CCNA Mlops Infrastructure Questions

Azure Bicep is a declarative domain-specific language that compiles to ARM templates, letting you define the Azure ML workspace and its dependent resources — storage account, Key Vault, Application Insights, container registry — as versioned infrastructure as code, satisfying the stem's requirement for reproducible, template-based workspace provisioning.

A versioned environment asset captures the exact dependencies and base image used for the job. Referencing a specific version ensures that reruns use the same environment even if newer versions are created later. This is a core mechanism for reproducible training in Azure ML and complements code and data versioning.

Azure ML resolves environments by image tag, so pushing a new tag to ACR and refreshing the Environment makes the updated image available. Reusing the old tag leaves the cached image reference unchanged, so training would keep running the previous version.

Azure CLI v2 exposes the ml extension, whose commands create, update, list and archive workspaces, environments, models and datasets. This satisfies the asset-management requirement because it drives the same Azure ML control plane as the studio, scriptable and repeatable.

A Component packages code, environment and inputs into a reusable pipeline step, letting the same logic be invoked across multiple pipelines without duplication. This modular reuse is the defining characteristic distinguishing Components from one-off pipeline steps.

Azure ML Environments package dependencies into a reusable definition referenced across training and scoring. This satisfies the stem's benefit by guaranteeing identical library versions wherever the environment is used, eliminating drift between local experimentation, pipelines and deployed inference endpoints.

Azure Key Vault stores secrets centrally, and Azure Machine Learning retrieves them at runtime through its workspace-linked key vault, injecting values without hardcoding. This satisfies the stem's requirement for scripts to access API keys securely without embedding them.

Azure ML Pipelines model a directed acyclic graph of discrete steps, each with its own inputs, outputs and compute, so data prep, training and evaluation run in dependency order with reusable artefacts. This orchestration is the feature purpose-built for chaining ML steps.

A private endpoint creates a private IP address within your virtual network for the Azure Machine Learning workspace, eliminating public internet exposure entirely. This directly satisfies the requirement that the workspace must not be accessible from the public internet, since traffic traverses the Microsoft backbone network rather than public routes.

A YAML pipeline definition using registered components lets each step specify its own environment with pinned dependencies, providing isolation. The pipeline itself can be registered and versioned in the workspace, and because it references components and environments by name and version, it can be shared and reproduced across workspaces that have access to those assets.

The Model Registry stores registered models with incrementing versions, lineage, tags and stage metadata, enabling reproducible deployment of a specific version. This satisfies the version-history purpose, letting teams retrieve, compare and roll back to any previously registered artefact.

An Azure ML datastore abstracts a storage account into a named, workspace-registered connection, holding the service endpoint and authentication credentials. This satisfies the stem's requirement for a primary function: it lets compute targets and jobs reference Azure Blob, ADLS or file shares without embedding secrets or paths in every script.

Azure Blob Storage is natively supported as an Azure ML Datastore, letting compute targets read and write training data through the workspace's credential-based connection. It satisfies the requirement that the registered storage type be a first-class datastore backend.

Managed online endpoints support multiple deployments behind one endpoint with configurable traffic splits. Creating a new deployment and gradually shifting traffic enables canary-style validation with minimal downtime, and because the original deployment remains intact, you can quickly route traffic back to it if the new model underperforms.

Batch endpoints run asynchronous scoring jobs over large datasets, returning results to a Datastore rather than a synchronous response. They are one of the three Azure Machine Learning endpoint types, alongside online and serverless endpoints.

Application Insights captures request latency, dependency timings and failure telemetry for the deployed model. Reviewing it first shows whether latency originates in the endpoint, the model, or a downstream dependency, giving the diagnostic starting point the question asks for.

Azure ML CLI v2 is declarative YAML executed from a shell, so pipelines can be invoked directly from GitHub Actions, Azure DevOps or Jenkins without bespoke glue code. This native CI/CD integration is the benefit, enabling automated retraining and deployment triggered by repository events.

Application Insights integrates directly with Azure ML, receiving telemetry from deployed endpoints and automatically collecting request latency, failure rates and dependency traces. This satisfies the requirement for automated metrics and logging without custom instrumentation, unlike Log Analytics or Monitor, which require manual wiring.

OIDC enables GitHub Actions to exchange a short-lived federated token for an Azure access token via a federated identity credential, so no secret is stored. This satisfies the no-hardcoded-credentials constraint without managing rotated client secrets.

Experiments group runs, logging each run's metrics, parameters and artefacts so results can be compared side by side in Azure Machine Learning studio. This directly satisfies the requirement to track experiments and compare performance metrics across model training attempts.

Idle shutdown monitors the compute instance for interactive activity and automatically deallocates it after a configured idle period, preventing runaway billing. It directly satisfies the requirement to stop the instance during inactivity without manual intervention.

YAML is the standard declarative format for Azure ML CLI v2 deployment configuration, letting GitHub Actions invoke az ml online-deployment create with a version-controlled spec. This satisfies the stem's automation requirement by defining the deployment reproducibly in CI.

Automated CI/CD pipelines provide repeatable, versioned deployment of models and scoring infrastructure, satisfying the stem's demand for a robust MLOps strategy. They integrate with Azure Machine Learning and Microsoft Entra ID, enabling automated retraining, testing and governed release, which manual processes cannot sustain reliably at scale.

The Azure Machine Learning extension adds pipeline tasks to Azure DevOps, letting build and release pipelines trigger Azure ML jobs, register models and deploy endpoints. Without it, no native Azure ML task exists in the pipeline, so the CI/CD integration fails.

A user-assigned managed identity gives the workspace an Entra ID identity whose credentials Azure manages and rotates, so no secrets are stored. Assigning it the Storage Blob Data Reader role on the Gen2 account satisfies the most-secure-access constraint.

A virtual network is mandatory because the private endpoint must be placed in a subnet within it, letting traffic reach the workspace privately. Without a VNet, no private endpoint can exist, so the Private Link requirement cannot be satisfied.

Azure RBAC allows for granular permissions, specifically who can manage compute clusters.

Managed VNet isolation combined with egress locks blocks outbound traffic from the workspace's managed network, so data cannot leave to unapproved destinations. This directly satisfies the no-egress requirement, which firewall rules alone cannot enforce for managed compute.

Compute clusters scale across multiple nodes, enabling distributed training that a single-node compute instance cannot provide. This directly satisfies the stem's training scenario, where parallelising work across nodes cuts wall-clock time for large models and datasets. Compute instances remain limited to one node, so they cannot deliver this horizontal scaling capability.

Streaming the job's logs exposes the container's stdout and stderr in real time, revealing the exact failure point inside the Docker image without rebuilding or redeploying. This directly satisfies the requirement to investigate a training job failing within a specific container.

The Environment component encapsulates the Docker image plus Conda and pip dependency specifications, so each pipeline step resolves a reproducible runtime. It is the definition element that pins Python packages and Conda dependencies for the job.

Components reference datastore data through declared input paths; if that path is wrong, the step resolves to a nonexistent location and fails at runtime. The datastore itself remains reachable, so the fault lies in the component's path definition rather than connectivity or credentials.

Auto-scaling dynamically adjusts the number of endpoint instances in response to incoming request volume, directly satisfying the sudden traffic-spike requirement. Unlike manual scaling, which fixes capacity at a static instance count, auto-scaling reacts to real-time load metrics, provisioning additional instances during peaks and removing them afterwards to control cost.

Compute Cluster is a valid AML training target: it provisions multi-node CPU or GPU clusters that automatically scale up on job submission and scale down to zero nodes when idle, satisfying the stem's requirement for a scalable, managed training compute target.

Identity-based datastore authentication lets the compute cluster access the storage account using its managed identity, so no account keys are stored in the job script. Using the datastore URI with fsspec or mltable enables streaming reads directly from ADLS Gen2 rather than downloading the entire dataset to local disk, satisfying both the security and streaming requirements.

Training fits model parameters against prepared data to produce a candidate artefact, making it the first lifecycle stage before evaluation, registration and deployment. Azure ML captures it as a job whose outputs feed subsequent stages, satisfying the lifecycle-stage criterion in the stem.

Causes runtime import errors.

Idle time before shutdown directly determines billed node-hours: the cluster keeps nodes running until the idle threshold elapses, so longer idle periods incur more charges. This is a cost lever distinct from node count and VM SKU, which set the hourly rate and scale.

Selecting a VM size with more GPU memory increases available device memory, resolving the out-of-memory failure without altering model code. This satisfies the stem's constraint of fixing the job while leaving the training script unchanged.