AZ-400 Container and Microservices Deployment 5 — Questions and Answers
Question 1: You need to implement GitOps for AKS deployments where the cluster state is continuously reconciled with a Git repository. Which tool is purpose-built for this pattern?
- Flux CD or Argo CD deployed in the AKS cluster (Correct answer)
- Azure Pipelines with a scheduled trigger polling Git
- Helm with the --wait flag in a cron-triggered pipeline
- kubectl apply run by a Kubernetes CronJob inside the cluster
Correct answer: Flux CD or Argo CD deployed in the AKS cluster
Flux CD and Argo CD are GitOps operators that run inside Kubernetes and continuously reconcile cluster state with the desired state declared in a Git repository.
Question 2: A container in AKS keeps being OOMKilled. What is the correct resource configuration change to prevent this?
- Increase the memory limit in the container's resources.limits.memory field (Correct answer)
- Increase the CPU request in the container's resources.requests.cpu field
- Set the pod's restartPolicy to Never
- Add a liveness probe with a higher failureThreshold
Correct answer: Increase the memory limit in the container's resources.limits.memory field
OOMKilled occurs when a container exceeds its memory limit; increasing resources.limits.memory gives the container more memory before the kernel terminates it.
Question 3: In Azure Container Registry (ACR), which feature automatically removes untagged manifests and old image tags based on configurable retention policies?
- ACR retention policies and automated purge tasks (Correct answer)
- ACR geo-replication with automatic failover cleanup
- ACR content trust with signature expiry enforcement
- ACR network rules blocking pushes of untagged images
Correct answer: ACR retention policies and automated purge tasks
ACR retention policies and scheduled purge tasks (az acr task create with a purge command) automatically clean up untagged manifests and old tags to manage registry storage.
Question 4: When deploying microservices with Azure Container Apps, what is the purpose of the 'ingress' configuration with 'external: false'?
- The container app is only reachable from other apps within the same Container Apps Environment (Correct answer)
- The container app has no network access and operates in isolated mode
- The container app's HTTP endpoint is disabled entirely
- The container app scales to zero immediately when no internal traffic is present
Correct answer: The container app is only reachable from other apps within the same Container Apps Environment
Setting external: false on a Container App's ingress restricts its HTTP endpoint to internal traffic within the Container Apps Environment, preventing public internet access.
Question 5: You want Azure Pipelines to deploy to AKS only after a manual approval from the security team. Where is this approval gate configured?
- On the Azure DevOps Environment as a pre-deployment approval check (Correct answer)
- As a condition expression on the Kubernetes deployment task
- In the pipeline's trigger settings under branch policies
- As a required reviewer in the Git repository's CODEOWNERS file
Correct answer: On the Azure DevOps Environment as a pre-deployment approval check
Pre-deployment approvals are configured on Azure DevOps Environments; when a pipeline targets that environment, it pauses and waits for designated approvers before proceeding.
Question 6: Which kubectl command shows the rollout history of a Deployment in AKS, including change-cause annotations from previous updates?
- kubectl rollout history deployment/<name> (Correct answer)
- kubectl describe deployment/<name>
- kubectl get events --field-selector involvedObject.name=<name>
- kubectl logs deployment/<name> --previous
Correct answer: kubectl rollout history deployment/<name>
kubectl rollout history lists revision numbers and their associated change-cause annotations, providing an audit trail of Deployment updates.
Question 7: Your team needs to enforce a policy that all AKS containers must have CPU and memory resource limits defined. Which mechanism enforces this at admission time?
- Azure Policy with the 'Kubernetes cluster containers CPU and memory resource limits should not exceed the specified limits' built-in (Correct answer)
- A Kubernetes NetworkPolicy blocking pods without resource annotations
- An AKS node pool taint rejecting pods without resource requests
- A Prometheus alert rule that deletes non-compliant pods after deployment
Correct answer: Azure Policy with the 'Kubernetes cluster containers CPU and memory resource limits should not exceed the specified limits' built-in
Azure Policy for AKS uses OPA Gatekeeper to deny pod admission if containers lack required CPU and memory resource limits, enforcing compliance before workloads run.
AZ-400 Container and Microservices Deployment 5
You need to implement GitOps for AKS deployments where the cluster state is continuously reconciled with a Git repository.
Which tool is purpose-built for this pattern?