce the same duplication one layer down.
  • C. Conditionals per step create three code paths in one file, which is harder to review and still drifts.
  • D. Detecting divergence after the fact does not remove the need to edit three files for every change.
Question 5Design and implement an MLOps infrastructure

Woodgrove must allow its data scientists to reach the Machine Learning workspace only from the corporate network's published egress addresses, and compute instances in the workspace must still provision successfully. Which two actions should you take? Each correct answer presents part of the solution.

Choose 2.

  1. A.

    Add the corporate egress ranges as IP network rules while the workspace's public network access remains disabled.

  2. B.

    Set the workspace's public network access to enabled from selected IP addresses and add the corporate egress ranges as IP network rules.

  3. C.

    Create the IP network rules in the same Bicep deployment that first creates the workspace.

  4. D.

    Enable the workspace managed virtual network, because compute instance provisioning fails when only selected IP addresses are configured.

  5. E.

    Apply a network security group to the workspace resource that permits only the corporate egress ranges.

  6. F.

    Add the private address ranges that the corporate network uses internally as IP network rules on the workspace.

Show answer

Answer: B, D

Selected-IP access is configured through the workspace's network ACLs, and it must be paired with network isolation or compute instance provisioning fails.

  • A. With public network access disabled the workspace rejects all public traffic and the IP rules are never evaluated.
  • B. Selected-IP access is configured with the workspace's IP network rules while public network access is enabled.
  • C. The IP addresses for a workspace can only be set after the workspace has been created.
  • D. Compute instance provisioning fails when selected IP addresses are configured without a managed virtual network or private endpoint.
  • E. A network security group filters virtual network traffic and cannot be applied to the workspace platform resource.
  • F. IP network rules accept only public internet IPv4 addresses; reserved private ranges are not allowed.
Question 6Design and implement an MLOps infrastructure

A change to the infrastructure template sets a customer-managed key on an existing Machine Learning workspace that was created without encryption settings. The pipeline deployment fails. The workload must end up encrypted with the customer-managed key. What should you do?

  1. A.

    Grant the workspace managed identity access to the key and redeploy the same template without other changes.

  2. B.

    Create a new workspace from the template with the encryption settings specified, and migrate the workload to it.

  3. C.

    Update the existing workspace with az ml workspace update, supplying the key vault ID and the key URI, and then redeploy the template.

  4. D.

    Redeploy the template in complete mode so that the workspace is replaced in place with the new encryption settings.

Show answer

Answer: B

Encryption, key vault ID and key identifier are fixed at workspace creation, so applying a customer-managed key means creating a new workspace.

  • A. Key access is a prerequisite for using a customer-managed key but does not make an existing workspace's encryption settings updatable.
  • B. Encryption settings are fixed at creation, so a new workspace with those settings and a migration is the supported path.
  • C. The workspace update command cannot change encryption settings, because those properties are immutable after creation.
  • D. Complete mode deletes resources that are absent from the template; it does not replace a resource that the template defines.
Question 7Design and implement an MLOps infrastructure

Jobs submitted by two engineers from the same repository record Git repository, branch and commit properties. Jobs submitted by a third engineer, from inside a container image, record none of those properties although the code is identical. What is the most likely cause?

  1. A.

    Git information is recorded only for jobs submitted through Machine Learning studio, not for jobs submitted locally.

  2. B.

    That engineer submits jobs from a detached HEAD, which the tracking feature treats as an untracked repository state.

  3. C.

    The git command is not available in that engineer's environment, so the upload process cannot read the repository information.

  4. D.

    That engineer's repository is hosted on a service other than GitHub, and only GitHub repositories are tracked.

Show answer

Answer: C

Git tracking depends on the git command being present in the submitting environment; without it no repository information is recorded.

  • A. Tracking applies to jobs submitted from the SDK and the CLI, which is exactly the path in this scenario.
  • B. A detached HEAD would affect the branch value, not suppress the repository URI, commit and dirty flag together.
  • C. The upload process shells out to Git, so an environment without the git command records no repository information at all.
  • D. The information comes from the local repository, so GitHub, GitLab, Bitbucket and Azure Repos are all tracked identically.
Question 8Design and implement an MLOps infrastructure

A pipeline redeploys the same Resource Manager template for a Machine Learning workspace and its dependent resources on every merge to main. Every deployment reports success. After each run, data scientists can no longer start their compute instances, and the studio reports that the workspace cannot reach its key vault. What is the most likely cause?

  1. A.

    The template pins an API version that is older than the one the workspace was created with, which silently drops its key vault property.

  2. B.

    The workspace resource is created before the key vault because the dependsOn chain is wrong, so the workspace stores an empty key vault reference.

  3. C.

    The template re-creates the key vault on every run, and deploying the vault clears its access policies, so the workspace loses the access it was granted.

  4. D.

    The deployment runs in complete mode, so the compute instances are deleted and then recreated on every run of the pipeline.

Show answer

Answer: C

Most template operations are idempotent, but redeploying a key vault clears its access policies, which breaks the workspace that depends on it.

  • A. An older API version can omit newer properties, but it does not remove the key vault association of an existing workspace on every run.
  • B. A wrong dependency order fails the deployment or produces an unresolved reference; here the deployment succeeds and the breakage is repeatable.
  • C. Key Vault clears its access policies whenever the template deploys it, which is the documented failure mode for repeated CI deployments.
  • D. Complete mode deletes resources absent from the template rather than recreating them, and it would not produce a key vault access error.
Question 9Design and implement an MLOps infrastructure

A Bicep deployment creates a Machine Learning workspace with the managed virtual network enabled and reports success. The pipeline's next step creates a managed online deployment, and that step fails. No compute has ever been created in this workspace. What should you do?

  1. A.

    Increase the instance count on the online deployment so that provisioning does not time out.

  2. B.

    Add an FQDN outbound rule for the scoring endpoint so that the online deployment is able to reach it.

  3. C.

    Disable public network access on the workspace and create a private endpoint for it in the hub virtual network before the online deployment is created.

  4. D.

    Provision the managed virtual network, with az ml workspace provision-network or the provision-network-now option at workspace creation, and wait for provisioning to complete before creating the online deployment.

Show answer

Answer: D

The managed virtual network is only provisioned lazily, and a managed online deployment cannot be created until it exists.

  • A. The failure is the absent managed network, not capacity, so more instances change nothing.
  • B. The scoring endpoint is created by the deployment; an outbound rule to it does not exist and would not make the network appear.
  • C. Inbound isolation is a separate concern, and no private endpoint for the workspace makes the managed network provision itself.
  • D. The managed network is provisioned lazily, and an online deployment cannot be created until provisioning has completed.
Question 10Design and implement an MLOps infrastructure

Three repositories deploy Machine Learning infrastructure through one Microsoft Entra application, each with its own federated identity credential. One of those repositories is archived, and its workflows must no longer be able to obtain a token for that identity. The other two repositories must continue to deploy without interruption. What should you do?

  1. A.

    Rotate the client secret on the application and distribute the new value to the two remaining repositories.

  2. B.

    Delete the AZURECLIENTID repository secret from the archived repository so that the login step has no client to authenticate.

  3. C.

    Delete the federated identity credential whose subject names the archived repository.

  4. D.

    Remove the application's role assignment on the subscription that the archived repository deployed to.

Show answer

Answer: C

Trust in a repository is expressed as a federated identity credential, so deleting that one credential revokes only that repository's access.

  • A. Federation uses no client secret, so there is nothing to rotate, and adding one would reintroduce the credential federation removed.
  • B. The client ID is a non-secret identifier that anyone with repository write access can restore, so deleting it revokes nothing.
  • C. The credential is what expresses trust in that repository, so deleting it revokes exactly that repository's ability to obtain a token.
  • D. Removing the role assignment withdraws authorization from all three repositories, breaking the two that must keep deploying.

Keep going with 561 more AI-300 questions

Free papers every day, in the real exam formats, with progress by exam domain. Unlock every paper and timed mock exam when you are ready.

Practise freeSee all AI-300 papers
AI-300 sample questions with answers (10 free) · CertifyAIx