AZ-400 Container and Microservices Deployment 3 — Questions and Answers
Question 1: You need to configure canary deployments in AKS using NGINX Ingress. Which annotation controls the percentage of traffic routed to the canary deployment?
- nginx.ingress.kubernetes.io/canary-weight (Correct answer)
- nginx.ingress.kubernetes.io/canary-header
- nginx.ingress.kubernetes.io/canary-by-cookie
- nginx.ingress.kubernetes.io/rewrite-target
Correct answer: nginx.ingress.kubernetes.io/canary-weight
The canary-weight annotation specifies the integer percentage (0-100) of requests that NGINX Ingress forwards to the canary Ingress resource.
Question 2: When building Docker images in Azure Pipelines, what is the primary security benefit of using a multi-stage Dockerfile?
- The final image excludes build tools and intermediate artifacts, reducing attack surface (Correct answer)
- It allows parallel execution of pipeline stages for faster builds
- It enables layer caching across multiple pipeline agents
- It automatically scans each stage for vulnerabilities using Defender for Containers
Correct answer: The final image excludes build tools and intermediate artifacts, reducing attack surface
Multi-stage builds copy only the compiled artifacts into a minimal final image, excluding compilers, SDKs, and build dependencies that could be exploited.
Question 3: Your microservices communicate over HTTP within AKS. You need mutual TLS (mTLS) between services without modifying application code. Which solution achieves this?
- Deploy a service mesh such as Istio or Linkerd with automatic sidecar injection (Correct answer)
- Configure TLS certificates in each pod's environment variables
- Use an NGINX Ingress controller with TLS termination for internal traffic
- Enable Azure Private Link on the AKS cluster virtual network
Correct answer: Deploy a service mesh such as Istio or Linkerd with automatic sidecar injection
Service meshes inject sidecar proxies that handle mTLS transparently, encrypting service-to-service traffic without requiring code changes.
Question 4: In Azure Container Apps, which scaling rule type allows the platform to scale based on the length of an Azure Service Bus queue?
- Azure Service Bus scaler (KEDA-based) (Correct answer)
- HTTP traffic scaler
- CPU percentage scaler
- Memory pressure scaler
Correct answer: Azure Service Bus scaler (KEDA-based)
Azure Container Apps uses KEDA under the hood, and the Service Bus scaler triggers scaling based on queue/topic message count or backlog.
Question 5: You are configuring Pod Disruption Budgets (PDB) for a critical microservice with 5 replicas. Setting minAvailable to 4 means:
- At least 4 pods must remain running during voluntary disruptions like node drains (Correct answer)
- No more than 4 pods can be disrupted simultaneously
- Exactly 4 pods will always be terminated during updates
- The Deployment will refuse to scale below 4 replicas permanently
Correct answer: At least 4 pods must remain running during voluntary disruptions like node drains
A PDB with minAvailable: 4 prevents voluntary disruptions (drains, evictions) from proceeding if they would leave fewer than 4 healthy pods.
Question 6: Which Azure DevOps pipeline task is used to run Trivy or similar vulnerability scans on a container image before pushing to ACR?
- A Bash or script task invoking the scanner CLI after the Docker build step (Correct answer)
- The Docker@2 task with the scan command option
- The AzureCLI@2 task with the acr scan subcommand
- The PublishTestResults@2 task with the image format option
Correct answer: A Bash or script task invoking the scanner CLI after the Docker build step
Container image scanners like Trivy are invoked via a Bash/script task in the pipeline after building the image but before pushing, failing the pipeline if critical CVEs are found.
Question 7: A Helm release deployment fails midway. Which command reverts the AKS cluster to the last known good Helm release revision?
- helm rollback <release-name> <revision-number> (Correct answer)
- helm uninstall <release-name> && helm install <release-name> <chart>
- helm history <release-name> --undo
- kubectl rollout undo deployment/<name>
Correct answer: helm rollback <release-name> <revision-number>
helm rollback atomically reverts a named release to a specified previous revision, restoring all managed Kubernetes resources to that state.
AZ-400 Container and Microservices Deployment 3
You need to configure canary deployments in AKS using NGINX Ingress.
Which annotation controls the percentage of traffic routed to the canary deployment?