AI-200 practice: Monitor and troubleshoot solutions on AKS and Container Apps by inspecting logs, events, and end-to-end connectivity

Question 1

Pods running an AI inference container in AKS intermittently show a Running status but stop responding to requests. Container Insights shows no CPU or memory pressure. You suspect the issue may be DNS resolution to an internal Cosmos DB private endpoint intermittently failing.

What is the most effective sequence to isolate the root cause?

Accepted Answer

Exec into an affected pod to test DNS and private-endpoint connectivity, then correlate results with Container Insights logs and network policy or NSG rules

Answer

Raise the Deployment CPU and memory requests and limits, then roll out a new revision, treating intermittent failures as resource contention

Answer

Delete and recreate the AKS user node pool that hosts the inference pods, assuming intermittent failures usually originate from unhealthy nodes

Answer

Disable the Cosmos DB private endpoint and temporarily allow public network access so you can rule out private networking as a factor

Question 2

A pod in your AKS cluster is repeatedly restarting. `kubectl get pods` shows:
```text
NAME                          READY   STATUS            RESTARTS   AGE
inference-api-7d4f9c6-2xk9j   0/1     CrashLoopBackOff  6          8m
```
`kubectl logs inference-api-7d4f9c6-2xk9j --previous` outputs:
```text
Traceback (most recent call last):
...
MemoryError: Unable to allocate 2.1 GiB for an array
```
The pod definition has:
```yaml
resources:
  requests:
    memory: "512Mi"
    cpu: "250m"
  limits:
    memory: "1Gi"
    cpu: "1"
```
What is the correct fix?

Accepted Answer

Increase limits.memory to a value comfortably above the process's peak usage (e.g., 3Gi), and raise requests.memory proportionally so the scheduler places the pod on a node with sufficient capacity.

Answer

Remove the limits block entirely so the container can use unlimited memory.

Answer

Decrease requests.memory to 128Mi so the pod schedules on smaller nodes with more headroom.

Answer

Add a livenessProbe with a longer initialDelaySeconds to give the process more time to allocate memory before being restarted.

Question 3

You use Dapr sidecars in AKS for pub/sub messaging between microservices. The order-service publishes to a topic, but inventory-service never receives events:
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: inventory-service
spec:
  template:
    metadata:
      annotations:
        dapr.io/enabled: "true"
        dapr.io/app-id: "inventory-service"
        dapr.io/app-port: "6001"
    spec:
      containers:
      - name: inventory-service
        image: myregistry.azurecr.io/inventory:1.0
        ports:
        - containerPort: 6001
---
apiVersion: dapr.io/v1alpha1
kind: Subscription
metadata:
  name: order-events-sub
spec:
  topic: order-events
  route: /events
  pubsubname: order-pubsub
  scopes:
  - inventory-service
```
Events are published successfully (confirmed in order-pubsub), but inventory-service never logs receipt. What is the most likely cause?

Accepted Answer

The Subscription's scopes field restricts delivery to app-ids listed; since inventory-service is listed, the issue is that inventory-service has no HTTP route handler for POST /events on port 6001.

Answer

Dapr Subscriptions do not support a scopes field; its presence invalidates the entire resource.

Answer

dapr.io/app-port must match the Dapr sidecar port (3500), not the application's own port.

Answer

Pub/sub components must be redeployed every time a new Subscription is created.

Question 4

You define a NetworkPolicy in AKS (using Azure Network Policy Manager / Calico) intended to allow only the frontend namespace to reach pods labeled `app=backend` on port 8080, denying all other traffic:
```yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend-to-backend
  namespace: backend
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: frontend
    ports:
    - protocol: TCP
      port: 8080
```
After applying this policy, pods in the frontend namespace still cannot reach backend pods, but before applying it, they could. What is the most likely explanation?

Accepted Answer

The network policy engine is active (enforcing default-deny once targeted), but the frontend namespace lacks the kubernetes.io/metadata.name: frontend label (or has it overridden), causing the selector to match 0 namespaces while default-deny remains active.

Answer

NetworkPolicy resources only support Egress, not Ingress, in AKS.

Answer

The frontend namespace must have the label kubernetes.io/metadata.name: frontend explicitly removed for the selector to work.

Answer

Applying any Ingress NetworkPolicy to a pod immediately blocks all traffic to it from every source due to an AKS-specific platform bug.

Question 5

An AKS-hosted RAG (retrieval-augmented generation) API intermittently fails to reach Azure Cosmos DB. You need to diagnose whether the issue is DNS resolution, network policy, or application-level, using data already available in the cluster. What is the best first step?

Accepted Answer

Check pod logs then test DNS in-pod

Answer

Delete and recreate the whole AKS cluster

Answer

Open a support ticket with no diagnostics

Answer

Increase replicas hoping the issue clears

Question 6

You need to verify end-to-end connectivity between an Azure Container Apps environment and a private Azure Database for PostgreSQL instance that has public access disabled. What should you check first?

Accepted Answer

VNet path to private PostgreSQL endpoint

Answer

Image tag set to latest on the revision

Answer

ACR Content Trust signing for the image

Answer

Replica count greater than one on the app

Question 7

Your Container Apps-hosted AI service logs show intermittent 502 errors correlating with new revision deployments. You suspect the new revision isn't passing its readiness probe before receiving traffic. What should you configure to prevent this?

Accepted Answer

Readiness probe plus warm-up before traffic

Answer

Raise the max replica count for the app

Answer

Disable multi-revision mode entirely now

Answer

Lower the container CPU allocation value

Question 8

A team runs both an AKS cluster and Container Apps environment for different AI microservices and needs a single command-line-driven way to confirm end-to-end connectivity, DNS resolution, and recent error events across both platforms during an incident. Which combination of steps is correct?

Accepted Answer

kubectl/az logs plus Log Analytics KQL correlation

Answer

Check only Azure portal Activity Log entries now

Answer

Restart both platforms at the same time together

Answer

Rely only on ACR repository operation log entries

Question 9

You are troubleshooting an Azure Container App that is failing to start. You need to view the logs generated during the container's startup phase. Which CLI command provides access to these logs?

Accepted Answer

az containerapp logs show

Answer

az containerapp revision list

Answer

az containerapp replica list

Answer

az containerapp env show

Question 10

You need to inspect real-time logs from an Azure Container Apps instance. Which command enables live streaming of application console logs?

Accepted Answer

az containerapp logs show --follow

Answer

az containerapp logs show --watch

Answer

az containerapp logs show --stream

Answer

az containerapp logs show --tail

12 questions