Troubleshooting practice questions

Azure Network Watcher.

Why it fails: Azure Network Watcher diagnoses network connectivity, latency and traffic flows between endpoints, not disk throughput. It is tempting because latency is the symptom, but confirming storage IOPS limits requires VM-level metrics such as Azure Monitor's disk performance counters for the virtual machine.

Azure Resource Graph Explorer.

Why it fails: Azure Resource Graph Explorer queries resource configuration and metadata across subscriptions, returning inventory-style results rather than live performance telemetry. It is tempting for auditing deployed resources, but storage IOPS metrics require Azure Monitor metrics or VM diagnostics, which record actual disk read/write operations per second.

Application Insights Dependency logs.

Why it fails: Application Insights Dependency logs record outbound calls made by instrumented application code, not hypervisor-level disk throughput, so they cannot expose the VM's storage IOPS ceiling. It is tempting because dependency telemetry does surface latency, but that reflects application-to-service calls; host storage metrics require Azure Monitor VM diagnostics or Metrics Explorer.

Verify the AMQP listener port 5671 firewall rules on the function app.

Why it fails: Event Grid delivers events over HTTPS webhooks, not AMQP, so port 5671 firewall rules are irrelevant to event delivery. It is tempting because AMQP 5671 is the standard port for Service Bus and Event Hubs, and verifying it would be correct when troubleshooting those AMQP-based services.

Review Service Bus session lock renewal logs.

Why it fails: Service Bus session lock renewal logs relate to Service Bus queues, not Event Grid subscriptions, so they reveal nothing about event delivery. It is tempting because session locks are a genuine troubleshooting area, and reviewing them would be correct when diagnosing a Service Bus-triggered function with session-enabled queues.

Check Event Hubs consumer group checkpoint offset status.

Why it fails: Event Hubs consumer group checkpoints track offset progress for Event Hubs streams, not Event Grid subscriptions, so this reveals nothing about the failing trigger. It is tempting because checkpoint lag genuinely diagnoses missed events — but only when Event Hubs, not Event Grid, delivers them.

Execute az aks browse to open the Kubernetes dashboard.

Why it fails: Azure Container Apps does not expose a Kubernetes API, so az aks browse has no cluster to connect to and returns an authentication or connection failure. It is tempting because Container Apps runs on Kubernetes underneath, but the dashboard would be correct when troubleshooting an AKS cluster directly.

Use kubectl describe pod to inspect Kubernetes events.

Why it fails: Container Apps abstracts the underlying Kubernetes control plane, so no pod objects are exposed and kubectl describe pod cannot reach the environment. It is tempting because the platform is Kubernetes-based, but kubectl describe pod would be correct when diagnosing pods in an AKS cluster you administer.

Disable the Application Insights telemetry client entirely in production to save bandwidth.

Why it fails: Disabling the telemetry client removes the very error and request data the scenario requires, so failures go unrecorded. It is tempting when bandwidth or ingestion cost is the concern, and disabling telemetry would suit an offline or air-gapped workload where no Application Insights resource exists.

Route all application logs exclusively to local text files on ephemeral container storage.

Why it fails: Ephemeral container storage is destroyed on restart, so logs vanish before troubleshooting and never reach Application Insights. Local file logging is tempting for low-latency debugging on a developer workstation, but the scenario requires centralised, queryable telemetry across instances.

Store plain-text passwords in telemetry custom dimensions.

Why it fails: Custom dimensions are transmitted to Application Insights and readable by anyone with access, so plain-text passwords become a credential leak. Storing secrets in telemetry is tempting for correlating authentication failures, but secrets belong in Azure Key Vault, referenced by identifier rather than logged.

Convert all vector fields to Edm.String

Why it fails: Edm.String cannot hold vector embeddings, so indexers would fail to populate vector fields and the timeout would persist. Converting to string is tempting when troubleshooting field-type mismatches, and it would be correct if the index schema wrongly declared vector data as text rather than the indexer exceeding its scheduled window on large PDFs.

Switch the search service to the Free tier

Why it fails: The Free tier caps index size, document counts and indexer runtime, so it would worsen the timeout rather than resolve it. Downgrading is tempting when reducing cost, and it would be correct if the workload fitted free-tier limits, but large PDF processing needs the higher throughput and quotas of a paid tier.

Delete all semantic configurations from the index

Why it fails: Semantic configurations affect query ranking at search time, not indexer document-processing throughput, so removing them leaves the timeout unchanged. Deleting them is tempting when trimming index complexity, and it would be correct if semantic reranking were causing slow queries rather than the indexer failing to finish within its scheduled window.

Replace all vector fields with standard ASCII folding tokenizers

Why it fails: ASCII folding tokenisers are lexical text analysers applied to searchable string fields; they cannot represent vector embeddings, so replacing vector fields destroys similarity search. It is tempting because tokeniser tuning genuinely improves keyword query latency, and it would be correct for optimising a lexical text index rather than a vector workload.

Configure the index to use exhaustive KNN exclusively for high-QPS production workloads

Why it fails: Exhaustive KNN scans the entire vector index per query, so latency and cost scale linearly with index size, capping throughput under high QPS. It is tempting because exhaustive search maximises recall, and it would be correct for low-volume workloads where accuracy outweighs latency.

In the Azure Container Registry webhook configuration

Why it fails: Registry webhooks fire notifications on image push, pull or delete events; they carry no runtime resource settings, so memory cannot be adjusted there. It is tempting because the image itself lives in the registry, but container CPU and memory allocations are configured in the Container App's container resource definition.

In the Azure Virtual Network route table settings

Why it fails: Route tables control packet forwarding between subnets and appliances; they hold no container resource settings, so memory cannot be adjusted there. It is tempting because networking is configured per Container App environment, but CPU and memory allocations belong in the Container App's container resource definition.

In the Azure Monitor diagnostic settings export destination

Why it fails: Diagnostic settings export platform logs and metrics to destinations such as Log Analytics; they hold no container resource configuration, so memory cannot be set there. It is tempting because Azure Monitor surfaces the OOM evidence, but allocations belong in the Container App's container resource definition (CPU and memory per container).

Enable Geo-Disaster Recovery to force the secondary region to sync historical logs.

Why it fails: Geo-Disaster Recovery performs metadata replication and namespace failover between regions; it does not expose historical events for replay and would redirect consumers entirely. It is the right feature for regional outage resilience, not for rewinding a stream two hours.

Delete the existing consumer group and recreate it with a 2-hour retention limit.

Why it fails: Recreating a consumer group resets its offsets to the stream start or end, and retention is a namespace or event-hub setting, not a per-group limit. This suits deliberately restarting processing from scratch, not temporarily replaying two hours while preserving current offsets.

Purge all messages from the Event Hub using the Azure CLI az eventhubs purge command.

Why it fails: Purging deletes events permanently, so the two-hour-old backlog is destroyed rather than replayed, and it cannot restore offsets. It is tempting as a quick way to clear a stuck queue, and would suit discarding poisoned or expired events when retention is no longer needed.

Kubenet with host-port mapping

Why it fails: Kubenet performs overlay routing with NAT, adding encapsulation hops rather than direct pod-to-pod paths. It is tempting because kubenet with host-port mapping is a supported AKS configuration, but it suits clusters needing simple, low-address-consumption networking, not minimal-hop routing.

Kubenet with basic Linux bridge

Why it fails: Kubenet routes pod traffic through user-defined routes and a Linux bridge, adding the extra hops the scenario seeks to eliminate. It is tempting because kubenet is a simple, long-standing AKS option, and would suit clusters where direct pod-to-pod routing and IP-per-pod addressing are not required.

Azure CNI Overlay

Why it fails: Azure CNI Overlay encapsulates pod traffic in an overlay tunnel, so packets still traverse extra hops rather than routing directly. It is tempting because Overlay conserves VNet IP space for large clusters, and would be correct where address exhaustion, not latency, is the binding constraint.

System Assigned Managed Identity Success Rate

Why it fails: System Assigned Managed Identity Success Rate reports authentication success for a managed identity, not token throughput against Azure OpenAI's tokens-per-minute quota. It is tempting because 429s can stem from authentication issues, but it would be the correct metric when diagnosing managed identity authentication failures.

Virtual Network Gateway Packet Drops

Why it fails: Virtual Network Gateway Packet Drops measures dropped packets on VPN or ExpressRoute gateways, unrelated to Azure OpenAI token consumption. It is tempting because 429s are HTTP errors and network metrics seem diagnostic, but it would be the correct metric when troubleshooting connectivity loss through a gateway.

Data Ingestion Volume (GB)

Why it fails: Data Ingestion Volume (GB) tracks data uploaded into a Log Analytics workspace, not token consumption against an Azure OpenAI deployment's rate limit. It is tempting because it measures data volume, but it would be the correct metric when monitoring workspace ingestion costs or quotas.

Configuring Vertical Pod Autoscaler.

Why it fails: Vertical Pod Autoscaler adjusts CPU and memory requests based on observed usage, which affects scheduling and runtime resources, not the time taken to start a container. It would be correct if pods were repeatedly evicted or under-resourced during steady-state inference.

Increasing the memory limit for the pod.

Why it fails: Raising the memory limit addresses runtime memory pressure, not the image pull and container initialisation delay that defines cold starts. It would be correct if pods were being OOM-killed or throttled during inference, which the stem's startup-time suspicion does not describe.

Using a smaller base OS distribution.

Why it fails: A smaller base OS reduces image size and pull time, but cold-start latency in AI inference is dominated by model loading and container initialisation, not OS footprint. It would be correct if the bottleneck were image download over a constrained registry link rather than startup processing.

Delete all log analytics workspaces weekly.

Why it fails: Deleting Log Analytics workspaces weekly destroys the telemetry, query history and alert rules that observability depends on, leaving no retained data for trend analysis or incident investigation. It is tempting because workspace retention does incur storage cost, and trimming retention policies would be the correct way to control that spend.

Rely solely on manual user bug reports without automated telemetry.

Why it fails: Manual bug reports are anecdotal, delayed and incomplete, giving no metrics, traces or alerting on model latency, token usage or failure rates in production. They are tempting because user feedback does surface real quality issues, and would be the correct supplement once automated telemetry already covers the application.

Disable all diagnostic logging to reduce storage overhead.

Why it fails: Disabling diagnostic logging removes the request, dependency and trace data needed to detect failures and diagnose incidents, so production issues become invisible. It is tempting because log ingestion drives storage and workspace costs, and sampling or setting retention limits would be the correct way to reduce that overhead.

Azure Cost Management amortization tables

Why it fails: Cost Management amortisation tables record resource spend and reservation usage, not token-acquisition telemetry, so they contain no HTTP status codes or error descriptions. It is tempting because Log Analytics does host cost data, but that is for billing analysis; token errors require the AADServicePrincipalSignInLogs or similar sign-in table.

Azure Storage blob access audit logs

Why it fails: Blob access audit logs record storage operations, not token acquisition requests, so they contain no HTTP status codes from Microsoft Entra ID. It is tempting because Log Analytics aggregates many Azure diagnostic tables, but token errors surface in the AADNonInteractiveUserSignInLogs or Microsoft Entra ID sign-in logs instead.

Azure Key Vault secret version history

Why it fails: Key Vault secret version history tracks secret and key versions, not token requests, so it exposes no HTTP status codes or error descriptions from Microsoft Entra ID. It is tempting because Key Vault stores credentials, but its versioning answers secret-rotation questions; token-acquisition diagnostics live in sign-in logs.

Azure Blob Storage tier status (Hot vs Cool)

Why it fails: Blob Storage access tiers govern object storage cost and retrieval latency, not Cosmos DB vector index traversal, so they cannot explain query degradation. Tiering is tempting because storage performance often affects applications, but the relevant signals are Cosmos DB RU consumption, index latency and vector policy metrics.

App Service SSL certificate expiration date

Why it fails: SSL certificate expiry affects TLS handshakes at the App Service front end, not Cosmos DB vector query execution, so it cannot cause this degradation. Certificate monitoring is tempting because expired certificates commonly break applications, but the correct checks are Cosmos DB request unit charge, indexing latency and query statistics.

Virtual machine CPU core count assigned to the client application

Why it fails: Client-side VM CPU cores affect how fast the calling application issues queries, not the relevance score Azure AI Search computes server-side. It is tempting because under-provisioned clients do cause timeouts and slow responses, and that factor would be correct when troubleshooting client throughput rather than ranking.

Azure Blob Storage container access tier (Hot vs Cool)

Why it fails: Blob Storage access tier affects retrieval cost and latency for indexed content, not the relevance score computed during hybrid semantic ranking. It is tempting because storage tiering genuinely influences indexing throughput and freshness, and that factor would be correct when diagnosing stale or delayed index content.

Network Watcher IP flow logs.

Why it fails: Network Watcher IP flow logs record traffic metadata for network security analysis; they carry no consumption or billing information, so cost monitoring and optimisation are impossible. It is tempting because Network Watcher is a monitoring service, and it would be correct for diagnosing connectivity, traffic filtering and NSG issues.

Application Insights live metrics stream.

Why it fails: Application Insights live metrics stream displays real-time telemetry such as request rates and failures; it exposes no cost or billing data, so it cannot monitor or optimise Azure AI service spend. It is tempting because Application Insights is a monitoring tool, and it would be correct for diagnosing latency and error rates.

Azure Bastion session monitoring logs.

Why it fails: Azure Bastion session monitoring logs capture RDP and SSH session activity for auditing; they contain no usage or billing metrics, so they cannot track or reduce Azure AI service costs. It is tempting because Bastion is a monitoring feature, and it would be correct for auditing secure remote access to virtual machines.

Azure Front Door geo-filtering rules blocking all international DNS queries.

Why it fails: Incorrect. Front Door geo-filtering does not resolve VNet private endpoint routing issues.

Local admin passwords on the App Service worker instances.

Why it fails: Incorrect. App Service is a PaaS offering where customers do not manage OS-level local admin passwords.

Kubernetes standard kube-proxy in IPVS mode only

Why it fails: kube-proxy in IPVS mode handles service load balancing and does not enforce NetworkPolicy objects. It is tempting because IPVS improves service routing performance, and would be correct when tuning kube-proxy load-balancing behaviour rather than filtering inter-pod traffic.

Azure Virtual Network NAT Gateway

Why it fails: NAT Gateway provides outbound SNAT for egress traffic and does not implement pod-level policy enforcement. It is tempting as an Azure networking component in AKS, and would be correct when configuring predictable outbound IP addresses for cluster egress.

Kubenet basic networking without network policies

Why it fails: Kubenet provides basic pod networking without any NetworkPolicy enforcement engine, so policies are silently ignored. It is tempting as the default AKS networking mode, and would be correct for simple clusters where pod-level traffic filtering is not required.

Azure Bastion connection to the container host VM

Why it fails: Azure Bastion provides browser-based RDP or SSH to virtual machines; Container Apps has no host VM you can reach this way. Bastion is correct when troubleshooting a VM's operating system directly, not a serverless container platform's probe configuration.

AKS control plane audit logs

Why it fails: AKS control plane audit logs record Kubernetes API server requests for AKS clusters; Container Apps runs on managed infrastructure where you cannot access that control plane. Audit logs are correct when investigating who changed AKS cluster objects or RBAC, not Container Apps probe failures.

Azure Storage Account blob container metrics

Why it fails: Blob container metrics report storage capacity, transactions and latency, revealing nothing about container health probe failures. Storage metrics are the right tool when diagnosing blob access patterns, throttling or capacity issues, not Container Apps replica or probe behaviour.

Delete all Application Insights workspaces and stop collecting any monitoring telemetry.

Why it fails: Deleting Application Insights workspaces removes the telemetry needed to detect degradation, so reliability cannot be verified or maintained. It is tempting because monitoring ingestion carries real cost, and would be correct only where an alternative observability platform already captures equivalent signals.

Run all development and production workloads on the highest tier enterprise GPUs 24/7 regardless of usage.

Why it fails: Running top-tier GPUs continuously for development and production bills for idle capacity, defeating cost optimisation while adding no reliability benefit. It is tempting because maximum GPU capacity guarantees performance headroom, and would be correct for sustained, latency-critical inference where utilisation genuinely justifies the spend.