Microsoft Machine Learning Operations Engineer Associate AI-300 practice questions
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About
Try 20 questions free →

Microsoft Machine Learning Operations Engineer Associate AI-300 Design and implement an MLOps infrastructure: 165 practice questions

Microsoft Machine Learning Operations Engineer Associate AI-300 165 questions 12 shown free

12 of the 165 Design and implement an MLOps infrastructure questions in the Certsqill Microsoft Machine Learning Operations Engineer Associate AI-300 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for Microsoft Machine Learning Operations Engineer Associate AI-300? Take the free 5-min readiness check →

1. Grant the identity a suitable storage data role: Which missing step is required?

Medium
A fraud workspace uses its managed identity to submit a training job. Authentication succeeds, storage private-endpoint DNS resolves, but the job reports `403 Blob read denied`. Exhibit: the identity has workspace Contributor, but no storage data-plane role. Which missing step is required?
  1. Assign the user Owner on the workspace.
    Changing the user’s workspace role does not grant the job identity permission to read storage data.
  2. Move training to a compute instance with interactive access.
    Changing compute type does not change the managed identity’s denied storage data-plane permission.
  3. Add another private endpoint for the workspace.
    The exhibit already confirms storage private-endpoint DNS resolution, so adding workspace connectivity does not address authorization.
  4. Grant the identity a suitable storage data role. ✓
    Storage data-plane authorization is missing even though workspace access, authentication, and network reachability succeed.
The trap
Confuses network reachability with storage authorization. Treats compute selection as a permissions repair. Changes the wrong principal and authorization plane.

Grant the executing identity storage data-plane permission; workspace Contributor alone does not authorize blob reads.

2. Grant the identity an appropriate storage data role: What should you change?

Easy
An equipment-failure training job uses a registered datastore. Registration succeeds, and the workspace managed identity authenticates, but reading the blob input returns HTTP 403. The identity has workspace Contributor and network access. What should you change?
  1. Increase the compute cluster minimum node count.
    More compute capacity cannot resolve an authorization failure returned while reading the input datastore.
  2. Recreate the datastore with a different name.
    Renaming or recreating the reference does not grant the executing identity permission to read blob data.
  3. Grant the identity an appropriate storage data role. ✓
    The identity needs storage data-plane permission; workspace Contributor alone does not authorize blob content reads.
  4. Register the same storage as a second datastore.
    A second datastore still uses the same underlying permissions and therefore reproduces the 403 failure.
The trap
Rebuilds metadata while leaving authorization unchanged. Mistakes an access error for a capacity problem. Duplicates the reference without changing access.

The 403 indicates missing storage data-plane authorization, not a datastore registration or compute-capacity problem.

3. Use an autoscaling compute cluster with minimum nodes set: Which approach best fits?

Medium
A document-classification team runs 200 noninteractive batch training jobs each month. Jobs can run concurrently, and the budget prohibits compute remaining allocated between runs. Which approach best fits?
  1. Use an autoscaling compute cluster with minimum nodes set to zero. ✓
    A cluster supports concurrent jobs and can scale to zero between runs, avoiding unnecessary idle allocation.
  2. Use a compute cluster with one minimum node for faster job startup.
    Keeping one node allocated may improve startup time but violates the requirement to avoid idle compute between runs.
  3. Use one persistent compute instance and submit each training job separately.
    A persistent instance is not an appropriate scalable target for many concurrent, noninteractive training jobs and incurs idle allocation.
  4. Use a larger compute instance and schedule all jobs sequentially overnight.
    Sequential scheduling does not use the available parallelism and makes capacity less responsive to batch demand.
The trap
Optimizes startup latency over the explicit cost constraint. Substitutes larger fixed capacity for scalable parallel execution. Uses interactive-style persistent capacity for batch processing.

An autoscaling cluster supports parallel batch jobs and can scale to zero when idle.

4. Grant the executing identity the needed storage data role: Which action is correct?

Medium
A warehouse-optimization analyst can open the workspace and submit a job. Telemetry confirms authentication and private-network resolution, but the job receives AuthorizationPermissionMismatch when reading a storage table. The analyst already has workspace Contributor. Which action is correct?
  1. Add another private endpoint for workspace and storage.
    Network resolution already succeeds, so additional connectivity does not fix the denied storage operation.
  2. Issue a new workspace token and submit the job again.
    Authentication has succeeded; replacing the token does not resolve the storage data-plane denial.
  3. Grant the analyst workspace Owner.
    Workspace Owner does not automatically grant the needed storage data-plane permission.
  4. Grant the executing identity the needed storage data role. ✓
    The evidence isolates the failure to storage authorization, so the identity performing the read needs the appropriate data-plane role.
The trap
Broadens workspace control without fixing storage authorization. Confuses network reachability with authorization. Treats authorization failure as authentication failure.

Give the executing identity the required storage data-plane role.

5. Use immutable or versioned source bytes: What reproducibility gap should be fixed?

Hard
A customer-churn pipeline registers a folder data asset pointing to `churn/current`. A rerun one week later produces different rows, although code, environment, and asset name are unchanged. What reproducibility gap should be fixed?
  1. Use immutable or versioned source bytes. ✓
    The folder reference points to mutable content, so immutable or explicitly versioned data is needed for reproducibility.
  2. Replace data-asset registration with MLflow tracking.
    Experiment tracking records runs and metrics but does not freeze mutable files referenced by the asset.
  3. Recreate the compute target before every run.
    Recreating compute does not prevent the referenced storage folder from changing.
  4. Create a second untracked copy of every training file.
    Duplication without immutable lineage does not establish which source bytes produced each run.
The trap
Changes execution capacity instead of source lineage. Confuses experiment tracking with data versioning. Creates copies without guaranteeing source immutability.

The asset references mutable bytes; use immutable or explicitly versioned source data.

6. Grant the identity a scoped registry pull role: Which least-privilege change is appropriate?

Medium
A literature-search pipeline builds its environment from a private container registry. The job identity can submit jobs and read datasets, but environment creation fails with an image-pull authorization error. The identity has no registry pull permission. Which least-privilege change is appropriate?
  1. Grant write access to the dataset storage account.
    Dataset storage permissions do not authorize pulling an environment image from the private registry.
  2. Allow unauthenticated image pulls from the private registry.
    Removing registry authentication weakens protection and is unnecessary when the executing identity can receive scoped pull access.
  3. Grant the identity subscription-level resource management access.
    Broad subscription management access is excessive for a read-only image-pull operation and violates least privilege.
  4. Grant the identity a scoped registry pull role. ✓
    Environment creation needs read access to pull the referenced image, so a scoped registry pull role satisfies the requirement with least privilege.
The trap
Changes access on an unrelated resource. Uses administrative scope for a narrow dependency. Weakens the security boundary instead of correcting identity authorization.

Grant the identity only scoped permission to pull from the registry.

7. Configure the pipeline to use validated version 2: Select TWO actions that provide a safe rollback and preserv

Easy
A release pipeline uses reusable components. Component version 3 caused a production regression, while version 2 passed validation. Select TWO actions that provide a safe rollback and preserve investigation evidence.

Select two. More than one option is correct — every correct one is ticked below.

  1. Rebuild version 3 with newly resolved dependencies before comparison.
    Changing dependencies introduces another variable and makes the regression comparison less reproducible.
  2. Configure the pipeline to use validated version 2. ✓
    Selecting the previously validated version provides a controlled rollback without deleting or modifying the failing component.
  3. Compare versions 2 and 3 with identical inputs. ✓
    Identical inputs provide a controlled comparison that helps isolate version-specific behavior while preserving evidence.
  4. Disable the production workspace while investigating the component.
    Disabling the workspace is broader than necessary and does not provide component-level rollback or controlled evidence collection.
  5. Delete version 3 after saving its display name.
    Deleting the failing version removes useful artifacts and prevents later inspection or comparison.
The trap
Destabilizes the investigation by changing the failing version. Destroys investigation evidence during diagnosis. Uses an unrelated infrastructure action instead of release control.

Roll back to version 2 and compare both versions using identical inputs.

8. Align both asset versions: Which comparison best isolates the cause?

Medium
A document assistant uses a component and environment from a registry. Workspace A performs well, but Workspace B shows a regression. The workspaces currently use different component versions and environment definitions. Which comparison best isolates the cause?
  1. Align both asset versions. ✓
    Using identical versioned component and environment assets controls the software configuration so remaining workspace differences can be investigated.
  2. Copy Workspace A storage into Workspace B before testing.
    Copying storage changes data location and adds variables without controlling the software asset versions.
  3. Repeat the current Workspace B run.
    Repeating the same uncontrolled configuration does not account for the differing component and environment versions.
  4. Upgrade both workspaces to their newest registered assets.
    Upgrading both introduces additional changes instead of isolating the cause of the existing regression.
The trap
Repeats an uncontrolled experiment. Adds uncontrolled changes during diagnosis. Changes infrastructure instead of aligning software assets.

Align both registered component and environment versions.

9. Give the runner private routing and DNS for Azure: Select TWO practices that are required for a secure, repeat

Medium
A team wants GitHub Actions to submit Azure Machine Learning jobs for support-response generation without storing long-lived Azure secrets. The repository is private, and the runner must reach private Azure resources. Select TWO practices that are required for a secure, repeatable workflow.

Select two. More than one option is correct — every correct one is ticked below.

  1. Store an encrypted client secret in the repository for authentication.
    An encrypted repository file still uses a long-lived secret, contrary to the requirement.
  2. Give the runner private routing and DNS for Azure resources. ✓
    The runner needs network reachability and name resolution for private resources.
  3. Configure GitHub OIDC federation, token permission, and scoped Azure roles. ✓
    Federated trust and token permission enable OIDC, while scoped roles authorize required operations without a client secret.
  4. Commit datasets and access tokens with the workflow files.
    Repositories should not contain secrets or large operational data artifacts.
  5. Assign broad workspace Contributor access and rely on it for private connectivity.
    RBAC authorization does not create network routes or DNS resolution, and broad access is unnecessary.
The trap
Exposes credentials and unsuitable data artifacts. Uses the credential type the scenario excludes. Confuses authorization with connectivity.

Use OIDC with scoped roles and separately provide the runner’s private network path and DNS.

10. Infrastructure deployment does not provide the runner’s: Why does the plausible alternative of changing Bicep

Hard
A search-relevance deployment is defined with parameterized Bicep and deployed successfully. A GitHub Actions job then attempts to submit a machine learning job, but the private workspace endpoint times out. The runner has valid OIDC credentials and Azure roles. Why does the plausible alternative of changing Bicep resource declarations alone fail?
  1. Infrastructure deployment does not provide the runner’s private route and DNS path. ✓
    Bicep success and valid roles do not make a runner network-connected; private routing and DNS remain necessary.
  2. Azure CLI cannot submit jobs after infrastructure is deployed declaratively.
    CLI and the machine learning extension can operate resources and jobs after infrastructure provisioning completes.
  3. Parameterization automatically removes private endpoint requirements for automation.
    Parameters improve consistency but do not create the runner’s required network path to private endpoints.
  4. Bicep cannot provision any machine learning workspace resources.
    Bicep can declaratively define Azure infrastructure, including workspace-related resources when supported by the deployment design.
The trap
Rejects infrastructure-as-code capability too broadly. Treats Bicep and CLI as mutually exclusive workflows. Confuses deployment configuration with runtime connectivity.

Bicep provisions infrastructure, but the runner still needs private routing and DNS to submit through the endpoint.

11. Configure GitHub OIDC federation: Select TWO missing operational steps.

Easy
A GitHub Actions workflow uses Bicep to provision a multilingual help-desk workspace and compute. The workspace is private, and the runner is hosted by GitHub. The workflow must avoid long-lived secrets and reach private resources. Select TWO missing operational steps.

Select two. More than one option is correct — every correct one is ticked below.

  1. Use workspace Contributor access to provide the hosted runner with private connectivity.
    RBAC authorizes operations but does not create network routes or DNS resolution.
  2. Configure GitHub OIDC federation, workflow token permission, and scoped Azure roles. ✓
    OIDC requires federated trust, token permission, and appropriately scoped Azure authorization.
  3. Use a self-hosted runner that can resolve and reach the private workspace network. ✓
    A self-hosted runner provides the required private network path and DNS resolution.
  4. Save a subscription administrator secret in the repository for Bicep deployment.
    A persistent administrator secret violates the requirement to avoid long-lived secrets and least privilege.
  5. Use Bicep to start training jobs after provisioning the workspace and compute.
    Bicep declares Azure infrastructure; workflow tooling must orchestrate job execution separately.
The trap
Confuses authorization with network reachability. Uses a high-privilege persistent credential instead of federation. Confuses infrastructure provisioning with job orchestration.

Use a networked self-hosted runner and federated OIDC authentication with scoped roles.

12. Configure private storage connectivity: Which action should be taken first?

Medium
A quality-inspection workspace uses a private endpoint. Authentication to the workspace succeeds, but jobs fail when reading a datastore. Storage public access is disabled, and DNS resolves the storage name to a public address. Which action should be taken first?
  1. Grant the job identity broad storage administration rights without changing DNS or routing.
    Additional authorization cannot fix DNS resolving to an unreachable public address.
  2. Change the datastore file format.
    A format change does not repair the storage network path.
  3. Configure private storage connectivity, DNS, and routes for the job. ✓
    The job needs a private path, private DNS resolution, and routes to the storage endpoint.
  4. Enable public access on the storage account.
    Public access weakens the intended isolation rather than configuring private access correctly.
The trap
Changes data representation instead of connectivity. Bypasses private networking. Treats a network failure as an RBAC failure.

Configure private storage connectivity, DNS, and routes for the executing job.

153 more Design and implement an MLOps infrastructure questions

The remaining 153 questions in this domain are part of the full Microsoft Machine Learning Operations Engineer Associate AI-300 bank — 869 questions, every option explained. Start with the free five-minute check and see your score per domain.

Test your Microsoft Machine Learning Operations Engineer Associate AI-300 readiness — free

Other Microsoft Machine Learning Operations Engineer Associate AI-300 domains

Part of the Certsqill Microsoft Machine Learning Operations Engineer Associate AI-300 question bank · Design and implement an MLOps infrastructure · Every answer, right and wrong, comes with its own explanation.