AI-200 Containerized AI Workloads — 20 Questions

Question 1

You are debugging a network connectivity issue between two pods in AKS. Which command helps you check if the service endpoint is reachable?

Accepted Answer

kubectl exec -it <pod> -- /bin/sh.. Using 'kubectl debug' or a temporary container with network tools (like 'curl' or 'nslookup') is the standard way to test internal network paths.

Answer

kubectl cluster-info.

Answer

kubectl get services.

Answer

kubectl top pods.

Question 2

You are configuring an Azure Container Apps environment with a custom Virtual Network. Your AI containers need to securely connect to an Azure SQL Database that is secured behind a private endpoint. Which configuration is required on the Container Apps environment?

Accepted Answer

Deploy the Container Apps environment into a custom VNet with workload profile subnets. To communicate with private endpoints within a VNet, Azure Container Apps must be deployed within a custom virtual network with a dedicated subnet.

Answer

Use an external Azure Application Gateway in front of the container apps

Answer

Enable Azure Bastion on the subnet

Answer

Configure IP restriction rules on the ingress controller

Question 3

You have an AI model container hosted in Azure Container Registry. You want to ensure that every container image pushed to the registry is automatically scanned for known vulnerabilities before deployment. Which ACR feature should you enable?

Accepted Answer

Microsoft Defender for Cloud vulnerability scanning. Microsoft Defender for Cloud integrates with Azure Container Registry to provide vulnerability scanning for container images upon push or import.

Answer

ACR Tasks auto-purge

Answer

Content Trust

Answer

ACR geo-replication

Question 4

You are deploying a Python Flask API that wraps an ONNX runtime model to Azure Container Instances (ACI). The container needs to expose port 5000 externally. Which parameter must you specify when creating the container group?

Accepted Answer

--dns-name-label and port 5000 mapping. When deploying to Azure Container Instances, you must explicitly configure the port and protocol for public IP exposure.

Answer

--assign-identity

Answer

--restart-policy Never

Answer

--os-type Windows

Question 5

You need to store custom AI container images in a private registry hosted within Azure. Which Azure service provides a managed Docker registry service?

Accepted Answer

Azure Container Registry. Azure Container Registry (ACR) is the managed Docker registry service in Azure used for storing and managing container images.

Answer

Azure Blob Storage

Answer

Azure Managed Disks

Answer

Azure Artifacts

Question 6

You are optimizing a large language model container inference deployment on AKS using GPU-enabled nodes (NC-series). The inference server experiences frequent out-of-memory errors on the GPU device itself during high context lengths. Which Kubernetes configuration metric should you monitor and alert on?

Accepted Answer

container_gpu_memory_used_bytes via NVIDIA DCGM Exporter. Monitoring NVIDIA GPU memory usage via DCGM (Data Center GPU Manager) metrics in Prometheus/Grafana is critical for detecting GPU out-of-memory errors.

Answer

container_memory_working_set_bytes via kubelet

Answer

container_cpu_cfs_throttled_periods_total

Answer

node_net_bytes_total

Question 7

You are managing an AKS cluster running resource-intensive AI training jobs. You want to ensure that nodes automatically scale up and down based on pending pod resource requests. Which component should you enable and configure?

Accepted Answer

Kubernetes Cluster Autoscaler. The Kubernetes Cluster Autoscaler monitors for unschedulable pods and requests additional nodes from Azure Virtual Machine Scale Sets.

Answer

KEDA (Kubernetes Event-driven Autoscaling)

Answer

Azure Load Balancer

Answer

Horizontal Pod Autoscaler

Question 8

You are running an AI inference workload in an Azure Kubernetes Service (AKS) cluster. The pods require access to an Azure Machine Learning workspace data store via managed identity without storing credentials in code. Which Kubernetes feature should you configure?

Accepted Answer

Azure AD Workload Identity. Azure AD Workload Identity enables Kubernetes service accounts to securely connect to Azure cloud resources using Azure AD managed identities.

Answer

Azure CNI Overlay

Answer

Kubernetes Secrets CSI driver

Answer

Node-level Managed Identity

Question 9

You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?

Accepted Answer

http. Azure Container Apps supports a built-in HTTP scale rule that scales applications based on the number of concurrent HTTP requests per replica.

Answer

azure-service-bus

Answer

cpu

Answer

tcp

Question 10

You are configuring GPU time-slicing on an AKS cluster to maximize GPU utilization for multiple lightweight AI inference containers sharing a single NVIDIA A100 GPU. Where must you define the time-slicing configuration profile?

Accepted Answer

A Kubernetes ConfigMap referenced by the NVIDIA device plugin daemonset. GPU time-slicing in AKS is configured using a ConfigMap that defines replica counts per GPU device, which is then applied to the cluster.

Answer

Inside the Dockerfile of each individual AI container

Answer

Via Azure Container Apps workload profiles configuration

Answer

In the Azure portal under AKS cluster node pool properties

Question 11

You need to deploy a containerized AI model to Azure Container Apps and configure it to scale based on Azure Service Bus queue messages. Which scaler should you specify?

Accepted Answer

azure-service-bus. Azure Container Apps supports KEDA scalers natively, including the azure-service-bus scaler.

Answer

azure-blob

Answer

memory

Answer

cron

Question 12

You have an AI model container that takes 10 seconds to load weights into memory upon startup. Users report HTTP 503 errors immediately after deployment because traffic is routed to the container before it is ready. Which probe should you configure?

Accepted Answer

Startup probe. A startup probe in Kubernetes or Container Apps delays liveness and readiness checks until the application has fully initialized.

Answer

Liveness probe

Answer

Resource quota probe

Answer

TCP socket probe

Question 13

You are troubleshooting an AI inference container in Azure Container Apps that fails to start because it cannot pull the base image from Azure Container Registry. Authentication fails with an unauthorized error. What is the recommended way to grant the Container App access to ACR?

Accepted Answer

Configure a system-assigned managed identity on the Container App and assign the AcrPull role on ACR. Enabling a managed identity on the Container App and granting it the AcrPull role on the Azure Container Registry is the secure, modern authentication approach.

Answer

Hardcode the admin username and password into environment variables

Answer

Expose the ACR endpoint publicly without authentication

Answer

Attach an Azure Storage Account SAS token to the container environment

Question 14

You need to deploy a set of batch AI processing containers in Azure Container Instances that run to completion and then terminate. Which container group restart policy should you select?

Accepted Answer

Never. For batch jobs that run to completion and stop, the restart policy should be set to Never or OnFailure.

Answer

Always

Answer

UnlessStopped

Answer

OnFailure

Question 15

You are setting up image builds for a multi-architecture (AMD64 and ARM64) AI model container using Azure Container Registry Tasks. Which command or feature should you use to build images for both architectures simultaneously?

Accepted Answer

az acr build with a multi-step task or docker buildx configuration. ACR Tasks support multi-architecture builds using Docker buildx commands within a task definition file or quick task execution.

Answer

Azure DevOps pipeline running docker push directly

Answer

az aks create with --node-os-sku

Answer

az acr import

Question 16

You are configuring network policies in an AKS cluster to isolate your AI inference pods from other namespaces. You notice that traffic is still flowing between namespaces despite applying a NetworkPolicy. What is the most likely cause?

Accepted Answer

The AKS cluster was deployed with a network plugin that does not enforce Kubernetes network policies. AKS requires a network plugin that supports network policies, such as Azure CNI with Azure Network Policies or Calico, to be enabled at cluster creation.

Answer

Network policies require IPv6 enablement on the cluster subnet

Answer

Network policies apply only to ingress controllers, not pod-to-pod traffic

Answer

Azure Firewall is blocking the network policy controller

Question 17

You want to view real-time standard output logs from a container running in Azure Container Instances named 'ai-inferencing-aci'. Which Azure CLI command should you run?

Accepted Answer

az container logs --resource-group myRG --name ai-inferencing-aci. The 'az container logs' command streams or retrieves logs from an Azure Container Instance.

Answer

az container show --resource-group myRG --name ai-inferencing-aci

Answer

az aks browse --name ai-inferencing-aci

Answer

az acr repository show-tags

Question 18

You are troubleshooting slow inference latency in an AI application deployed on AKS. You suspect that network packets between inference pods are traversing unnecessary hops due to overlay routing. Which CNI mode should you have chosen for optimal direct routing?

Accepted Answer

Azure CNI with direct pod IP routing (no overlay). Azure CNI without overlay assigns VNet IP addresses directly to pods, eliminating encapsulation overhead and improving networking performance for high-throughput AI workloads.

Answer

Kubenet with host-port mapping

Answer

Kubenet with basic Linux bridge

Answer

Azure CNI Overlay

Question 19

You are deploying an AI model container to Azure Container Apps. The container requires persistent storage to cache downloaded Hugging Face model weights across container restarts. Which storage type should you attach to the Container App?

Accepted Answer

Azure Files mount via Container Apps storage configuration. Azure Container Apps supports mounting Azure Files shares as volumes for persistent storage across container lifecycles.

Answer

Azure Managed Disks (Premium SSD) direct attach

Answer

Azure Blob Storage FUSE driver

Answer

Ephemeral emptyDir volume

Question 20

You are building an AI container image and need to minimize its final size to speed up deployment times. Which multi-stage build practice should you follow?

Accepted Answer

Use a builder stage for compilation and copy only runtime artifacts into a slim base image. Multi-stage builds allow you to use a heavy builder image with SDKs and compilers, then copy only the compiled artifacts and runtime binaries into a slim final base image.

Answer

Store model weights directly inside the container image layers

Answer

Install all development tools and pip packages in a single RUN instruction

Answer

Disable container image compression when pushing to ACR