AI-200 practice: Deploy applications to Azure Container Apps, including environment configuration and revision management

Question 1

You are rolling out a new revision of a RAG API in Azure Container Apps. You want 90% of production traffic to keep going to the stable revision and 10% to the new revision, want both revisions addressable by a fixed label for internal testing regardless of which is "latest," and want to shift more traffic gradually over several days without redeploying.

What should you configure?

Accepted Answer

Multiple revisions with revision labels on both, traffic-weight percentages split 90/10, then adjust weights gradually without redeploying the app

Answer

Single active revision mode that deactivates the previous revision as soon as the new revision is healthy and takes all production traffic

Answer

A second Container App hosting only the new revision, with Azure Front Door weighted routing splitting traffic between the two Container App endpoints

Answer

HTTP concurrency scale rules on both revisions so replica counts indirectly determine how much production traffic each revision receives

Question 2

You are deploying a container app that must pull its image from a private ACR without embedding registry credentials as secrets:
```bicep
resource containerApp 'Microsoft.App/containerApps@2024-03-01' = {
  name: 'orders-api'
  location: location
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${uami.id}': {}
    }
  }
  properties: {
    configuration: {
      registries: [
        {
          server: 'myregistry.azurecr.io'
          identity: uami.id
        }
      ]
    }
    template: {
      containers: [
        {
          name: 'orders-api'
          image: 'myregistry.azurecr.io/orders-api:1.0'
        }
      ]
    }
  }
}
```
Deployment fails with an image pull authorization error. What is missing?

Accepted Answer

The user-assigned managed identity has not been granted the AcrPull role assignment on the ACR resource.

Answer

The registries array must include a username and passwordSecretRef even when using managed identity.

Answer

Container Apps do not support user-assigned identities for registry authentication; a system-assigned identity is required.

Answer

The image tag 1.0 must be replaced with latest for managed identity pulls to succeed.

Question 3

You need to gradually shift traffic to a new revision of a Container App, sending 20% of traffic to the new revision and 80% to the stable one, without deactivating the old revision.

You run:
```bash
az containerapp update \
  --name orders-api \
  --resource-group rg-orders \
  --image myregistry.azurecr.io/orders-api:2.0
```
After this command, all traffic still routes to the old revision. What must be done to achieve the 80/20 split?

Accepted Answer

Run az containerapp ingress traffic set --name orders-api --resource-group rg-orders --revision-weight orders-api--old=80 orders-api--new=20 after confirming the app is in multiple-revision mode.

Answer

Nothing further; az containerapp update automatically splits traffic 50/50 between the two most recent revisions.

Answer

Delete the old revision and redeploy it with a --traffic-weight 80 flag.

Answer

Set minReplicas: 0 on the old revision so Container Apps automatically balances traffic based on load.

Question 4

A Container App needs to reach an internal-only PostgreSQL server inside a peered VNET, and must not be reachable from the public internet at all — only from other services in the same Container Apps Environment and peered VNETs.
```bicep
resource env 'Microsoft.App/managedEnvironments@2024-03-01' = {
  name: 'orders-env'
  location: location
  properties: {
    vnetConfiguration: {
      infrastructureSubnetId: subnet.id
      internal: true
    }
  }
}
```
Which ingress configuration on the Container App correctly complements this environment setting for a fully internal-only app?

Accepted Answer

ingress: { external: false, targetPort: 8080 }

Answer

ingress: { external: true, targetPort: 8080 }

Answer

Omit the ingress block entirely; internal environments block all ingress by default.

Answer

ingress: { external: true, targetPort: 8080, ipSecurityRestrictions: [{ action: 'Deny', ipAddressRange: '0.0.0.0/0' }] }

Question 5

You need to attach a custom domain `api.contoso.com` with a managed TLS certificate to a Container App:
```bash
az containerapp hostname add \
  --hostname api.contoso.com \
  --name orders-api \
  --resource-group rg-orders
```
This command fails with a domain ownership validation error. What must be done before this command succeeds?

Accepted Answer

Create a TXT record at the DNS provider for domain validation (or a CNAME/asuid TXT record as required), pointing to the values Azure provides, before Azure can verify ownership of api.contoso.com.

Answer

Purchase the domain through Azure App Service Domains first; custom domains from third-party registrars are not supported by Container Apps.

Answer

Enable internal: true on the Container Apps Environment.

Answer

Generate a self-signed certificate and upload it via az containerapp ssl upload before adding the hostname.

Question 6

Which Azure service lets you run containerized microservices with built-in autoscaling and traffic splitting between revisions, without managing the underlying Kubernetes cluster?

Accepted Answer

Azure Container Apps

Answer

Azure Kubernetes Service

Answer

Virtual Machine Scale Sets

Answer

Azure Batch compute jobs

Question 7

You deployed a new version of a container image to Azure Container Apps and want to gradually shift 10% of production traffic to it while keeping 90% on the stable version. What should you configure?

Accepted Answer

Revisions with weighted traffic split

Answer

Separate app with its own custom domain

Answer

Front Door origin with 90/10 priority

Answer

Two AKS deployments behind an Ingress

Question 8

An AI batch-scoring workload runs as a scheduled job rather than a long-running service. Which Container Apps feature best fits this pattern?

Accepted Answer

Container Apps Jobs for finite work

Answer

Ingress sticky sessions for HTTP apps

Answer

Dapr binding component for external IO

Answer

Revision label for stable endpoints

Question 9

You must ensure that an Azure Container Apps environment used for a healthcare AI application has no public inbound access and all outbound traffic is routed through a network virtual appliance for inspection. What deployment model should you choose?

Accepted Answer

Custom VNet environment with UDRs for NVA egress

Answer

Default Consumption environment without a VNet

Answer

Public FQDN environment with IP allowlists only

Answer

AKS cluster deployed with no network policies

Question 10

When deploying to Azure Container Apps, you want to test a new version of your AI model with 10% of the live traffic before a full rollout. Which feature should you use?

Accepted Answer

Revision traffic splitting

Answer

Application Gateway routing

Answer

Front Door origin weighting

Answer

App Service slot percentage

13 questions