AZ-400 Container and Microservices Deployment 4 — Questions and Answers
Question 1: You need to store sensitive database connection strings for a containerized app in AKS. What is the most secure method to inject these at runtime?
- Mount secrets from Azure Key Vault using the Secrets Store CSI Driver (Correct answer)
- Bake credentials into the Docker image during the CI build
- Pass credentials as Docker build arguments stored in pipeline variables
- Store credentials in a Kubernetes ConfigMap referenced by the pod
Correct answer: Mount secrets from Azure Key Vault using the Secrets Store CSI Driver
The Secrets Store CSI Driver mounts Key Vault secrets directly into pods as volumes or environment variables without storing them in etcd as Kubernetes Secrets.
Question 2: When using Azure Container Instances (ACI) for burst capacity alongside AKS, which component enables AKS pods to be scheduled onto ACI nodes transparently?
- Virtual Kubelet / AKS virtual nodes (Correct answer)
- Azure Load Balancer with backend pool targeting ACI
- AKS node auto-provisioner with spot instance pools
- Azure Arc-enabled Kubernetes federation
Correct answer: Virtual Kubelet / AKS virtual nodes
Virtual Kubelet (implemented as AKS virtual nodes) registers ACI as a node in the cluster, allowing the scheduler to place pods on ACI using standard Kubernetes node selectors.
Question 3: In a microservices architecture on AKS, you need service discovery without using a service mesh. Which Kubernetes-native mechanism handles DNS-based discovery?
- CoreDNS resolving ClusterIP Service names using the format <service>.<namespace>.svc.cluster.local (Correct answer)
- Azure Private DNS zones mapped to each pod IP
- Kubernetes EndpointSlices published to an external etcd cluster
- Azure Traffic Manager with health probes targeting pod IPs
Correct answer: CoreDNS resolving ClusterIP Service names using the format <service>.<namespace>.svc.cluster.local
CoreDNS in AKS automatically creates DNS records for each Service, enabling pods to discover services by their fully qualified DNS name within the cluster.
Question 4: Your pipeline must build a container image for both linux/amd64 and linux/arm64 architectures from a single Dockerfile. Which Docker feature enables this?
- docker buildx build --platform linux/amd64,linux/arm64 with BuildKit (Correct answer)
- docker build --arch flag with multiple comma-separated values
- docker manifest create combining two separately built images
- docker compose build with platform overrides in the compose file
Correct answer: docker buildx build --platform linux/amd64,linux/arm64 with BuildKit
Docker Buildx with BuildKit supports multi-platform builds using the --platform flag, producing a single multi-arch manifest image from one build command.
Question 5: A microservice Deployment in AKS needs to complete in-flight requests before a pod is terminated during rolling updates. Which pod configuration achieves this?
- Add a preStop lifecycle hook with a sleep and set terminationGracePeriodSeconds appropriately (Correct answer)
- Set the Deployment's minReadySeconds to a high value
- Configure a readiness probe with a long successThreshold
- Use a PodDisruptionBudget with maxUnavailable set to 0
Correct answer: Add a preStop lifecycle hook with a sleep and set terminationGracePeriodSeconds appropriately
A preStop sleep hook delays SIGTERM until Kubernetes removes the pod from endpoints, combined with terminationGracePeriodSeconds long enough for in-flight requests to complete.
Question 6: In Azure DevOps, which environment resource type is used to represent an AKS namespace as a deployment target with built-in deployment history and approvals?
- Kubernetes resource in an Azure DevOps Environment (Correct answer)
- Service connection of type Kubernetes
- Variable group linked to the AKS cluster
- Pipeline artifact pointing to a kubeconfig file
Correct answer: Kubernetes resource in an Azure DevOps Environment
Adding a Kubernetes resource to an Azure DevOps Environment enables deployment tracking, audit history, and approval gates for deployments targeting a specific AKS namespace.
Question 7: When configuring Horizontal Pod Autoscaler (HPA) in AKS, what happens if both minReplicas and maxReplicas are set to the same value?
- The HPA maintains a fixed replica count and effectively disables autoscaling (Correct answer)
- The HPA errors and the Deployment reverts to manual scaling
- Kubernetes ignores the HPA and uses the Deployment's replicas field
- The HPA continuously reconciles the replica count every 15 seconds regardless of metrics
Correct answer: The HPA maintains a fixed replica count and effectively disables autoscaling
When minReplicas equals maxReplicas, the HPA cannot scale up or down and keeps the replica count fixed at that value, making autoscaling non-functional.
AZ-400 Container and Microservices Deployment 4
You need to store sensitive database connection strings for a containerized app in AKS.
What is the most secure method to inject these at runtime?