42 of 117 questions · Page 2/2 · Containerized Ai Workloads topic · Answers revealed
You are managing multiple containerized AI models in AKS. You want to implement a service mesh to handle traffic splitting and mTLS. Which tool should you integrate?
Istio provides the traffic splitting and mTLS required.
Why this answer
Istio is the standard service mesh supported for AKS to provide traffic management and security.
Your containerized AI application needs to access sensitive API keys. What is the most secure way to provide these to your application in Azure Container Apps?
Key Vault references keep secrets out of the configuration and inject them at runtime.
Why this answer
Azure Key Vault references allow secrets to be injected securely into the container environment.
You are running an AI inference workload in an Azure Kubernetes Service (AKS) cluster. The pods require access to an Azure Machine Learning workspace data store via managed identity without storing credentials in code. Which Kubernetes feature should you configure?
Azure AD Workload Identity integrates Kubernetes service accounts with Azure AD managed identities securely.
Why this answer
Azure AD Workload Identity enables Kubernetes service accounts to securely connect to Azure cloud resources using Azure AD managed identities.
You are optimizing an AI model container image size. Which technique is most effective for reducing the footprint of an image based on a large Python deep learning framework?
This discards build-time compilers and source code, significantly shrinking the image.
Why this answer
Multi-stage builds allow you to keep only the runtime dependencies in the final image, excluding build-time tools.
You are troubleshooting an AI inference container in Azure Container Apps that fails to start because it cannot pull the base image from Azure Container Registry. Authentication fails with an unauthorized error. What is the recommended way to grant the Container App access to ACR?
Managed identities eliminate stored credentials and securely authenticate Container Apps to ACR.
Why this answer
Enabling a managed identity on the Container App and granting it the AcrPull role on the Azure Container Registry is the secure, modern authentication approach.
You are deploying a distributed PyTorch training job across multiple nodes in an Azure Kubernetes Service (AKS) cluster. Which mechanism should you use to facilitate high-speed, low-latency inter-node communication required for gradient synchronization?
Using specialized GPU VMs equipped with SR-IOV and InfiniBand provides the high throughput needed for distributed gradient sync.
Why this answer
Distributed deep learning frameworks require low-latency networks; InfiniBand or high-performance SR-IOV enabled GPU VMs (like ND-series) with MPI are standard. In AKS, Azure CNI with appropriate networking and node selection enables high-performance setups.
You have an AI model container that takes 10 seconds to load weights into memory upon startup. Users report HTTP 503 errors immediately after deployment because traffic is routed to the container before it is ready. Which probe should you configure?
A startup probe tells the orchestrator that the application is still initializing, preventing premature traffic routing.
Why this answer
A startup probe in Kubernetes or Container Apps delays liveness and readiness checks until the application has fully initialized.
Your data science team pushes container images to Azure Container Registry (ACR). You need to ensure that every image pushed is automatically scanned for known vulnerabilities before being deployed to production. Which ACR feature should you enable?
Defender for Cloud scans images pushed to ACR for Common Vulnerabilities and Exposures (CVEs).
Why this answer
Microsoft Defender for Cloud integrates with ACR to provide vulnerability scanning for container images upon push or import.
You are deploying an AI model to AKS that requires a specific kernel module. What is the recommended strategy to ensure the node has this module?
A privileged DaemonSet or InitContainer can load kernel modules if permissions allow.
Why this answer
Using a Custom Node Image or a DaemonSet to load the module is the standard way to handle kernel dependencies.
Which THREE of the following are benefits of using ACR Tasks for containerized AI workloads?
Keeps AI images patched automatically.
Why this answer
ACR Tasks automate builds, secure workflows, and integrate with source control triggers.
You are optimizing a large language model container inference deployment on AKS using GPU-enabled nodes (NC-series). The inference server experiences frequent out-of-memory errors on the GPU device itself during high context lengths. Which Kubernetes configuration metric should you monitor and alert on?
NVIDIA DCGM exporter tracks GPU-specific memory consumption metrics directly.
Why this answer
Monitoring NVIDIA GPU memory usage via DCGM (Data Center GPU Manager) metrics in Prometheus/Grafana is critical for detecting GPU out-of-memory errors.
You need to store sensitive database connection strings and AI API keys used by containerized applications running in Azure Container Apps. Which feature should you use to securely store and reference these values?
Container App secrets securely store sensitive data that can be referenced as environment variables.
Why this answer
Azure Container Apps supports built-in secrets management, allowing secure storage and referencing of sensitive configuration data.
Which command-line interface tool is used to deploy and manage container images directly to Azure Container Registry?
az acr is the Azure CLI module for ACR.
Why this answer
The Azure CLI (az acr) is the standard tool for managing ACR resources.
You are managing an AKS cluster and need to ensure that GPU driver updates do not disrupt running AI inference workloads. Which AKS feature helps manage GPU operator lifecycle and driver installation?
The NVIDIA GPU Operator manages GPU drivers, CUDA software, and device plugins automatically on Kubernetes.
Why this answer
AKS supports automated GPU driver installation and management using GPU-optimized node image SKUs and the NVIDIA GPU Operator.
You are configuring an Azure Container Apps environment with a custom Virtual Network. Your AI containers need to securely connect to an Azure SQL Database that is secured behind a private endpoint. Which configuration is required on the Container Apps environment?
Integrating Azure Container Apps into a custom VNet allows resolution and routing to private endpoints.
Why this answer
To communicate with private endpoints within a VNet, Azure Container Apps must be deployed within a custom virtual network with a dedicated subnet.
You are deploying a high-performance AI model in AKS. You need to ensure the container has access to the underlying host's NVIDIA GPU. What must be configured in the Pod spec?
This resource request is required for the NVIDIA device plugin to assign a GPU to the pod.
Why this answer
The pod must request 'nvidia.com/gpu' resources to ensure the scheduler places it on a GPU node and mounts the drivers.
You are setting up auto-scaling for a containerized AI web app in Azure Container Apps. You want to scale based on the number of concurrent HTTP requests. Which scaler do you use?
The HTTP scaler allows scaling based on request concurrency.
Why this answer
The 'http' scaler in KEDA (integrated in ACA) is specifically designed to scale based on HTTP traffic.
You notice that your AKS pods are stuck in 'ContainerCreating' state. You check the events and see 'FailedMount'. What is the most likely cause?
FailedMount is the standard error when a volume cannot be mounted.
Why this answer
FailedMount typically occurs when a requested volume (like a PVC or Secret) cannot be attached or accessed.
Which TWO of the following are valid ways to authenticate an AKS cluster to an Azure Container Registry?
Preferred modern method.
Why this answer
Managed Identity and Service Principals are the two standard ways for AKS to authenticate to ACR.
Which TWO of the following features help manage traffic to containerized applications?
Provides traffic splitting and mTLS.
Why this answer
Ingress controllers and Service Mesh (like Istio) are the standard tools for traffic management.
Which TWO of the following techniques help optimize the performance of containerized AI models in AKS?
Ensures optimal resource utilization.
Why this answer
Resource tuning and node selection are the most effective ways to optimize performance.
You are integrating Azure Container Registry with Azure Kubernetes Service. You want to enable authentication without storing static credentials (username/password) in Kubernetes secrets. What is the recommended integration method?
ACR-AKS integration automatically configures the kubelet identity with Reader/AcrPull permissions on the registry.
Why this answer
Attaching an ACR to an AKS cluster using 'az aks update --attach-acr' automatically grants the AKS kubelet managed identity permissions to pull images from the registry.
You have an AI scoring script that runs periodically. You want to execute this containerized workload on a schedule without managing virtual machines. Which Azure service is best suited for running containerized batch jobs on a schedule?
Container Apps Jobs are specifically designed for scheduled or triggered task execution to completion.
Why this answer
Azure Container Apps Jobs allow you to run containerized batch tasks triggered on a schedule, on-demand, or via events.
You have an AI model container hosted in Azure Container Registry. You want to ensure that every container image pushed to the registry is automatically scanned for known vulnerabilities before deployment. Which ACR feature should you enable?
Defender for Cloud scans images pushed to ACR for Common Vulnerabilities and Exposures (CVEs).
Why this answer
Microsoft Defender for Cloud integrates with Azure Container Registry to provide vulnerability scanning for container images upon push or import.
You want to limit the CPU resources that a specific AI inference pod can consume. Which Kubernetes field do you configure?
Limits provide the hard ceiling for resource usage.
Why this answer
The 'resources.limits' field in the container spec defines the maximum CPU and memory a pod can use.
You are deploying an AI model container in Azure Container Apps. Which TWO authentication mechanisms can you configure for securely pulling the image from a private Azure Container Registry?
Admin credentials can be supplied directly in the container app registry settings.
Why this answer
Container Apps can authenticate to ACR using either a managed identity or registry administrator credentials.
Your team pushes custom AI model container images to Azure Container Registry (ACR). Company policy states that all container images must be automatically scanned for Common Vulnerabilities and Exposures (CVEs) upon push. Which ACR service tier must you use to meet this requirement using Microsoft Defender for Cloud?
The Premium tier is required to integrate Microsoft Defender for Cloud vulnerability assessments for container images.
Why this answer
Vulnerability scanning integrated with Microsoft Defender for Cloud requires the Premium tier of Azure Container Registry.
You are deploying an AI model container to Azure Container Apps. The container application needs to securely connect to an Azure SQL Database without storing plain-text database credentials in environment variables or application code. What is the recommended feature to use?
Azure Container Apps natively supports referencing Azure Key Vault secrets securely using a managed identity.
Why this answer
Managed identities for Azure resources allow Azure Container Apps to authenticate to Azure services that support Azure AD authentication without embedding credentials in code or configuration.
You are configuring an Azure Kubernetes Service (AKS) cluster to host GPU-accelerated AI model inference workloads using NVIDIA GPUs. Which component must you install in the cluster to enable containerized workloads to utilize the GPU nodes?
The NVIDIA GPU Operator automates the installation of GPU drivers, container runtime, and device plugins required for AKS GPU nodes.
Why this answer
The NVIDIA GPU Operator automates the management of all NVIDIA software components needed to provision GPUs in Kubernetes.
You are configuring secure ingress and network isolation for an Azure Container Apps environment. Which THREE capabilities are supported when configuring networking for Container Apps? (Choose three.)
Ingress can be configured as external for public access or internal for VNet-only private access.
Why this answer
Azure Container Apps supports custom domain bindings with managed certificates, integration into a pre-existing Virtual Network (VNet), and internal/external ingress configuration.
You are using Azure Container Apps to host a web API for an AI model. You want to ensure that only authorized traffic reaches the container. How should you secure the endpoint?
ACA provides built-in authentication integration for ingress.
Why this answer
Container Apps can be placed in a VNET or use 'Ingress' settings with 'Authentication' enabled (e.g., Azure AD).
You want to track the latency of your model inference API in production. Which Azure tool should you integrate into your containerized application?
App Insights tracks request latency and performance.
Why this answer
Application Insights is the standard for monitoring performance metrics and telemetry in Azure.
You are troubleshooting high latency in an AI inference workload on AKS. You suspect the issue is caused by container startup time (cold starts). Which feature helps mitigate this?
Artifact streaming allows containers to start before the image is fully pulled.
Why this answer
Image Pull Secrets and ACR 'Artifact Streaming' (or pre-pulling images) are designed to reduce startup latency.
You are troubleshooting a containerized AI model deployment in Azure Container Apps that fails to pass its HTTP readiness probe. You need to inspect the container logs and runtime diagnostics. Which THREE tools or commands can you use to troubleshoot this issue? Each correct answer presents a complete solution.
The Azure Portal provides a built-in interactive console to connect directly to a running container revision for troubleshooting.
Why this answer
To troubleshoot Azure Container Apps, you can use the Azure CLI command 'az containerapp logs show', inspect the Log Analytics workspace where system and console logs are streamed, or use the Azure Portal Container Apps console diagnostic tools.
You need to deploy a set of batch AI processing containers in Azure Container Instances that run to completion and then terminate. Which container group restart policy should you select?
Setting restart policy to Never ensures the container does not restart after completing its task.
Why this answer
For batch jobs that run to completion and stop, the restart policy should be set to Never or OnFailure.
You are configuring TLS termination for an AI model API hosted in Azure Container Apps using a custom domain name. Where must you upload or configure the custom SSL certificate?
Container Apps supports binding custom SSL certificates managed directly within the app's custom domain settings.
Why this answer
Custom domain certificates in Azure Container Apps are managed via the custom domains and certificates blade of the Container App resource.
Which Azure feature allows you to scan images in your registry for vulnerabilities before deploying them to your production cluster?
Defender provides vulnerability scanning for images in ACR.
Why this answer
Microsoft Defender for Containers (formerly Defender for ACR) provides scanning for images in ACR.
You are deploying an AI model container to Azure Container Apps. The container requires persistent storage to cache downloaded Hugging Face model weights across container restarts. Which storage type should you attach to the Container App?
Mounting an Azure Files share provides shared, persistent filesystem storage accessible by container replicas.
Why this answer
Azure Container Apps supports mounting Azure Files shares as volumes for persistent storage across container lifecycles.
You are deploying a custom PyTorch model container image to Azure Container Apps. The container needs to scale out based on HTTP concurrent requests. Which built-in scale rule type should you configure in Azure Container Apps?
The http scale rule scales container replicas based on concurrent HTTP requests.
Why this answer
Azure Container Apps supports a built-in HTTP scale rule that scales applications based on the number of concurrent HTTP requests per replica.
You are deploying an AI workload to Azure Container Apps. You need to ensure the container scales down to zero when there is no traffic. What should you configure?
Setting min-replicas to 0 allows for scale-to-zero.
Why this answer
Setting the min-replicas to 0 enables scale-to-zero in ACA.
Your organization requires that container images stored in Azure Container Registry (ACR) comply with security standards. Which TWO actions can you take to secure container images in ACR? (Choose two.)
Defender for Cloud scans container images for vulnerabilities upon push.
Why this answer
Securing ACR involves enabling vulnerability scanning via Microsoft Defender for Cloud and enforcing content trust / image signing.
You are designing a secure MLOps pipeline using Azure Container Registry. Which THREE practices should you implement to secure your AI container images?
Managed identities eliminate hardcoded static credentials.
Why this answer
Securing container images in ACR involves vulnerability scanning, access control with managed identities, and content signing.
Ready to test yourself?
Try a timed practice session using only Containerized Ai Workloads questions.