Q01 - Question
A container app reads events from an Azure Event Hubs instance that has 16 partitions. The app uses a single consumer group and an azure-eventhub scale rule. The current maxReplicas value is 100. You need to control cost without reducing the effective processing capacity. What should you do?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Increase maxReplicas to 200 so that the app can process lag faster
- B. Set maxReplicas to 16
- C. Lower unprocessedEventThreshold and keep maxReplicas at 100
- D. Add a CPU scale rule so that the app can add replicas beyond the partition count
B is correct.
Explanation: Within a consumer group, one consumer at a time can read each partition. With 16 partitions, the app can't benefit from more than 16 replicas. Set maxReplicas to 16 to cap cost at the effective maximum.
A is incorrect: Replicas beyond the partition count provide no additional scaling benefit. A higher limit only raises the potential cost.
C is incorrect: A lower threshold makes scaling start earlier. It doesn't change the limit of 16 useful replicas, so the excess maximum remains.
D is incorrect: Replicas added by a CPU rule still can't read partitions that other consumers in the same consumer group already read.
Q02 - Question
You deploy an AI inference API to Azure Kubernetes Service (AKS). The Pods stay in the Pending status and never transition to Running. You need to identify the cause and resolve the issue. What should you do?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Run kubectl describe pod to check for insufficient memory or CPU, and review resource requests or add nodes to the cluster.
- B. Run kubectl logs to check for application startup errors, and verify that all environment variables are configured.
- C. Run kubectl describe svc to check for empty endpoints, and verify that the Pod labels match the Service selector.
- D. Run az acr repository list to confirm the image exists, and verify the image path in the Deployment manifest.
A is correct.
Explanation: Pending Pods usually indicate that Kubernetes cannot schedule the Pods due to insufficient resources. You should run kubectl describe pod to check for insufficient memory or CPU events, and then review resource requests or scale the cluster.
B is incorrect: Checking application logs is the solution for CrashLoopBackOff, which occurs when the application exits or crashes on startup.
C is incorrect: Checking for empty endpoints is the solution when a Service has no endpoints because the selector does not match the Pod labels.
D is incorrect: Verifying the image path and registry is the solution for ImagePullBackOff, which occurs when Kubernetes cannot pull the container image.
Q03 - Question
You run kubectl apply for an inference API Deployment that references myregistry.azurecr.io/inference-api:v1.0. The Pods show the status ImagePullBackOff. What should you do to diagnose and resolve the issue?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Increase the memory and CPU requests in the Deployment manifest.
- B. Run az aks scale to add more nodes to the cluster.
- C. Run kubectl describe pod to review the events, then verify the image path and tag and confirm the image exists by using az acr repository list.
- D. Update the Service selector so that it matches the Pod labels.
C is correct.
Explanation: ImagePullBackOff means Kubernetes can't pull your container image from the registry. Run kubectl describe pod and review the events section for the pull error. Then verify the image path, tag, and registry in your manifest, and confirm the image was built and pushed with az acr repository list.
A is incorrect: Resource requests affect scheduling. Requests that are too large cause Pending Pods, not image pull failures.
B is incorrect: Adding nodes with az aks scale resolves exhausted cluster capacity for Pending Pods. More nodes can't pull an image that doesn't exist or has the wrong path.
D is incorrect: A selector mismatch causes a Service to have no endpoints. It doesn't prevent the image from being pulled.
Q04 - Question
Your team runs an AI document processing API in Azure Container Apps. You built a new image that changes the model version. You want to send a small portion of production traffic to the new revision and keep most traffic on the current revision until you validate latency and errors. What should you configure?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Configure single revision mode and reference the new image by digest.
- B. Configure single revision mode and deactivate the current revision after the update.
- C. Configure multiple revision mode and split traffic between the current and new revisions.
- D. Keep the current configuration and run az containerapp restart after the image update.
C is correct.
Explanation: Multiple revision mode allows more than one active revision at the same time. Use it for canary rollouts and traffic splitting so a new model version receives only a small portion of traffic while you validate it.
A is incorrect: A digest gives you an immutable, traceable image reference, but single revision mode keeps only one active revision, so you can't split traffic.
B is incorrect: Single revision mode limits you to one active revision, and deactivating the current revision stops it from receiving traffic instead of keeping it as the main traffic target.
D is incorrect: Restart forces replicas to restart, but it doesn't control how traffic is divided between revisions.
Q05 - Question
Your team runs a model inference API and a background data enrichment worker on Azure Kubernetes Service (AKS). When slowdowns occur, the team wants a quick visual assessment first. Then the team wants direct access to cluster resources, logs, and events for in-depth analysis. Which approach should you use?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Use only kubectl commands for all inspection, because the Azure portal doesn't show workload logs.
- B. Use only the Azure portal Diagnose and solve problems feature, because it replaces log and event inspection.
- C. Use Azure portal tools such as the Workloads blade and Live Logs for visual inspection, and use kubectl commands for detailed investigation.
- D. Wait for users to report errors, and then redeploy both components to reset their state.
C is correct.
Explanation: The evidence states that the Azure portal offers visual tools like the Workloads blade, Live Logs, and the Diagnose and solve problems feature for quick inspection. For detailed investigation, kubectl commands give you direct access to cluster resources, logs, and events. Many developers use both approaches together.
A is incorrect: The Azure portal provides Live Logs to view container output, so it is not limited to non-log inspection.
B is incorrect: Diagnose and solve problems provides guided troubleshooting, but you still use kubectl for detailed investigation of resources, logs, and events.
D is incorrect: The goal of monitoring is to spot issues before they affect users. Redeploying does not identify whether the cause is application code, Kubernetes configuration, or the cluster.
Q06 - Question
An inference API on AKS serves several model versions. When some inference calls fail, engineers cannot determine which request, model, or version produced the error. They also have difficulty querying and filtering the log output in both the Azure portal and kubectl. Which two actions should you take? Each correct answer presents part of the solution.
Domain: Develop containerized solutions on Azure (20–25%) Type: Multiple choice
- A. Rely on kubectl top pods output to identify the failed inference calls.
- B. Add request identifiers, model names, and version information to log entries.
- C. Increase the CPU limits for all pods in the namespace.
- D. Emit logs in a structured format.
B and D are correct.
Explanation: The evidence recommends including correlation data in logs, such as request identifiers, model names, and version information, so you can trace problematic inference calls. It also recommends emitting logs in structured formats that are easier to query and filter in both the portal and command-line tools.
A is incorrect: The kubectl top command shows per-node and per-pod CPU and memory usage. It does not identify individual requests or model versions.
C is incorrect: Increasing CPU limits addresses resource pressure. It does not add the correlation data you need to trace specific failed calls or make logs easier to query.
Q07 - Question
A production AI workload on AKS has strict compliance requirements. Secrets must remain exclusively in a dedicated vault. You need fine-grained audit trails for each secret access. Rotated secrets must reach the containers without Pod restarts. What should you use?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. The Azure Key Vault provider for Secrets Store CSI Driver to mount secrets from Azure Key Vault into Pod filesystems.
- B. Azure App Configuration with Key Vault references, resolved by the App Configuration Kubernetes Provider into Kubernetes Secret resources.
- C. Opaque Kubernetes Secrets created with kubectl create secret generic and referenced with secretKeyRef.
- D. Secret manifests with literal values stored in a GitOps repository and applied with kubectl apply.
A is correct.
Explanation: The Secrets Store CSI Driver mounts secrets from Key Vault into Pod filesystems as files. Secrets remain in Key Vault. The driver polls for changes and updates mounted secrets without Pod restarts. Choose direct Key Vault integration when you need fine-grained audit trails for each secret access.
B is incorrect: The App Configuration Kubernetes Provider generates native Kubernetes Secret resources with the resolved values. Use this option when you want to manage secret mappings centrally, not when secrets must remain exclusively in the vault.
C is incorrect: Kubernetes Secrets store the values in the cluster. Environment variable values from secretKeyRef are set at Pod start, so you must trigger a Deployment rollout after you update them.
D is incorrect: Never commit Secret manifests with literal values to source control. This option also does not keep secrets in a dedicated vault.
Q08 - Question
Your team stores a container app definition in a YAML file in source control and reviews all configuration changes like code. A developer needs to move the ai-api app to the image myregistry.azurecr.io/ai-api:v2. The change must stay consistent with the reviewed configuration. What should the developer do?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Update the image value in the YAML file, submit it for review, and apply it with az containerapp update --yaml.
- B. Run az containerapp update --yaml ./containerapp.yml --image myregistry.azurecr.io/ai-api:v2 so the --image flag overrides the YAML file.
- C. Run az containerapp up with the new image so the command creates a new environment and supporting resources.
- D. Delete the app and recreate it with az containerapp create --image myregistry.azurecr.io/ai-api:v2 without a YAML file.
A is correct.
Explanation: When you use --yaml, the YAML file is the source of truth. Change the image in the YAML file, review the change, and apply it with az containerapp update --yaml. The update creates a new revision that you can validate.
B is incorrect: When you use --yaml, other flags are ignored. The --image flag doesn't override the YAML file.
C is incorrect: Use az containerapp up for prototypes or a first deployment. It doesn't keep the change in the reviewed YAML file.
D is incorrect: Recreating the app without the YAML file bypasses code review and can cause configuration drift across environments.
Q09 - Question
You write a Deployment manifest for an AI inference API on AKS. The API needs a nonsensitive MODEL_NAME value and an API key. The API key must stay out of source control and version history. Which two actions should you take? Each correct answer presents part of the solution.
Domain: Develop containerized solutions on Azure (20–25%) Type: Multi-select
- A. Set MODEL_NAME as an environment variable with a value in the env section of the container spec.
- B. Set API_KEY as an environment variable with the key value written directly in the manifest.
- C. Create a Secret with kubectl create secret generic, and reference it from API_KEY by using valueFrom and secretKeyRef.
- D. Store the API key as a Pod label in the Deployment template metadata.
A and C are correct.
Explanation: Use environment variables for nonsensitive configuration such as a model name. Use Secrets for sensitive data such as API keys. Create the Secret separately with kubectl, then reference it in the manifest with secretKeyRef so the key value isn't stored in the manifest.
B is incorrect: Never hardcode secrets in your manifest. A value written in the manifest is stored in source control and version history.
D is incorrect: Pod labels are used by Deployment and Service selectors to identify Pods. They aren't a mechanism for passing sensitive data to your application.
Q10 - Question
You plan to run a Python API as the main container and a model server as a sidecar in Azure App Service. The model server needs a large amount of memory during initialization. You must select an App Service plan for the app. What should you do?
Domain: Develop containerized solutions on Azure (20–25%) Type: Single choice
- A. Select a plan based on the steady-state memory use of the API, because the main container receives all external traffic.
- B. Select a small plan and configure the model-server sidecar to scale out independently when inference load increases.
- C. Measure the memory required to load the model and the combined CPU and memory of both containers under concurrent requests, including startup overlap, and then add operational headroom.
- D. Select a plan based only on the model server's peak memory, because sidecars don't consume capacity from the main app.
C is correct.
Explanation: All containers on an app instance consume capacity from the same App Service plan. Measure the model load memory, measure both containers under representative concurrent requests, include startup overlap during deployment and scale-out, and select a plan with headroom for the combined peak.
A is incorrect: The API steady-state measurement ignores the model server and peak usage. A model server that uses most of the memory can affect API responsiveness even when the API uses little memory.
B is incorrect: The plan doesn't scale the model server independently from the API. Each instance contains the main container and all configured sidecars.
D is incorrect: Sidecars share App Service plan resources with the main container, so the estimate must include the main API, the model server, and any other sidecars.