Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A platform team sets up Azure Machine Learning for five product teams. Four teams train on serverless compute and must create their own workspaces without IT tickets, sharing one private endpoint and one compute quota. The fifth team scores nightly files through batch endpoints on compute clusters. Which design meets every requirement?
ACreate one hub and give all five teams project workspaces, with the batch team's endpoints running on serverless compute
BCreate five default workspaces from one Bicep template, each with its own private endpoint and workspace-level quota
CCreate a hub with project workspaces for the four teams, and a separate default workspace for the batch-scoring team
DCreate a default workspace for the batch team first, then convert it into a hub so the other teams can add projects
Show the answer and why
ACreate one hub and give all five teams project workspaces, with the batch team's endpoints running on serverless compute
Incorrect
Batch endpoints aren't supported in hub or project workspaces, whatever compute the team would choose.
BCreate five default workspaces from one Bicep template, each with its own private endpoint and workspace-level quota
Incorrect
Default workspaces don't share one private endpoint or one quota, and teams can't create them self-service from a hub.
CCreate a hub with project workspaces for the four teams, and a separate default workspace for the batch-scoring team
Correct
Project workspaces give the four teams self-service, one hub private endpoint and shared quota, while batch endpoints and compute clusters need a default workspace.
DCreate a default workspace for the batch team first, then convert it into a hub so the other teams can add projects
Incorrect
Converting a regular workspace into a hub workspace isn't supported.
A hub shares one managed virtual network and a single private endpoint with its project workspaces, deducts their compute quota from the hub, and lets users create projects themselves. The support matrix doesn't offer compute clusters or batch endpoints in hub or project workspaces, so the batch-scoring team needs a default workspace.
Training data sits in an Azure Files share. Security now requires that no datastore in the workspace hold an account key or SAS token, and that access to the data follow each identity's Azure RBAC role on the storage account. What should the team do?
ARecreate the Azure Files datastore with identity-based access so that the workspace keeps only the account details
BKeep the Azure Files datastore but switch it from the account key to a SAS token scoped to the share
CKeep the account-key datastore and grant each identity a data role on the share for access control
DCopy the data to a blob container and register it through an identity-based Azure Blob datastore
Show the answer and why
ARecreate the Azure Files datastore with identity-based access so that the workspace keeps only the account details
Incorrect
Azure File Share datastores support credential-based authentication only.
BKeep the Azure Files datastore but switch it from the account key to a SAS token scoped to the share
Incorrect
A SAS token is still a stored credential, and workspace Readers can view datastore credentials.
CKeep the account-key datastore and grant each identity a data role on the share for access control
Incorrect
The account key stays stored in the datastore, and anyone using the datastore goes through the key, not their own role.
DCopy the data to a blob container and register it through an identity-based Azure Blob datastore
Correct
Blob containers support identity-based datastores, so no credential is saved and RBAC on the storage account decides access.
Datastores authenticate either with stored credentials (service principal, SAS token or account key, which users with Reader access can see) or with identities. Identity-based access is supported for Blob containers and Data Lake Storage Gen2, not for Azure File Share, so the data has to move to a blob container or Data Lake Storage Gen2 to meet the requirement.
A workspace has only a system-assigned identity. Nightly training jobs on serverless compute must read a storage account with a managed identity rather than the identity of whoever submits them, and the team doesn't want to manage compute clusters. What should you do?
AGrant the workspace's system-assigned identity Storage Blob Data Reader and set the jobs' identity to type managed
BAdd a user-assigned identity to the workspace, grant it Storage Blob Data Reader, and use it as the job identity
CSet the jobs' identity to user_identity and grant every data scientist Storage Blob Data Reader on the account
DCreate a compute cluster with a system-assigned identity, grant it access, and run the jobs on that cluster
Show the answer and why
AGrant the workspace's system-assigned identity Storage Blob Data Reader and set the jobs' identity to type managed
Incorrect
Serverless compute doesn't support a system-assigned identity.
BAdd a user-assigned identity to the workspace, grant it Storage Blob Data Reader, and use it as the job identity
Correct
Serverless jobs support the workspace's user-assigned identity for storage access.
CSet the jobs' identity to user_identity and grant every data scientist Storage Blob Data Reader on the account
Incorrect
That authenticates as the submitting user, which the requirement rules out.
DCreate a compute cluster with a system-assigned identity, grant it access, and run the jobs on that cluster
Incorrect
It works, but it brings back the compute clusters the team doesn't want to manage.
Serverless compute supports two identities for storage access: the user identity of the submitter and the workspace's user-assigned managed identity, passed through ManagedIdentityConfiguration with its client ID. It doesn't support a system-assigned identity, so a workspace that has only one needs a user-assigned identity added.
Data scientists must run experiments, register models and spin up their own clusters and instances in a workspace, but mustn't change role assignments or modify the workspace itself. Which two built-in roles should you assign together at workspace scope? (Choose TWO.)
AContributor
BAzureML Data Scientist
CReader
DAzureML Registry User
EAzureML Compute Operator
Show the answer and why
AContributor
Incorrect
Contributor isn't limited like AzureML Data Scientist, which excludes modifying the workspace itself.
BAzureML Data Scientist
Correct
It allows every action in the workspace except creating or deleting compute and modifying the workspace.
CReader
Incorrect
Readers can only list and view assets; they can't submit runs or create compute.
DAzureML Registry User
Incorrect
It grants access to assets in a registry, not to experiments or compute in a workspace.
EAzureML Compute Operator
Correct
It adds creating, managing and deleting compute, which AzureML Data Scientist excludes.
Microsoft's guidance combines AzureML Data Scientist with AzureML Compute Operator so users can experiment and create compute in a self-service way. AzureML Data Scientist excludes compute creation and workspace changes, and neither role can change role assignments on the workspace.
A GPU compute cluster with its minimum nodes set to 0 has sat idle for weeks, yet the team lacks quota for a new cluster in the same VM family. What explains it?
AIdle clusters keep one node allocated and billed until they're deleted
BIts unprovisioned nodes still count toward quota until it's deleted
CThe quota is held by the jobs that ran on the cluster in past weeks
DIts idle time before scale down hasn't passed, so the nodes are still up
Show the answer and why
AIdle clusters keep one node allocated and billed until they're deleted
Incorrect
With minimum nodes at 0, the cluster de-allocates its nodes, so nothing is billed while no jobs run.
BIts unprovisioned nodes still count toward quota until it's deleted
Correct
Scaling down to zero nodes doesn't release quota; deleting the cluster does.
CThe quota is held by the jobs that ran on the cluster in past weeks
Incorrect
Finished jobs don't hold quota; the cluster's nodes count toward it.
DIts idle time before scale down hasn't passed, so the nodes are still up
Incorrect
After weeks without jobs, the cluster has long since scaled down to its minimum node count.
A compute cluster with minimum nodes set to 0 scales down to zero nodes when it isn't used, so you don't pay for idle nodes. Its unprovisioned nodes still contribute to your quota usage, though. Deleting the cluster removes the compute target from the workspace and releases the quota.
A team created a CPU compute cluster and now needs GPUs for the same workload. What must it do?
ACreate a new cluster with a GPU virtual machine type
BEdit the cluster and change its virtual machine type to GPU
CScale the cluster to zero nodes and then select a GPU size
DRequest GPU quota, after which the cluster switches automatically
Show the answer and why
ACreate a new cluster with a GPU virtual machine type
Correct
The CPU or GPU choice can't be changed after the cluster is created.
BEdit the cluster and change its virtual machine type to GPU
Incorrect
The virtual machine type is fixed at creation.
CScale the cluster to zero nodes and then select a GPU size
Incorrect
Scaling doesn't change the virtual machine type.
DRequest GPU quota, after which the cluster switches automatically
Incorrect
Quota doesn't change an existing cluster's type.
When you create a compute cluster you choose CPU or GPU as the virtual machine type, and that type can't be changed after creation. A GPU workload needs a new cluster with a GPU size and enough quota for that VM family.
Project leads should add and remove people from a workspace themselves, without holding Owner or any other right to assign roles on the workspace. What should you set up?
AThe User Access Administrator role on the workspace for each lead
BA custom role for the leads with Microsoft.Authorization/roleAssignments/write
CA Microsoft Entra security group with a workspace role, and the leads as group owners
DA shared account for each project that the leads hand out
Show the answer and why
AThe User Access Administrator role on the workspace for each lead
Incorrect
That still grants the leads role-assignment rights on the resource.
BA custom role for the leads with Microsoft.Authorization/roleAssignments/write
Incorrect
That's a role-assignment right on the workspace, which the leads shouldn't hold.
CA Microsoft Entra security group with a workspace role, and the leads as group owners
Correct
Group owners manage membership, and members inherit the group's role on the workspace.
DA shared account for each project that the leads hand out
Incorrect
Shared accounts break individual access and auditing.
With Microsoft Entra security groups, team or project leaders can manage user access to a workspace as group owners, without the Owner role on the workspace. Assign the group a role such as AzureML Data Scientist, and members gain access; the group owner doesn't need to be a member or hold a role on the workspace.
A data scientist wants to create a compute instance now and add an SSH key next week for VS Code Remote debugging. What should be chosen at creation?
ALeave SSH off and enable it from the instance's Details page next week
BLeave SSH off and turn it on next week with az ml compute update
CLeave SSH off and connect with the az ml compute connect-ssh command
DEnable SSH access with the public key source Set up an SSH key later
Show the answer and why
ALeave SSH off and enable it from the instance's Details page next week
Incorrect
SSH access can't be enabled or disabled after creation.
BLeave SSH off and turn it on next week with az ml compute update
Incorrect
SSH access can't be enabled after creation, from the CLI or the studio.
CLeave SSH off and connect with the az ml compute connect-ssh command
Incorrect
That command is for instances without a public IP that already allow SSH.
DEnable SSH access with the public key source Set up an SSH key later
Correct
SSH can't be turned on after creation, but the key can be added later on an SSH-enabled instance.
SSH access is disabled by default and can't be enabled or disabled after the compute instance is created. You can enable SSH and choose Set up an SSH key later as the public key source, then add the key from the instance's Details page after creation.