Azure-AI_Foundry

Module 2: Knowledge Check

Test your understanding of Projects, Hubs, networking, and security. Choose the best answer for each question.

Question 1

Your organization has three teams (Marketing, Engineering, Support) that all need access to GPT-4o and Azure AI Search. Each team builds different applications. What is the recommended structure?

A) One hub, one shared project for all teams
B) Three separate hubs, one per team
C) One hub with shared connections, three projects (one per team)
D) Three separate Azure OpenAI resources, no hub needed

✅ Answer **C) One hub with shared connections, three projects (one per team)** A single hub centralizes shared infrastructure (connections, networking, policies) while separate projects provide workspace isolation for each team. Hub-level connections to GPT-4o and AI Search are automatically available to all projects.

Question 2

A developer has the “Azure AI Developer” role on a project but cannot access it. What is the most likely cause?

A) The developer needs the “Owner” role on the project
B) The developer lacks “Reader” access on the parent hub
C) The project has exceeded its quota
D) The developer needs a separate Azure OpenAI resource

✅ Answer **B) The developer lacks "Reader" access on the parent hub** Users need at minimum Reader access on the parent hub to access any child project. Project-level roles alone are insufficient.

Question 3

You’re deploying an AI Foundry hub for a financial services company with strict regulatory requirements. Which networking configuration should you use?

A) Public access with IP allowlist
B) Managed VNet with “Allow Internet Outbound” mode
C) Managed VNet with “Allow Only Approved Outbound” mode and private endpoints
D) Public access with Azure Front Door

✅ Answer **C) Managed VNet with "Allow Only Approved Outbound" mode and private endpoints** For strict regulatory environments, "Allow Only Approved Outbound" restricts all egress to explicitly approved destinations, and private endpoints ensure no public internet exposure for the hub.

Question 4

When creating an AI Hub via Bicep, which kind value do you use for the Microsoft.MachineLearningServices/workspaces resource?

A) kind: 'AIHub'
B) kind: 'Hub'
C) kind: 'Workspace'
D) kind: 'AIFoundry'

✅ Answer **B) `kind: 'Hub'`** The Bicep resource type `Microsoft.MachineLearningServices/workspaces` uses `kind: 'Hub'` for hubs and `kind: 'Project'` for projects.

Question 5

A hub has connections to Azure OpenAI and Azure AI Search configured at the hub level. A new project is created in that hub. What happens to the connections?

A) The project must create its own connections
B) Hub connections are automatically available to the new project
C) Hub connections must be manually duplicated to the project
D) Only the Azure OpenAI connection is inherited

✅ Answer **B) Hub connections are automatically available to the new project** Connections defined at the hub level are inherited by all child projects automatically. Projects can also create their own additional connections.

Question 6

You want to ensure that your AI Foundry hub’s managed identity can read secrets from Key Vault. Which RBAC role should you assign?

A) Key Vault Contributor
B) Key Vault Secrets User
C) Key Vault Administrator
D) Key Vault Crypto Officer

✅ Answer **B) Key Vault Secrets User** Key Vault Secrets User provides read-only access to secrets, following the principle of least privilege. If the hub also needs to create/update secrets, use Key Vault Secrets Officer instead.

Question 7

What is the default limit for projects per hub in Azure AI Foundry?

A) 10
B) 50
C) 100
D) Unlimited

✅ Answer **C) 100** The default limit is 100 projects per hub. This can be increased by filing an Azure support ticket.

Question 8

Your team needs to deploy AI Foundry hubs across multiple environments. Which approach ensures consistency and auditability?

A) Create hubs manually in the Portal for each environment
B) Use Bicep or Terraform templates stored in version control
C) Export ARM templates after manual creation
D) Use the Python SDK in a Jupyter notebook

✅ Answer **B) Use Bicep or Terraform templates stored in version control** Infrastructure as Code (Bicep/Terraform) in version control ensures repeatable, auditable, and reviewable deployments across environments.

Question 9

Which managed identity type is recommended when a single identity needs to be shared across multiple AI Foundry hubs?

A) System-assigned managed identity
B) User-assigned managed identity
C) Service principal with client secret
D) Shared access signature (SAS)

✅ Answer **B) User-assigned managed identity** User-assigned managed identities have an independent lifecycle and can be shared across multiple resources. System-assigned identities are tied to a single resource.

Question 10

You’ve enabled diagnostic settings on your AI Foundry hub. Which Azure service should you send logs to for centralized querying and alerting?

A) Azure Blob Storage
B) Azure Event Hubs
C) Azure Log Analytics workspace
D) Azure SQL Database

✅ Answer **C) Azure Log Analytics workspace** Log Analytics provides centralized log storage, KQL querying, dashboards, and integration with Azure Monitor alerts — ideal for AI Foundry diagnostics.

Question 11

A compliance officer asks you to ensure all secrets used by AI Foundry connections are automatically rotated. Where should you implement this?

A) In the application code
B) In Azure Key Vault with rotation policies
C) In the AI Foundry portal settings
D) In Azure Active Directory

✅ Answer **B) In Azure Key Vault with rotation policies** Azure Key Vault supports automated secret rotation policies. Since AI Foundry stores connection secrets in Key Vault, rotation policies ensure secrets are refreshed on schedule.

Question 12

You’re designing a multi-region AI Foundry deployment for a global company. Data from European users must stay in Europe. Which topology is appropriate?

A) One hub in East US with global projects
B) Separate hubs in each region (e.g., East US and West Europe)
C) One hub with VNet peering across regions
D) Azure Front Door routing to a single hub

✅ Answer **B) Separate hubs in each region (e.g., East US and West Europe)** Data residency requirements mandate that data stays in the designated region. Separate hubs ensure that storage, Key Vault, and AI resources remain region-local.

Question 13

Which Key Vault configuration should you enable to prevent accidental permanent deletion of secrets used by AI Foundry?

A) Access policies
B) Soft delete and purge protection
C) Premium SKU
D) Double encryption

✅ Answer **B) Soft delete and purge protection** Soft delete retains deleted secrets for recovery, and purge protection prevents permanent deletion during the retention period — critical for protecting AI Foundry connection secrets.

Question 14

An AI application running in an Azure Container App needs to call a model deployed in AI Foundry. What is the most secure authentication method?

A) Embed the API key in the container’s environment variables
B) Use a managed identity assigned to the Container App
C) Store the key in a config file within the container image
D) Use a shared access signature

✅ Answer **B) Use a managed identity assigned to the Container App** Managed identity provides credential-free authentication. The Container App's identity is granted the appropriate RBAC role on the AI Foundry project, eliminating the need for API keys.

Question 15

You need to restrict outbound traffic from your AI Foundry hub to only Azure OpenAI and Azure AI Search endpoints. Which configuration achieves this?

A) Network Security Group with deny-all outbound rule
B) Managed VNet with “Allow Only Approved Outbound” and FQDN rules
C) Azure Firewall with application rules
D) Private endpoints only (no outbound rules)

✅ Answer **B) Managed VNet with "Allow Only Approved Outbound" and FQDN rules** The "Allow Only Approved Outbound" isolation mode blocks all outbound traffic by default. FQDN rules whitelist specific destinations like `*.openai.azure.com` and `*.search.windows.net`.

Score Guide

Score Rating
13–15 ⭐ Excellent — Ready for Module 3
10–12 👍 Good — Review missed topics
7–9 📖 Fair — Re-read lessons before continuing
< 7 🔄 Needs review — Revisit all lessons
*← Lesson 3 Module 3 — Model Catalog & Deployments →*