Pass Your Microsoft AZ-104 Exam Easy!

'Inspect container termination status, logs and expected output artifacts' applies to a different feature boundary because scheduling a container is not evidence its batch logic completed or wrote the intended result. In the stated scenario where a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Inspect container termination status, logs and expected output artifacts' does not satisfy the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. The necessary action is 'Run the isolated task in Azure Container Instances where appropriate', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Evaluate Container Apps replica scaling versus fixed ACI group sizing' is associated with this separate need: a team proposes a single large ACI container for intermittent unpredictable HTTP demand rather than using managed autoscaling. That is because ACI sizes a container group; Container Apps can add replicas based on configured triggers. Here a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, so 'Evaluate Container Apps replica scaling versus fixed ACI group sizing' misses the fact that ACI provisions a container group directly without requiring full managed microservice revision features. 'Run the isolated task in Azure Container Instances where appropriate' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When an ACI container group repeatedly fails to start with unauthorized image errors, the action 'Provide valid registry pull credentials or identity permissions for the image' can be relevant: container group startup requires image authorization; increasing CPU won't fix a registry rejection. For the different problem of a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Provide valid registry pull credentials or identity permissions for the image' misses the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. Choosing 'Provide valid registry pull credentials or identity permissions for the image' would address that other need, whereas 'Run the isolated task in Azure Container Instances where appropriate' is intended to solve the stated condition.

'Restrict ingress and expose only required ports through approved network configuration' applies to a different feature boundary because container group endpoint design should not publish unrelated debugging services. In the stated scenario where a nightly batch job processes one file, then exits; the team wants no long-lived app hosting platform, 'Restrict ingress and expose only required ports through approved network configuration' does not satisfy the mechanism that ACI provisions a container group directly without requiring full managed microservice revision features. The necessary action is 'Run the isolated task in Azure Container Instances where appropriate', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Create Azure Container Registry with appropriate authentication and network controls' is associated with this separate need: a container service pulls approved application images from a company registry. That is because ACR holds OCI container images; repository access and pull authorization are separate concerns. Here an ACI container group repeatedly fails to start with unauthorized image errors, so 'Create Azure Container Registry with appropriate authentication and network controls' misses the fact that container group startup requires image authorization; increasing CPU won't fix a registry rejection. 'Provide valid registry pull credentials or identity permissions for the image' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Evaluate Container Apps replica scaling versus fixed ACI group sizing' solves another task because ACI sizes a container group; Container Apps can add replicas based on configured triggers. For the situation where an ACI container group repeatedly fails to start with unauthorized image errors, this distractor misses the requirement that container group startup requires image authorization; increasing CPU won't fix a registry rejection. Unlike 'Evaluate Container Apps replica scaling versus fixed ACI group sizing', 'Provide valid registry pull credentials or identity permissions for the image' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A build agent and an Azure Container Instances container group are distinct authentication principals. Allowing the CI pipeline to pull an ACR image does not authorize the runtime's image request, so the 401-style image-pull failure continues if its credential or approved user-assigned managed identity lacks registry access. Microsoft documents a supported ACI user-assigned identity path for registry image pulls; the exact registry-permission model and network route still matter. Grant access to the principal used by the container group, not merely to the image publisher.

Launching the same workload in the unchanged ACI container group does not alter its CPU or memory resource request. If its available resources are below the application’s tested requirement, repeating the job can reproduce performance failures or out-of-memory termination. The relevant distinction is that the group was already created with specific allocation properties, not that ACI is the wrong container product. Microsoft documents resource-request changes as requiring deletion and new deployment of the group. Administrators should preserve the configuration, plan any workload interruption, and recreate the container group with the approved supported allocation.

Azure Container Apps offers managed application revisions and scaling rules, but the scenario does not require changing orchestration products or event-driven autoscaling. The application already runs as a bounded ACI batch task. Moving it to another service would be a larger architectural decision and would not directly describe how to correct the existing ACI group allocation. Azure Container Instances supports explicit CPU and memory requests within regional and group limits. For an existing group, those resource properties cannot simply be edited in place: the group must be deleted and recreated using the new request sizes.

Logs and termination codes can help determine whether resource pressure caused a previous batch failure, but the tested requirement is already given: 2 vCPU and 4 GiB, while the group was provisioned below that. Inspecting the logs without changing its resource requests leaves the actual capacity problem unresolved. The request sizes are properties of the ACI container group that require a delete-and-recreate operation, not a live resize. The administrator should coordinate the restart of the batch workload, keep any needed external state or volumes, and provision the new supported group allocation.

An image tag chooses the code and dependencies to run. Updating that tag may cause a supported group redeployment, but it does not change the CPU and memory resource requests that were specified when the container group was created. The batch could still face the same resource ceiling even with a new image version. The scenario does not report an outdated image as the root issue; it explicitly states a tested allocation requirement. Correct the deployment resource requests in the replacement ACI group, after verifying supported region limits and maintaining any necessary external state.

Registry credentials govern whether Azure Container Instances can retrieve a private container image. They do not control which IP address and ports make a running container group reachable to clients. The existing group is publicly exposed, so changing an image-pull password or managed identity would leave the unsafe ingress configuration in place. For private-only access, the group must instead be deployed into a supported delegated virtual-network subnet with a private address and no direct public endpoint. The application should then be tested from an approved VNet client and rejected from an unauthorized internet path.

Azure Container Apps is a separate managed service with its own ingress and revision model. Configuring private ingress for a Container Apps application would not automatically move or secure the already public Azure Container Instances group named in the scenario. A cross-service migration might be reasonable for other operational requirements, but it introduces unnecessary architecture and leaves the original exposure unresolved unless that ACI resource is retired. The supported ACI solution is to deploy its container group in an appropriately delegated VNet subnet without direct public-IP access and limit any remaining debug listener to authorized private clients.

Running another copy of the batch or deploying an additional container does not make the existing public debug port private. If the old container group remains reachable over its public IP, the original compliance risk continues even if a separate internal copy succeeds. The requirement is to remove direct public exposure and constrain the actual task endpoint to authorized VNet clients. Use the ACI virtual-network deployment design with a delegated subnet, replace the exposed group as appropriate, and verify from both approved and unauthorized source networks that the intended ingress policy is effective.

'Set supported container CPU/memory resource requests matching workload limits' applies to a different feature boundary because container sizing and quotas must permit the requested resources in the selected region. In the stated scenario where a container batch command was issued, but no one checked whether the process ended successfully, 'Set supported container CPU/memory resource requests matching workload limits' does not satisfy the mechanism that scheduling a container is not evidence its batch logic completed or wrote the intended result. The necessary action is 'Inspect container termination status, logs and expected output artifacts', which should be checked against this Azure resource's actual permissions and state.

'Run the isolated task in Azure Container Instances where appropriate' solves another task because ACI provisions a container group directly without requiring full managed microservice revision features. For the situation where a container batch command was issued, but no one checked whether the process ended successfully, this distractor misses the requirement that scheduling a container is not evidence its batch logic completed or wrote the intended result. Unlike 'Run the isolated task in Azure Container Instances where appropriate', 'Inspect container termination status, logs and expected output artifacts' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When an ACI container group repeatedly fails to start with unauthorized image errors, the action 'Provide valid registry pull credentials or identity permissions for the image' can be relevant: container group startup requires image authorization; increasing CPU won't fix a registry rejection. For the different problem of a container batch command was issued, but no one checked whether the process ended successfully, 'Provide valid registry pull credentials or identity permissions for the image' misses the mechanism that scheduling a container is not evidence its batch logic completed or wrote the intended result. Choosing 'Provide valid registry pull credentials or identity permissions for the image' would address that other need, whereas 'Inspect container termination status, logs and expected output artifacts' is intended to solve the stated condition.

The nearby action 'Configure an authenticated event-driven Container Apps scale rule for the queue' is associated with this separate need: a worker should start when Service Bus queue depth grows and idle when messages are absent. That is because kEDA-backed rules can scale replicas using queue metrics without polling from the application itself. Here a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale, so 'Configure an authenticated event-driven Container Apps scale rule for the queue' misses the fact that container Apps supports managed ingress, revisions and scaling rules for service workloads. 'Use Azure Container Apps rather than a one-off ACI container group' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Provide valid registry pull credentials or identity permissions for the image' solves another task because container group startup requires image authorization; increasing CPU won't fix a registry rejection. For the situation where a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale, this distractor misses the requirement that container Apps supports managed ingress, revisions and scaling rules for service workloads. Unlike 'Provide valid registry pull credentials or identity permissions for the image', 'Use Azure Container Apps rather than a one-off ACI container group' directly targets that requirement; its success must be confirmed at the authorized resource scope.

When a new Container Apps revision starts but never receives traffic because health checks fail, the action 'Check readiness probes, target port, app startup and revision health' can be relevant: unhealthy revisions may be excluded from traffic despite successful image deployment. For the different problem of a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale, 'Check readiness probes, target port, app startup and revision health' misses the mechanism that container Apps supports managed ingress, revisions and scaling rules for service workloads. Choosing 'Check readiness probes, target port, app startup and revision health' would address that other need, whereas 'Use Azure Container Apps rather than a one-off ACI container group' is intended to solve the stated condition.

The nearby action 'Treat a revision as an immutable app version and replicas as running instances' is associated with this separate need: an application config change creates a new Container Apps revision, but the operator interprets it as an additional replica. That is because revision versioning and autoscale replica count describe different axes of deployment. Here a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale, so 'Treat a revision as an immutable app version and replicas as running instances' misses the fact that container Apps supports managed ingress, revisions and scaling rules for service workloads. 'Use Azure Container Apps rather than a one-off ACI container group' is the more defensible action; confirm its behavior in the target service before calling the task complete.

Managed secrets, identity-based references and App Configuration can control how an Azure Container Apps workload retrieves sensitive settings. They do not by themselves constrain which network clients can reach the application ingress endpoint. The question asks for per-app reachability limited to sibling container apps within the same Container Apps environment. Configure internal ingress, independent of secret handling, and verify that VNet-only or public clients cannot reach the service through the app endpoint. Valid credentials do not make a publicly reachable listener network-private.

Application authentication can reject unauthorized requests after a connection is established, but it does not make the endpoint internally reachable only within the Container Apps environment. With public external ingress enabled on an external environment, the network endpoint still accepts connections from outside, contrary to this design. Set the app ingress visibility to internal so other container apps in that environment can reach it, and verify the environment-level exposure and target port. Do not substitute business-layer login checks for the requested network visibility boundary.

Readiness probes and target-port checks determine whether a Container Apps revision starts and receives routed traffic, but those health settings do not select who may connect to the app endpoint. A perfectly healthy revision can still be exposed outside the intended environment when per-app ingress visibility is external. The stated requirement concerns the network boundary for callers, so adjust and verify internal-only per-app ingress rather than merely improving the revision's health signal. Do not confuse successful startup with authorization or ingress isolation.

'Check readiness probes, target port, app startup and revision health' applies to a different feature boundary because unhealthy revisions may be excluded from traffic despite successful image deployment. In the stated scenario where an application config change creates a new Container Apps revision, but the operator interprets it as an additional replica, 'Check readiness probes, target port, app startup and revision health' does not satisfy the mechanism that revision versioning and autoscale replica count describe different axes of deployment. The necessary action is 'Treat a revision as an immutable app version and replicas as running instances', which should be checked against this Azure resource's actual permissions and state.

The nearby action 'Use Azure Container Apps rather than a one-off ACI container group' is associated with this separate need: a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale. That is because container Apps supports managed ingress, revisions and scaling rules for service workloads. Here an application config change creates a new Container Apps revision, but the operator interprets it as an additional replica, so 'Use Azure Container Apps rather than a one-off ACI container group' misses the fact that revision versioning and autoscale replica count describe different axes of deployment. 'Treat a revision as an immutable app version and replicas as running instances' is the more defensible action; confirm its behavior in the target service before calling the task complete.

'Evaluate Container Apps replica scaling versus fixed ACI group sizing' solves another task because ACI sizes a container group; Container Apps can add replicas based on configured triggers. For the situation where an application config change creates a new Container Apps revision, but the operator interprets it as an additional replica, this distractor misses the requirement that revision versioning and autoscale replica count describe different axes of deployment. Unlike 'Evaluate Container Apps replica scaling versus fixed ACI group sizing', 'Treat a revision as an immutable app version and replicas as running instances' directly targets that requirement; its success must be confirmed at the authorized resource scope.

A private Azure Container Registry limits who can pull the image, but the members, build pipelines and administrators who can access it may inspect its layers and environment metadata. Keeping a production credential baked into the image is still a disclosure risk, even when repository access controls are strong. The problem specifically includes readers of the image as the threat model; making the registry private only reduces the population of those readers. Move the credential to an authorized runtime secret source and rebuild an image that contains no usable secret, rather than retaining the credential in a private artifact.

Docker build arguments or temporary build-stage variables can still leak into build history, caches, produced files or downstream image layers when they are not handled through an approved secret-mount mechanism. Merely suppressing CI log output does not establish that a connection string copied into the final image is absent from its contents. The request is for an image that can be distributed without exposing credentials to authorized pullers. Protect the entire build and final artifact, and use Container Apps' runtime secret reference rather than relying on less-visible build output.

Storing a connection string in an ordinary environment-variable template checked into a shared repository changes where the plaintext appears but does not give it a protected lifecycle or permission boundary. Collaborators and repository history readers can still retrieve it, and automation may echo or replicate its value. A runtime environment variable can be populated securely from a Container Apps secret reference, but that is different from committing the secret value to source control. Use managed identity and a vault-backed secret instead, while rotating the already exposed credential and keeping the image clean.

Keeping a Dockerfile with an embedded production connection string in a restricted branch only controls source-repository visibility. The built image can still disclose the value through layers or metadata to anyone who can pull it, and earlier commits may remain accessible in history. The scenario's security requirement concerns the distributable artifact, not only the source branch. Remove the secret from image-building inputs and final output, rotate it, and retrieve the replacement at runtime through an authorized protected secret mechanism; private source control alone cannot satisfy those conditions.

The nearby action 'Use Azure Container Apps rather than a one-off ACI container group' is associated with this separate need: a managed HTTP microservice needs revision rollouts and traffic splitting, with event-driven scale. That is because container Apps supports managed ingress, revisions and scaling rules for service workloads. Here a new Container Apps revision starts but never receives traffic because health checks fail, so 'Use Azure Container Apps rather than a one-off ACI container group' misses the fact that unhealthy revisions may be excluded from traffic despite successful image deployment. 'Check readiness probes, target port, app startup and revision health' is the more defensible action; confirm its behavior in the target service before calling the task complete.

When a developer stores a production connection string in the container image, risking disclosure to image pullers, the action 'Use managed secrets and references through Container Apps configuration or identity' can be relevant: credentials should not be baked into reusable images or build logs. For the different problem of a new Container Apps revision starts but never receives traffic because health checks fail, 'Use managed secrets and references through Container Apps configuration or identity' misses the mechanism that unhealthy revisions may be excluded from traffic despite successful image deployment. Choosing 'Use managed secrets and references through Container Apps configuration or identity' would address that other need, whereas 'Check readiness probes, target port, app startup and revision health' is intended to solve the stated condition.

'Treat a revision as an immutable app version and replicas as running instances' applies to a different feature boundary because revision versioning and autoscale replica count describe different axes of deployment. In the stated scenario where a new Container Apps revision starts but never receives traffic because health checks fail, 'Treat a revision as an immutable app version and replicas as running instances' does not satisfy the mechanism that unhealthy revisions may be excluded from traffic despite successful image deployment. The necessary action is 'Check readiness probes, target port, app startup and revision health', which should be checked against this Azure resource's actual permissions and state.

Changing charts can reveal useful details about peak traffic, concurrency and response times, but it does not change how many replicas the Container Apps revision can create. The given rule is already at maxReplicas=2 during the high-latency period. If healthy instances are capacity-constrained, the administrator needs to evaluate a higher supported maximum and the HTTP concurrency target, then measure the result. New dashboards alone leave the binding scale ceiling intact, so they cannot supply the additional service capacity requested in the question.

A Service Bus scaler is designed to react to queue depth or another supported event source. The application in the question receives HTTP requests and has no stated Service Bus queue. Adding a queue trigger would not characterize the existing inbound HTTP concurrency or resolve a two-replica cap caused by the current HTTP scale configuration. Event-driven queue scaling is relevant to worker applications that actually consume such messages; this service instead needs measured adjustment of its HTTP rule and allowed replica maximum. Use the trigger that corresponds to the traffic actually described.

Valid image-pull credentials are necessary for new replicas to start, but the existing revision has two healthy running replicas and no image-pull errors. Replacing successful registry credentials cannot by itself raise the maximum replica count or change the HTTP concurrency threshold that determines scale-out. Credential investigation would be relevant for failing revision starts or authorization errors, neither of which is present in the scenario. The material symptom is peak requests encountering a capacity ceiling, not an inability to retrieve the container image.

Lowering minReplicas from one to zero may reduce idle charges when the application has no requests, but it does not increase the maxReplicas=2 ceiling already reached during peaks. It can also introduce cold-start considerations when traffic resumes. The question explicitly asks for additional capacity under a healthy but saturated two-replica revision, not lower idle cost. Keep the scaling goal separate from another practice scenario's idle scale-to-zero objective: this case requires raising the maximum and tuning HTTP thresholds based on observed demand, not changing only the floor.