AI-200 · Domain 4 of 4

AI-200 Domain 4: Secure, monitor, and troubleshoot Azure solutions

This domain covers running AI solutions safely and observably. It covers securing secrets and configuration with Azure Key Vault and App Configuration, distributed tracing with OpenTelemetry, and analyzing logs and metrics with KQL.

Exam weight
20–25%
Official functional groups
2
Estimated questions estimate
9–14
Suggested study time estimate
15–25 hrs

About 9 min read Reviewed October 2026

Overview

Secure, monitor, and troubleshoot Azure solutions covers keeping AI solutions secure and observable. It has two objective groups. Implementing secure solutions covers securing secrets with Azure Key Vault, including rotation and retrieval, and storing and retrieving application configuration with Azure App Configuration. Monitoring and troubleshooting covers tracing distributed systems with OpenTelemetry SDKs and writing Kusto Query Language (KQL) queries to analyze logs and metrics.

At 20–25%, this group ensures the AI solutions built in the other domains are protected and diagnosable. The exam rewards keeping secrets out of code with Key Vault, separating configuration from secrets with App Configuration, instrumenting distributed AI pipelines with OpenTelemetry, and querying telemetry with KQL. These are the operational-quality skills that make an AI solution production-ready.

How it's tested

AI-200 questions in this group describe a security, configuration or diagnostics need and ask how to implement it. Look for clues in the wording: secrets, keys and certificates point to Key Vault, feature flags and plain settings point to App Configuration, and cross-service latency points to OpenTelemetry tracing.

  • Secrets or configuration

    A sensitive-data or settings need is described, and you choose Key Vault for secrets or App Configuration for settings.

  • Trace the system

    A distributed-diagnostics need is described, and you choose OpenTelemetry instrumentation.

  • Query the telemetry

    A log or metric analysis need is described, and you choose a KQL query.

Reasoning it through

A developer must store a database connection password and a non-sensitive feature-flag setting for an AI service, keeping the password protected and rotatable. Putting both in App Configuration exposes the password, since App Configuration is for non-secret settings. Storing the password in Azure Key Vault, with rotation and secure retrieval, and the feature flag in App Configuration, keeps secrets protected while managing configuration separately, which is the correct separation the exam expects.

Functional groups 2

Official functional groups from the Microsoft outline, in outline order.

4.1 Implement secure Azure solutionsAzure Key Vault secrets with rotation, and Azure App Configuration.
What it means
This covers securing secrets with Azure Key Vault, including secret rotation and secure retrieval in code, and storing and retrieving application configuration with Azure App Configuration.
What to understand
Key Vault stores secrets, keys and certificates securely, supports rotation, and is accessed at runtime, often with a managed identity, so secrets stay out of code and images. App Configuration centralizes non-secret application settings and feature flags, and can reference Key Vault for secrets. Separating secrets from configuration is the key principle.
How it shows up
A secret or configuration need is described, and you must choose Key Vault or App Configuration and secure retrieval.
Common confusion
Confusing App Configuration with Key Vault; App Configuration holds non-secret settings, while Key Vault holds secrets, keys and certificates.
4.2 Monitor and troubleshoot Azure solutionsOpenTelemetry distributed tracing and KQL log and metric analysis.
What it means
This covers tracing distributed systems with OpenTelemetry SDKs to follow requests across services, and writing Kusto Query Language (KQL) queries to analyze logs and metrics in Azure Monitor and Application Insights.
What to understand
OpenTelemetry instruments code to emit traces that follow a request across the distributed services of an AI pipeline, revealing where latency or errors occur. KQL queries logs and metrics to investigate behavior and diagnose problems. Instrumenting first makes later troubleshooting possible; KQL turns telemetry into answers.
How it shows up
A distributed-tracing or log-analysis need is described, and you must choose OpenTelemetry instrumentation or a KQL query.
Common confusion
Expecting logs alone to reveal cross-service latency; OpenTelemetry tracing follows the request across services, which scattered logs do not.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Azure Key Vault

    Secure storage for secrets, keys and certificates.

    Remember
    Keep secrets out of code; support rotation.
    Tested as
    Security questions.
    Trap
    Hard-coding secrets.

  • Secret rotation

    Replacing secrets periodically.

    Remember
    It limits the window of a compromised secret.
    Tested as
    Security questions.
    Trap
    Using static, long-lived secrets.

  • Managed identity retrieval

    Accessing Key Vault without stored credentials.

    Remember
    No secret needed to fetch secrets.
    Tested as
    Security questions.
    Trap
    Storing a credential to reach Key Vault.

  • Azure App Configuration

    Centralized non-secret settings and feature flags.

    Remember
    It can reference Key Vault for secrets.
    Tested as
    Configuration questions.
    Trap
    Storing secrets in it.

  • Secrets vs. configuration

    Sensitive values versus application settings.

    Remember
    Key Vault for secrets, App Configuration for settings.
    Tested as
    Security questions.
    Trap
    Mixing the two.

  • OpenTelemetry

    Standard instrumentation for distributed tracing.

    Remember
    It follows a request across services.
    Tested as
    Monitoring questions.
    Trap
    Relying on logs alone for traces.

  • Distributed tracing

    Following a request through many services.

    Remember
    It shows where latency and errors occur.
    Tested as
    Monitoring questions.
    Trap
    Isolating per-service logs only.

  • KQL

    Kusto Query Language for logs and metrics.

    Remember
    It queries telemetry for answers.
    Tested as
    Troubleshooting questions.
    Trap
    Scanning logs manually.

  • Application Insights

    Application performance monitoring in Azure Monitor.

    Remember
    It collects traces, logs and metrics.
    Tested as
    Monitoring questions.
    Trap
    Ignoring app-level telemetry.

  • Instrument first

    Adding telemetry before problems occur.

    Remember
    It makes later diagnosis possible.
    Tested as
    Monitoring questions.
    Trap
    Adding telemetry only after an incident.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Key Vault vs. App Configuration

ConceptMeaningKey differenceCommon trap
Azure Key Vault Secrets, keys and certificates Protected, rotatable secrets Storing non-secret settings here
Azure App Configuration Non-secret settings and feature flags Centralized configuration Storing secrets here

OpenTelemetry tracing vs. logs vs. KQL

ConceptMeaningKey differenceCommon trap
OpenTelemetry tracing Follows a request across services Cross-service latency and errors Using logs alone for the full path
Logs Per-service records Detailed events Expecting cross-service traces
KQL Queries logs and metrics Turns telemetry into answers Scanning logs manually

Static secret vs. rotated secret vs. managed identity

ConceptMeaningKey differenceCommon trap
Static secret Long-lived credential Simple but risky Leaving it unrotated
Rotated secret Periodically replaced Limits exposure window Never rotating
Managed identity No stored credential Safest retrieval Storing a credential anyway

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Secret in App Configuration

    What candidates pick
    Store a database password in Azure App Configuration.
    Why it looks right
    It centralizes settings.
    Why it's wrong
    App Configuration is for non-secret settings; secrets belong in Key Vault, which App Configuration can reference.

    Clue to watch for The value is a password, key or other secret.

  2. Hard-coded secret

    What candidates pick
    Embed a connection secret in the application code.
    Why it looks right
    It is quick.
    Why it's wrong
    Secrets belong in Key Vault, retrieved at runtime, ideally via a managed identity, not in code.

    Clue to watch for The app needs a credential at runtime.

  3. Logs for cross-service latency

    What candidates pick
    Scan per-service logs to find which service in an AI pipeline is slow.
    Why it looks right
    Logs contain timing.
    Why it's wrong
    OpenTelemetry tracing follows the request across services and shows where latency occurs, which scattered logs cannot.

    Clue to watch for The slowness spans multiple services.

  4. No rotation

    What candidates pick
    Use a single long-lived secret indefinitely.
    Why it looks right
    It avoids rotation effort.
    Why it's wrong
    Rotating secrets limits the damage if one is compromised; Key Vault supports rotation.

    Clue to watch for The requirement mentions limiting exposure of a secret.

  5. Manual log scanning

    What candidates pick
    Read raw logs by hand to find an error.
    Why it looks right
    It is direct.
    Why it's wrong
    KQL queries logs and metrics efficiently to find the issue far faster than manual scanning.

    Clue to watch for A specific pattern or error must be found in telemetry.

Answer framework

For any Domain 4 scenario, use these steps to find the answer AI-200 expects.

  1. Separate secrets from configuration: store secrets, keys and certificates in Key Vault, and non-secret settings and feature flags in App Configuration.
  2. Retrieve secrets at runtime, ideally with a managed identity, and rotate them rather than hard-coding or leaving them static.
  3. Instrument the distributed AI pipeline with OpenTelemetry so requests can be traced across services before problems occur.
  4. For cross-service latency or errors, use distributed traces; for detailed investigation, query logs and metrics with KQL.
  5. Use Application Insights telemetry to make the solution observable, and document the diagnosis and fix. Use KQL to query the telemetry and find the failing call.

Practice question

An AI service needs to store a database connection password that must be protected and rotatable, and also a non-sensitive feature-flag setting. How should the developer store these values?

Want more like this? The AI-200 practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as making the AI solution production-ready in two parts: secure and observable. For security, fix firmly the Key Vault versus App Configuration split, secrets, keys and certificates in Key Vault with rotation and managed-identity retrieval, and non-secret settings and feature flags in App Configuration. Practice retrieving a secret with a managed identity so nothing is hard-coded.

For observability, learn OpenTelemetry for distributed tracing, since AI pipelines span many services and logs alone cannot show cross-service latency. Then practice writing KQL queries to analyze logs and metrics, which is a concrete, testable skill. Instrument first, so problems are diagnosable when they occur.

Build a small instrumented service with a Key Vault secret and query its telemetry with KQL in a free subscription. This is the final domain, so finish with full practice tests spanning all four, and remember AI-200 often describes requirements without naming the service. Build a small capstone across the four domains in a free subscription rather than only reading, and review missed practice questions by group to find weak spots.

FAQ

How much of AI-200 is Domain 4?

Secure, monitor, and troubleshoot Azure solutions is 20–25% of the exam, covering security, tracing and log analysis.

What is the difference between Key Vault and App Configuration?

Azure Key Vault stores secrets, keys and certificates securely, with rotation. Azure App Configuration stores non-secret application settings and feature flags, and can reference Key Vault for secrets.

How should an app retrieve secrets?

At runtime from Key Vault, ideally using a managed identity so no credential is stored to reach the vault, rather than hard-coding secrets in code or images.

What is OpenTelemetry used for?

Instrumenting code to emit distributed traces that follow a request across the services of an AI pipeline, revealing where latency or errors occur, which per-service logs cannot show.

What is KQL?

Kusto Query Language, used to query and analyze logs and metrics in Azure Monitor and Application Insights to investigate behavior and diagnose problems.

Why instrument before problems occur?

Because telemetry added only after an incident cannot explain what already happened. Instrumenting first makes later troubleshooting possible.

How does Domain 4 connect to the rest of the exam?

It secures the secrets and configuration used by the containers, data services and integrations of the other domains, and makes the whole distributed AI solution observable and diagnosable.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 4 knowledge

You have covered Key Vault, App Configuration, OpenTelemetry and KQL. Test whether you can secure and observe an AI solution under exam conditions.

Take the AI-200 practice test Check your AI-200 readiness

Keep going