You save $69.98
A stakeholder asks whether the proposed configuration guarantees: centralize image storage and authorize limited pull/push operations for separate build and runtime identities. What qualification is technically accurate?
Registry access does not guarantee images are safe; signing, scanning and trusted build provenance remain separate concerns. That remains a practical service boundary even after the recommended change (create an Azure Container Registry with role-based access and compatible image publishing and pulling credentials) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Attempt an image push with the pull-only identity and verify denial' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Registry access does not guarantee images are safe; signing, scanning and trusted build provenance remain separate concerns.
The two checks cover separate behavior: 'Attempt an image push with the pull-only identity and verify denial' and 'Pull a tagged image using the intended runtime identity'. Neither check removes the remaining operational limitation: Registry access does not guarantee images are safe; signing, scanning and trusted build provenance remain separate concerns.
The incident (a deployed runtime cannot pull its private image although the build pipeline pushed it successfully) could recur if a related Azure dependency changes. The design still faces the limitation: Registry access does not guarantee images are safe; signing, scanning and trusted build provenance remain separate concerns.
An Azure administrator must resolve a specific request: A web API packed as a container must scale based on HTTP demand and support revision-based rollouts. The expected outcome is: run a managed container app with built-in ingress and autoscaling rules. Which option is appropriate?
Container Apps supports managed ingress and autoscaling while exposing revision management for application delivery. This achieves run a managed container app with built-in ingress and autoscaling rules through deploy Azure Container Apps with the appropriate ingress, revisions and scaling configuration instead of relying on merely similar resource settings.
ACI does not offer the same revision/ingress autoscale model; that would not meet run a managed container app with built-in ingress and autoscaling rules, for which the relevant Azure action is deploy Azure Container Apps with the appropriate ingress, revisions and scaling configuration.
Locks restrict management changes, not autoscale capacity; that would not meet run a managed container app with built-in ingress and autoscaling rules, for which the relevant Azure action is deploy Azure Container Apps with the appropriate ingress, revisions and scaling configuration.
Storage lifecycle rules do not control compute replicas; that would not meet run a managed container app with built-in ingress and autoscaling rules, for which the relevant Azure action is deploy Azure Container Apps with the appropriate ingress, revisions and scaling configuration.
Operations sees an unexpected outcome: Traffic spikes cause timeouts because the container app remains at a replica limit of one. The original demand was: run a managed container app with built-in ingress and autoscaling rules. Which cause is most consistent with the evidence?
The trace reports: Traffic spikes cause timeouts because the container app remains at a replica limit of one. The causal misconfiguration is: The configured scaling rule or maximum replica capacity is too restrictive for demand. The targeted action is to set appropriate min/max replicas and HTTP scaling thresholds for the Container App.
The proposed mechanism concerns the container app successfully scales above one healthy replica during the observed traffic spike, which is not established by the observed traffic spikes cause timeouts because the container app remains at a replica limit of one. Test the more directly supported condition: The configured scaling rule or maximum replica capacity is too restrictive for demand.
The image build embedded plaintext secret values instead of injecting them at runtime; that mechanism would be more consistent with an observation such as a scanner finds a production database password in the distributed container image history, rather than this case's traffic spikes cause timeouts because the container app remains at a replica limit of one.
The runtime identity lacks required registry pull authorization or network access to ACR; that mechanism would be more consistent with an observation such as a deployed runtime cannot pull its private image although the build pipeline pushed it successfully, rather than this case's traffic spikes cause timeouts because the container app remains at a replica limit of one.
A service owner needs a practical fix after this failure: Traffic spikes cause timeouts because the container app remains at a replica limit of one. What is the best remediation?
Set appropriate min/max replicas and HTTP scaling thresholds for the Container App. This addresses the documented failure condition: the configured scaling rule or maximum replica capacity is too restrictive for demand. Retest the affected operation and retain the original least-privilege boundaries.
Locks restrict management changes, not autoscale capacity. In the reported incident (traffic spikes cause timeouts because the container app remains at a replica limit of one), that change would not correct the cause: the configured scaling rule or maximum replica capacity is too restrictive for demand.
Storage lifecycle rules do not control compute replicas. In the reported incident (traffic spikes cause timeouts because the container app remains at a replica limit of one), that change would not correct the cause: the configured scaling rule or maximum replica capacity is too restrictive for demand.
ACI does not offer the same revision/ingress autoscale model. In the reported incident (traffic spikes cause timeouts because the container app remains at a replica limit of one), that change would not correct the cause: the configured scaling rule or maximum replica capacity is too restrictive for demand.
A deployment claims to meet: run a managed container app with built-in ingress and autoscaling rules. The environment is: A web API packed as a container must scale based on HTTP demand and support revision-based rollouts. Which TWO test results would substantiate that claim? Select TWO answers.
Generate test HTTP load and observe replica changes and response health. This supplies observed evidence for run a managed container app with built-in ingress and autoscaling rules. It is not interchangeable with the second required check, deploy a new revision and verify traffic allocation and rollback work, because that checks a separate success or failure boundary.
Deploy a new revision and verify traffic allocation and rollback work. This supplies observed evidence for run a managed container app with built-in ingress and autoscaling rules. It is not interchangeable with the second required check, generate test HTTP load and observe replica changes and response health, because that checks a separate success or failure boundary.
A privileged administrator in a different subscription may succeed at 'Generate test HTTP load and observe replica changes and response health' even though the intended caller fails. This does not prove the required behavior for generate test http load and observe replica changes and response health.
A release checklist recording 'Deploy a new revision and verify traffic allocation and rollback work' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must deploy a new revision and verify traffic allocation and rollback work on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise generate test HTTP load and observe replica changes and response health on the affected Azure deployment.
An infrastructure design was selected to meet: run a managed container app with built-in ingress and autoscaling rules. What caveat remains relevant during operation?
Managed scaling is subject to quotas, cold starts and application readiness, so it is not an absolute latency guarantee. That remains a practical service boundary even after the recommended change (deploy Azure Container Apps with the appropriate ingress, revisions and scaling configuration) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Generate test HTTP load and observe replica changes and response health' and 'Deploy a new revision and verify traffic allocation and rollback work'. Neither check removes the remaining operational limitation: Managed scaling is subject to quotas, cold starts and application readiness, so it is not an absolute latency guarantee.
The incident (traffic spikes cause timeouts because the container app remains at a replica limit of one) could recur if a related Azure dependency changes. The design still faces the limitation: Managed scaling is subject to quotas, cold starts and application readiness, so it is not an absolute latency guarantee.
The successful check 'Generate test HTTP load and observe replica changes and response health' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Managed scaling is subject to quotas, cold starts and application readiness, so it is not an absolute latency guarantee.
An Azure operations team is evaluating a proposed change: An Azure Container Apps service has two healthy revisions and the team wants a staged release without shifting every client at once. It must achieve: route a controlled percentage of inbound traffic to the newly deployed revision. Which solution fits the stated boundary?
Weighted revision routing lets a new version receive a subset of traffic while the stable revision continues serving requests. This achieves route a controlled percentage of inbound traffic to the newly deployed revision through configure multiple active revisions and explicit traffic weights for the Container App instead of relying on merely similar resource settings.
VMSS scaling is not Container Apps revision traffic routing; that would not meet route a controlled percentage of inbound traffic to the newly deployed revision, for which the relevant Azure action is configure multiple active revisions and explicit traffic weights for the Container App.
Deactivation removes the desired rollback-serving path; that would not meet route a controlled percentage of inbound traffic to the newly deployed revision, for which the relevant Azure action is configure multiple active revisions and explicit traffic weights for the Container App.
Subscription names cannot implement HTTP traffic splitting; that would not meet route a controlled percentage of inbound traffic to the newly deployed revision, for which the relevant Azure action is configure multiple active revisions and explicit traffic weights for the Container App.
During incident triage, the cloud team observes: All requests shift to the new revision despite a planned small canary rollout. The goal was: route a controlled percentage of inbound traffic to the newly deployed revision. Which configuration mistake most directly explains it?
The trace reports: All requests shift to the new revision despite a planned small canary rollout. The causal misconfiguration is: The app is using an incompatible revision mode or lacks the intended traffic-weight configuration. The targeted action is to enable an appropriate multiple-revision strategy and assign intended stable/canary weights.
The runtime identity lacks required registry pull authorization or network access to ACR; that mechanism would be more consistent with an observation such as a deployed runtime cannot pull its private image although the build pipeline pushed it successfully, rather than this case's all requests shift to the new revision despite a planned small canary rollout.
The ACI container group image reference or startup command is incorrect; that mechanism would be more consistent with an observation such as the scheduled job never starts because the container group has an invalid image or command configuration, rather than this case's all requests shift to the new revision despite a planned small canary rollout.
The configured scaling rule or maximum replica capacity is too restrictive for demand. That mechanism would be more consistent with an observation such as traffic spikes cause timeouts because the container app remains at a replica limit of one, rather than this case's all requests shift to the new revision despite a planned small canary rollout.
A production configuration must be repaired: All requests shift to the new revision despite a planned small canary rollout. Which corrective action should the administrator take?
Enable an appropriate multiple-revision strategy and assign intended stable/canary weights. This addresses the documented failure condition: the app is using an incompatible revision mode or lacks the intended traffic-weight configuration. Retest the affected operation and retain the original least-privilege boundaries.
VMSS scaling is not Container Apps revision traffic routing. In the reported incident (all requests shift to the new revision despite a planned small canary rollout), that change would not correct the cause: the app is using an incompatible revision mode or lacks the intended traffic-weight configuration.
Subscription names cannot implement HTTP traffic splitting. In the reported incident (all requests shift to the new revision despite a planned small canary rollout), that change would not correct the cause: the app is using an incompatible revision mode or lacks the intended traffic-weight configuration.
Deactivation removes the desired rollback-serving path. In the reported incident (all requests shift to the new revision despite a planned small canary rollout), that change would not correct the cause: the app is using an incompatible revision mode or lacks the intended traffic-weight configuration.
Before accepting the rollout, the administrator reviews: An Azure Container Apps service has two healthy revisions and the team wants a staged release without shifting every client at once. It must accomplish: route a controlled percentage of inbound traffic to the newly deployed revision. Which TWO independent checks matter most? Select TWO answers.
Send representative requests and inspect routing distribution by revision. This supplies observed evidence for route a controlled percentage of inbound traffic to the newly deployed revision. It is not interchangeable with the second required check, shift weights back to the stable revision and confirm the rollback path, because that checks a separate success or failure boundary.
Shift weights back to the stable revision and confirm the rollback path. This supplies observed evidence for route a controlled percentage of inbound traffic to the newly deployed revision. It is not interchangeable with the second required check, send representative requests and inspect routing distribution by revision, because that checks a separate success or failure boundary.
A release checklist recording 'Shift weights back to the stable revision and confirm the rollback path' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must shift weights back to the stable revision and confirm the rollback path on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The required check must exercise send representative requests and inspect routing distribution by revision on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Send representative requests and inspect routing distribution by revision' even though the intended caller fails. This does not prove the required behavior for send representative requests and inspect routing distribution by revision.
An Azure administrator describes a solution for: route a controlled percentage of inbound traffic to the newly deployed revision. What remaining limitation must not be misrepresented?
Traffic weighting is approximate over samples and does not substitute for readiness and integration checks. That remains a practical service boundary even after the recommended change (configure multiple active revisions and explicit traffic weights for the Container App) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (all requests shift to the new revision despite a planned small canary rollout) could recur if a related Azure dependency changes. The design still faces the limitation: Traffic weighting is approximate over samples and does not substitute for readiness and integration checks.
The successful check 'Send representative requests and inspect routing distribution by revision' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Traffic weighting is approximate over samples and does not substitute for readiness and integration checks.
The two checks cover separate behavior: 'Send representative requests and inspect routing distribution by revision' and 'Shift weights back to the stable revision and confirm the rollback path'. Neither check removes the remaining operational limitation: Traffic weighting is approximate over samples and does not substitute for readiness and integration checks.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
