AZ-400 Container and Microservices Deployment 2 — Questions and Answers
Question 1: You need to implement blue-green deployments for a microservice in AKS. Which Kubernetes resource strategy best achieves this?
- Use two separate Deployments with a Service selector toggling between labels (Correct answer)
- Use a DaemonSet with rolling update strategy
- Use a StatefulSet with partition-based updates
- Use a CronJob to swap container images on a schedule
Correct answer: Use two separate Deployments with a Service selector toggling between labels
Blue-green deployments in Kubernetes use two Deployments (blue and green) and switch the Service selector label to route traffic to the new version instantly.
Question 2: Your AKS cluster needs to pull images from Azure Container Registry (ACR) without storing credentials in Kubernetes Secrets. What is the recommended approach?
- Attach the ACR to the AKS cluster using managed identity integration (Correct answer)
- Create an imagePullSecret with the ACR admin credentials
- Store ACR credentials in Azure Key Vault and mount as a volume
- Use a service principal password stored in a ConfigMap
Correct answer: Attach the ACR to the AKS cluster using managed identity integration
Attaching ACR to AKS using managed identity (--attach-acr) grants the kubelet identity the AcrPull role, eliminating the need for stored credentials.
Question 3: A microservice in AKS is experiencing CPU throttling under load. Which HPA metric source allows scaling based on custom application metrics from Azure Monitor?
- External metrics adapter using Azure Monitor metrics (Correct answer)
- Resource metrics using cpu utilization
- Object metrics targeting a Kubernetes Ingress
- Pod metrics from the default metrics server
Correct answer: External metrics adapter using Azure Monitor metrics
The Azure Monitor metrics adapter exposes custom and external metrics to the HPA, enabling scaling based on application-specific telemetry.
Question 4: When configuring a multi-stage Azure Pipeline to build and push a Docker image, which built-in variable contains the unique identifier suitable for tagging the image per build?
- $(Build.BuildId) (Correct answer)
- $(System.TeamProject)
- $(Agent.WorkFolder)
- $(Pipeline.Workspace)
Correct answer: $(Build.BuildId)
$(Build.BuildId) is an auto-incrementing integer unique per build, commonly used as a Docker image tag to ensure traceability.
Question 5: You want to enforce that only images from your ACR registry are deployed into a specific AKS namespace. Which Azure Policy built-in achieves this?
- Kubernetes cluster containers should only use allowed images (Correct answer)
- Kubernetes cluster should not allow privileged containers
- Kubernetes cluster pods should use specified labels
- Kubernetes cluster services should listen on allowed ports only
Correct answer: Kubernetes cluster containers should only use allowed images
The 'allowed images' policy uses OPA Gatekeeper to restrict container images to an approved registry pattern, preventing unauthorized images from running.
Question 6: In a Helm chart deployment pipeline, which command applies a new chart version to an existing release WITHOUT deleting and recreating resources when possible?
- helm upgrade <release> <chart> (Correct answer)
- helm install <release> <chart>
- helm rollback <release> <revision>
- helm template <release> <chart> | kubectl apply -f -
Correct answer: helm upgrade <release> <chart>
helm upgrade performs an in-place update of an existing Helm release, patching resources rather than recreating them unless necessary.
Question 7: A container in your AKS pod fails its readiness probe repeatedly. What is the immediate effect on traffic routing?
- The pod is removed from Service endpoints until the probe passes (Correct answer)
- The pod is restarted by the kubelet immediately
- The Deployment scales down the failing pod's replica count
- The node is cordoned and no new pods are scheduled on it
Correct answer: The pod is removed from Service endpoints until the probe passes
A failing readiness probe causes Kubernetes to remove the pod from the Service's endpoint slice, stopping traffic from reaching it without restarting the container.
AZ-400 Container and Microservices Deployment 2
You need to implement blue-green deployments for a microservice in AKS.
Which Kubernetes resource strategy best achieves this?