DRAG DROP (Drag and Drop is not supported)You deploy an API to Azure Container Apps.The solution must provide the following functionality: ● Support the concurrent activation of multiple application versions. ● Allocate a specific percentage of incoming requests to a secondary version.You need to configure revision behavior.Which configurations should you use? To answer, move the appropriate configurations to the correct requirements. You may use each configuration once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Multiple revisions mode To test a new revision without affecting production traffic, you must configure the Container App to use Multiple active revisions mode and set the traffic allocation for the new revision to 0%.Box 2: Traffic splitting To split traffic between multiple versions, you must switch the container app's revision mode to Multiple revision mode and configure the traffic splitting weights under the Ingress configurations.
https://learn.microsoft.com/en-us/azure/container-apps/revisions-manage
DRAG DROP (Drag and Drop is not supported)You plan to create a Docker image that runs an ASP.NET Core application named ContosoApp. You have a setup script named setupScript.ps1 and a series of application files including ContosoApp.dll.You need to create a Dockerfile document that meets the following requirements: ● Call setupScript.ps1 when the container is built. ● Run ContosoApp.dll when the container starts.The Dockerfile document must be created in the same folder where ContosoApp.dll and setupScript.ps1 are stored.Which five commands should you use to develop the solution? To answer, move the appropriate commands from the list of commands to the answer area and arrange them in the correct order.Select and Place:
Step 1: FROM microsoft/aspnetcore:latest Sets the base image for the container.Base First: You must always declare the base image (FROM) before running any other commands.Step 2: WORKDIR /apps/ContosoApp Creates and sets the working directory inside the container.Directory and Copy: You need to set the working directory (WORKDIR) before copying files (COPY) so Docker knows exactly where to put them.Step 3: COPY ./ . Copies the application files and script from your local folder into the working directory.Step 4: RUN powershell ./setupScript.ps1 Executes the script during the image build process.Build vs. Run: The RUN command happens while building the image, so the script completes its setup before the final image is saved. The CMD instruction does not execute anything during the build; it simply configures the starting point for when the container is actually launched.Step 5: CMD ["dotnet", "ContosoApp.dll"] Defines the default command to run your application when the container starts.
https://azuretar.com/using-startup-command-to-pass-command-line-arguments-to-azure-app-service-for-linux/
DRAG DROP (Drag and Drop is not supported)You are preparing a container image for deployment to production.The container image build and deployment process must ensure the following: ● The image is uniquely versioned. ● Secure authentication is used when pushing the image to Azure Container Registry (ACR). ● The image is stored in ACR for deployment.You need to ensure that the container image build-and-push process meets the requirements.Which action should you perform for each requirement? To answer, move the appropriate actions to the correct requirements. You may use each action once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: use a unique tag for the image You should use a unique tag—such as the Git commit SHA or a semantic version combined with a build number—for each container image deployed to production.Using unique tags ensures that every deployment is traceable, repeatable, and easily rollable back to a specific, immutable state.Box 2: Authenticate to ACR by using Microsoft Entra ID You should authenticate to Azure Container Registry (ACR) using Microsoft Entra ID to ensure secure, role-based, and auditable authentication for production deployments.Eliminates Static Credentials: It replaces long-lived, risky passwords or registry admin keys with short-lived, automatically rotated tokens.Granular Access Control: It leverages Azure Role-Based Access Control (Azure RBAC). You can assign the specific AcrPush role to your deployment identity, satisfying the principle of least privilege.Auditability: Every login and image push action is tied to a specific identity and logged, which is critical for production compliance.Box 3: Push the image to ACR Pushing the built image to ACR satisfies the exact requirement of storing the container image in a secure, private registry for cloud deployment.
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication
DRAG DROP (Drag and Drop is not supported)You plan to deploy a web application to AKS.The solution must: ● Scale out the application by adding more pods during peak CPU usage. ● Expose the application internally within the cluster only.You need to configure a Kubernetes resource for each requirement.Which resources should you configure? To answer, move the appropriate resources to the correct requirements. You may use each resource once, more than once, or not at all. You may need to move the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: HorizontalPodAutoscaler Horizontal Pod Autoscaler (HPA) is the AKS feature to use. It automatically scales the number of pods in a deployment based on observed CPU utilization or other metrics.Box 2: ClusterIP serviceUse a ClusterIP service or internal LoadBalancer with annotations to expose your web application internally within an Azure Kubernetes Service (AKS) cluster only.
https://learn.microsoft.com/en-us/azure/aks/optimize-aks-costs https://learn.microsoft.com/en-us/azure/aks/concepts-network-services
You deploy a new revision of an app in ACA.You need to gradually shift production traffic to the revision while monitoring performance. In addition, you need to be able to quickly roll back.Which two actions should you perform? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,E
To gradually shift traffic and enable fast rollbacks in Azure Container Apps, switch the app to multiple-revision mode and configure percentage-based traffic splitting weights between the active revisions.
https://learn.microsoft.com/en-us/azure/container-apps/traffic-splitting
HOTSPOT (Drag and Drop is not supported)You plan to deploy an Azure Container Apps app named App1. App1 will use an access key to connect to a backend API.The solution must store the key outside of the App1 environment and minimize maintenance efforts.You need to configure secure key storage for App1.Which configurations should you use? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure Key Vault secret. The key should be stored as an Azure Key Vault secret.This option directly satisfies the requirement to store sensitive strings (like access keys or API keys) outside of the application environment. By leveraging Azure Key Vault references in Azure Container Apps, the Container Apps platform automatically pulls the secret value at runtime. If you leave out the specific version tag in the secret URI, Azure Container Apps will automatically fetch the latest version within 30 minutes of a rotation, drastically minimizing ongoing maintenance efforts.Incorrect: Azure Key Vault Key: This is incorrect because Key Vault keys are cryptographic key material used strictly for cryptographic operations (such as encryption, decryption, and signing). They do not return plaintext secret data to your application, making them unsuited for raw API string storage.Azure Container Apps secret: While easy to implement natively, this option stores the key inside the Container App environment scope. It fails the requirement to keep the key entirely separated from the application environment and requires manual application updates if the backend key changes or rotates.Box 2: Managed identity You should use a Managed identity.Zero Secret Lifecycle Management: A managed identity provides an automatically managed identity in Microsoft Entra ID. Azure handles credential rotation automatically, completely eliminating maintenance efforts and the risk of leaked credentials.Native Platform Integration: Azure Container Apps natively supports managed identities to authenticate with Azure Key Vault. You can directly reference Key Vault secrets in your Container App configuration without writing custom authentication code inside the container.
https://learn.microsoft.com/en-us/azure/container-apps/manage-secrets
You have container source code stored in a Git repository.The container registry must automatically build and store a new container image whenever a developer commits code to the Git repository.You must minimize the use of an external build infrastructure.You need to configure Azure Container Registry (ACR) to manage the build process natively and automatically.Which two ACR components should you use? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): A,D
The two components that should be included in the solution are a Source-triggered task and a Webhook.Source-triggered task: This component fulfills the requirement natively within Azure. An Azure Container Registry (ACR) Task can monitor a Git repository (like GitHub or Azure Repos). Whenever a developer commits code, it automatically triggers a native build inside Azure without needing external CI/CD build infrastructure.Webhook: This is the underlying mechanism that connects your Git repository to ACR. When a commit occurs, the Git repository sends a webhook notification to Azure Container Registry to signal the source-triggered task to start building the new image.
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-build-task
DRAG DROP (Drag and Drop is not supported)You have an existing AKS cluster and a container image stored in Azure Container Registry.You must deploy a new version without interrupting traffic.You need to perform a rolling update by using a manifest file.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Step 1: Update the image tag in the deployment manifest This changes the definition file to point to your new version image stored in the Azure Container Registry.Step 2: Apply the updated manifest Running kubectl apply -f <manifest.yaml> triggers Kubernetes to natively initiate a zero-downtime rolling update strategy, incrementally replacing old pods with new ones.Step 3: Verify rollout status Running kubectl rollout status deployment/<deployment-name> allows you to track and ensure the new version deploys successfully without failure.
https://learn.microsoft.com/en-us/azure/aks/tutorial-kubernetes-deploy-application
Share your comments for Microsoft AI-200 exam with other users:
Question 52:Question 52’s stated answer looks partly incorrect.
ACR Tasks
Commit
Base image update
ACR Task
Question 17:Question 17 tests how an Azure Container App securely accesses Azure Key Vault without storing credentials. The answer key’s sequence appears questionable. The logical sequence should be:
Key Vault Secrets User
DefaultAzureCredential
SecretClient