AI-200 practice: Deploy containers to Azure App Service, including configuring App Service to supply environment variables and secrets

Question 1

A containerized inference API on Azure App Service (Linux, custom container) needs a database connection string and a third-party API key at startup. Security requires that no secret value is ever stored as plain text in App Service configuration, and that the values automatically reflect the current version in Key Vault after rotation, without redeploying the app.

What should you configure?

Accepted Answer

Assign a system-assigned managed identity to the App Service, grant it Key Vault access, and use Key Vault references in Application Settings

Answer

Store both secrets as plain Application Settings values and update those settings manually whenever Key Vault rotations occur in the environment

Answer

Pass the secret values as Docker build-time ARG/ENV instructions so they are baked into image layers and never appear in App Service settings

Answer

Mount an Azure Files share containing a secrets text file into the container and have the entrypoint script read credentials at startup

Question 2

You are deploying a containerized AI model-serving API to Azure App Service. The image requires an OPENAI_API_KEY at runtime that should not be stored in source control. What is the recommended approach?

Accepted Answer

App setting with Key Vault reference

Answer

Dockerfile ENV with the secret baked

Answer

Public GitHub Gist fetched at startup

Answer

Hardcoded key in requirements.txt file

Question 3

Your organization requires that container images deployed to App Service can only be pulled using a managed identity rather than admin credentials stored on the registry. Which configuration satisfies this?

Accepted Answer

Grant AcrPull to App Service identity

Answer

Enable ACR admin user in App settings

Answer

Give Owner rights to a service principal

Answer

Store ACR password in Actions secrets

Question 4

You want App Service to automatically restart and pull the newest image tag whenever a new image is pushed to ACR, without manual redeployment. What should you enable?

Accepted Answer

Continuous deploy webhook from ACR to App Service

Answer

Static image tag pinned with no update webhook

Answer

ACR geo-replication across paired Azure regions

Answer

App Service Always On without deploy triggers

Question 5

You want to deploy an AI model to Azure App Service for Containers and supply sensitive environment variables (like API keys). How should you supply these secrets securely?

Accepted Answer

Key Vault refs in App Settings via managed identity

Answer

Plaintext API keys set in Dockerfile ENV instructions

Answer

Secrets baked into image layers during container build

Answer

Secrets passed as CLI args in the container start cmd

Question 6

You deploy a custom Linux container running a FastAPI app on port 8000 to Azure App Service. The log stream shows: `Container didn't respond to HTTP pings on port: 80, failing site start`. What is the simplest fix?

Accepted Answer

Add the app setting WEBSITES_PORT=8000

Answer

Add EXPOSE 8000 to the Dockerfile and redeploy the image

Answer

Turn on Always On so the platform keeps pinging the container until it responds

Answer

Set WEBSITES_ENABLE_APP_SERVICE_STORAGE=true so the container can bind to port 8000

Question 7

A containerized App Service app reads an `OPENAI_API_KEY` environment variable. The key is stored in Key Vault `kv-prod` as secret `OpenAIKey` and is rotated every 30 days. The app has a managed identity with secret read access. Which app setting value lets the container receive the current secret version after each rotation without anyone editing the setting?

Accepted Answer

@Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/OpenAIKey/)

Answer

@Microsoft.KeyVault(SecretUri=https://kv-prod.vault.azure.net/secrets/OpenAIKey/3f9c0a1b2d4e4c8f9a7b6c5d4e3f2a1b)

Answer

keyvault://kv-prod/OpenAIKey

Answer

https://kv-prod.vault.azure.net/secrets/OpenAIKey

Question 8

Your App Service for Containers app pulls `myregistry.azurecr.io/chat-ui:4.0`. Security policy says the registry's admin user must stay disabled and no registry password may appear in app settings. The app already has a system-assigned managed identity. Which two actions are required? Select two.

Accepted Answer

Assign the AcrPull role to the app's managed identity on the registry

Accepted Answer

Configure the app to pull with managed identity, for example by setting acrUseManagedIdentityCreds to true

Answer

Enable the ACR admin user and store its password in DOCKER_REGISTRY_SERVER_PASSWORD as a Key Vault reference

Answer

Assign the AcrPush role to the app's managed identity on the resource group

Answer

Enable anonymous pull on the registry

Answer

Grant the managed identity Contributor on the registry

Question 9

A custom Linux container on App Service downloads a 6 GB model at startup. The model is downloaded again on every restart and on every scaled-out instance, which slows cold starts. You want all instances to read the model files from one persistent location mounted at `/models`. What should you configure?

Accepted Answer

Mount an Azure Files share with az webapp config storage-account add --storage-type AzureFiles --mount-path /models

Answer

Write the model to /tmp, which persists across restarts and is shared between instances

Answer

Add a VOLUME /models instruction to the Dockerfile

Answer

Scale up to a larger App Service plan SKU so the container file system keeps its contents between restarts

Question 10

You run blue-green container releases with a `staging` deployment slot. The staging slot must always call a test Azure OpenAI endpoint through the `OPENAI_ENDPOINT` setting, and production must always call the production endpoint, even after a swap. How should you configure `OPENAI_ENDPOINT`?

Accepted Answer

Mark OPENAI_ENDPOINT as a deployment slot setting in each slot, for example with az webapp config appsettings set --slot-settings

Answer

Bake each endpoint into a separate image tag and deploy the matching tag to each slot

Answer

Create the setting only in the production slot; swaps copy production settings to staging automatically

Answer

Put both endpoints in one setting and let the container choose based on its hostname

11 questions