AI-200 · CHEAT SHEET

Microsoft Certified: Azure AI Cloud Developer Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Develop containerized solutions on Azure

20–25%

Implement container application hosting

Azure Container Registry stores images by repository, tag and manifest; pulling by digest pins the version. Use unique tags for deployments and lock deployed images with az acr repository update. Re-pushing a tag leaves orphaned manifests: remove them by digest, with acr purge or with a retention policy. az acr import copies images between registries without Docker.
ACR Tasks builds images in the cloud: az acr build runs a quick task without local Docker and pushes the image unless you pass --no-push. az acr task create supports commit, base image (stable tag) and UTC cron timer triggers. Multi-step tasks are defined in YAML with build, push and cmd steps, and reach other resources through managed identities.
App Service runs custom containers that pull their image from Azure Container Registry, ideally with a managed identity (AcrPull plus acrUseManagedIdentityCreds). App settings reach the container as environment variables (WEBSITES_PORT when it doesn't listen on 80; __ instead of colons on Linux), and secrets resolve through @Microsoft.KeyVault references using the app's identity.

Implement container-orchestrated solutions

In Azure Container Apps every change under properties.template (image, suffix, scale rules) creates an immutable revision, while secrets, ingress and traffic splitting are application-scope changes. Single mode switches traffic with zero downtime once the new revision is ready; multiple mode adds traffic weights, labels with their own URL and blue-green releases. The environment is the secure boundary for networking and logs.
Azure Container Apps scales with KEDA: HTTP and TCP rules use concurrent requests or connections, and custom rules copy the type and metadata of a KEDA scaler. Authentication uses secrets (triggerParameter and secretRef) or a managed identity through the identity property. Without ingress or a custom rule the app scales to zero and never restarts; event-driven jobs start one execution per event.
On AKS, az aks get-credentials configures kubectl and kubectl apply -f creates the objects in a manifest. A Deployment creates a revision only when .spec.template changes; maxSurge and maxUnavailable shape rolling updates, Recreate avoids running two versions at once and kubectl rollout undo rolls back. Services pick pods by selector, a Deployment selector is immutable, and readiness, startup and liveness probes do different jobs.
In Azure Container Apps, log streaming (az containerapp logs show with --type console or system) shows stdout/stderr and service messages live, while Log Analytics stores ContainerAppConsoleLogs_CL, ContainerAppSystemLogs_CL and, when enabled, ContainerAppHTTPLogs. In AKS you diagnose with kubectl describe, get events, logs --previous, debug and EndpointSlices.

2. Develop AI solutions by using Azure data management services

30–35%

Develop AI solutions by using Azure Cosmos DB for NoSQL

With the Python SDK you create a single CosmosClient (with DefaultAzureCredential and a data plane role such as Cosmos DB Built-in Data Contributor) and get the database and container. read_item does point reads by id and partition key; query_items runs parameterized queries with @ and can span partitions. Joins only work within one item.
The indexing policy drives cost: excluding paths you never query makes writes cheaper, composite indexes are required for multi-property ORDER BY and each optimizes one range filter, and TTL requires consistent mode. Strong and Bounded staleness double read costs; Session guarantees read-your-writes with single-replica reads.
Azure Cosmos DB for NoSQL stores embeddings next to the data. It requires enabling EnableNoSQLVectorSearch and creating the container with a vector policy (path, dataType, dimensions, distanceFunction) and a flat, quantizedFlat or diskANN index. Queries use VectorDistance with TOP N, and hybrid search fuses VectorDistance and FullTextScore with RRF in ORDER BY RANK.
The change feed processor (.NET and Java SDKs) reads changes from a monitored container, stores its progress in a lease container and spreads the leases across instances that share a processorName but have distinct instance names, with at-least-once delivery. Python uses the pull model with continuation tokens or the Azure Functions trigger; latest version mode does not capture deletes.

Develop AI solutions by using Azure Database for PostgreSQL

From Python, psycopg connects with a Microsoft Entra token (ossrdbms-aad scope) as the password and sslmode=require, refreshing the token because it expires; managed identities are registered with pgaadauth_create_principal in the postgres database. For performance, pool connections (psycopg_pool, Npgsql or PgBouncer on port 6432), batch queries, bulk-load with COPY and retry with exponential backoff.
The extension is named vector and is created in each database; vector(n) columns validate dimensions and are required for indexing, halfvec reduces size, and expression indexes allow indexing through a cast. Frequently filtered metadata belongs in typed columns with B-tree indexes (leftmost column of a composite), JSONB with GIN only helps containment, and partitions or separate tables isolate tenants.
HNSW gives a better speed-recall trade-off and can be created without data; IVFFlat is built after loading data and tuned with ivfflat.probes, HNSW with hnsw.ef_search. The index is used only when the operator matches the operator class and ORDER BY is an ascending distance with LIMIT. To cut compute: inner product for normalized vectors, iterative scans with filters, binary quantization and fewer dimensions.
pgvector searches use CPU for distance calculations and memory to keep indexes cached; the Memory Optimized tier gives more memory per vCore, and Burstable is unsuitable for sustained load because it runs out of CPU credits. The compute size caps the usable IOPS, Premium SSD v2 lets you tune IOPS and throughput independently, and storage can only be scaled up, never down.
With pgvector, semantic search orders by a distance operator (such as <=>) and combines metadata WHERE clauses, distance thresholds and LIMIT; with approximate indexes the filter is applied after the index scan, so enable iterative index scans or partition by tenant. In RAG, PostgreSQL acts as the retriever: chunks linked to their source document, context windows built from adjacent chunks, and metadata returned for citations.

Integrate Azure Managed Redis in AI solutions

In Azure Managed Redis, the cache-aside pattern reads the cache first, queries the data store on a miss and stores the result with a TTL (for example, SETEX); on writes, update the store first and then invalidate the key. The default eviction policy is volatile-lru, which only evicts keys that have a TTL; SET without KEEPTTL clears the TTL, pattern deletes should use SCAN rather than KEYS, and TTLs benefit from a small random variation.
Azure Managed Redis performs vector search with the RediSearch module, which is enabled at creation and requires the Enterprise clustering policy and NoEviction. FT.CREATE defines the VECTOR field (exact FLAT or approximate HNSW, with TYPE, DIM and DISTANCE_METRIC), and FT.SEARCH with DIALECT 2 runs KNN, range or metadata-filtered queries.

3. Connect to and consume Azure services

20–25%

Develop event- and message-based AI solutions

Service Bus uses queues for point-to-point delivery and topics with filtered subscriptions for one-to-many publishing. In peek-lock mode the consumer completes, abandons, defers or dead-letters each message; exceeding the max delivery count or expiring with the option enabled moves it to the dead-letter subqueue, which is read with sub_queue and is never cleaned up automatically.
An Event Grid subscription filters by event type, by subject prefix or suffix, and with advanced filters (values in one filter are ORed, separate filters are ANDed, comparisons ignore case). Delivery is at least once with no ordering guarantee: Event Grid retries with exponential backoff until the time-to-live or the attempt limit runs out, whichever comes first, and dead-letters only when you configure a blob container.

Develop and implement Azure Functions

Each function has exactly one trigger and zero or more input and output bindings. A serverless API uses the HTTP trigger: the route template defines the URL (under the api prefix, configurable in host.json), authLevel decides which access key is required, and binding expressions such as {id} or {Query.id} pass request data to other bindings without writing SDK code.
Flex Consumption is the recommended serverless plan: it supports only package deployment, is configured through functionAppConfig (instance memory, always ready instances, deployment container) and uses rolling updates instead of slots. On Premium and Dedicated plans, slots let you swap staging into production, and identity-based connections use suffixes such as __accountName or __fullyQualifiedNamespace.

4. Secure, monitor, and troubleshoot Azure solutions

20–25%

Implement secure Azure solutions

Apps read secrets with SecretClient and DefaultAzureCredential (a managed identity in Azure) or with @Microsoft.KeyVault references in app settings, and the Key Vault Secrets User role is enough to read. set_secret creates a new version; rotation is automated with the Event Grid SecretNearExpiry event and a function, and two sets of credentials avoid downtime.
Azure App Configuration stores labeled key-values, feature flags and Key Vault references, which hold only a URI: the app reads the secret with its own identity. The Python provider (load) stacks selectors, trims prefixes and refreshes on demand with refresh() and a sentinel key. Immutable snapshots and Microsoft Entra ID with data roles complete secure usage.

Monitor and troubleshoot Azure solutions

Distributed tracing with OpenTelemetry correlates spans across services through W3C Trace Context: the trace-id becomes operation_Id in Application Insights. In Python, configure_azure_monitor() reads the connection string, instruments common libraries and supports sampling, span processors and resources (service.name sets the Application Map role). Without instrumentation, context is propagated with inject and extract.
KQL chains operators with pipes: where filters early on TimeGenerated with ago(), summarize aggregates by bin(), and make-series fills empty intervals with zeros for series analysis. has matches whole terms and is faster than contains; join defaults to innerunique and lookup suits small dimension tables. With sampling, count with sum(ItemCount) in the workspace App* tables.

Practice this certification