Question 720
A design review identifies: A regulated microservice platform needs Kubernetes-native custom resource definitions, advanced admission policy and direct control over Kubernetes API. The failure is: A container platform without Kubernetes API prevents the required operator and custom controller deployment. Select TWO distinct decisions that together provide the immediate technical solution AND an ongoing prevention control. A verification-only step does not replace either responsibility.
- Choose Azure Container Apps with proper environment, ingress and KEDA-based scaling rules.
- Use Azure Kubernetes Service with appropriate node pools, networking and governance for Kubernetes-native requirements.
- Test runtime support and plan scale settings when application frameworks change.
- Review Kubernetes version, node pool upgrades and admission policies for compatibility.
- Use supported Kubernetes workload identity federation with a scoped Azure managed identity and Storage Blob Data permissions.
Explanation
Correct Answers
B:This option addresses the actual design defect: The hosting choice does not expose necessary Kubernetes orchestration APIs. The correction is: Use Azure Kubernetes Service with appropriate node pools, networking and governance for Kubernetes-native requirements. Confirm the outcome with: Deploy a custom resource and admission policy and confirm cluster API behavior under controlled changes.
D:The key follow-up control is: Review Kubernetes version, node pool upgrades and admission policies for compatibility. It avoids recurrence of the scenario in which: A container platform without Kubernetes API prevents the required operator and custom controller deployment. It addresses: The hosting choice does not expose necessary Kubernetes orchestration APIs.
Incorrect Answers
A:The option belongs to a different failure mechanism: The hosting choice exposes unnecessary Kubernetes cluster management obligations. That situation exhibits: Operators spend excessive time maintaining cluster nodes for simple container services. For the stated case, the remedy is: Use Azure Kubernetes Service with appropriate node pools, networking and governance for Kubernetes-native requirements.
C:This is a reasonable safeguard for a different fault: The team operates unnecessary webserver VMs and manually patches them for routine hosting. That different mechanism is: A full IaaS VM hosting model was retained though managed App Service meets the constraints. The original incident here instead arises from: The hosting choice does not expose necessary Kubernetes orchestration APIs. The directly relevant safeguard is: Review Kubernetes version, node pool upgrades and admission policies for compatibility.
E:That design instead addresses another observed condition: Containers fail when a hard-coded client secret expires. Its technical cause is: The deployment lacks supported workload-to-Azure-identity federation and data-plane authorization. The current workload exhibits: A container platform without Kubernetes API prevents the required operator and custom controller deployment. Its targeted remedy is: Use Azure Kubernetes Service with appropriate node pools, networking and governance for Kubernetes-native requirements.
Question 721
A design workshop has this requirement: A QA team must run one isolated Linux container for a short integration test without setting up a long-running cluster. Operators currently observe: A dedicated AKS cluster remains running for a single sporadic one-container test. Select the ONE design remedy that best addresses the root cause.
- Choose Azure Container Apps with proper environment, ingress and KEDA-based scaling rules.
- Use Azure Container Registry with appropriate AKS managed-identity pull authorization and network access.
- Use supported Kubernetes workload identity federation with a scoped Azure managed identity and Storage Blob Data permissions.
- Use Azure Container Instances for the supported short-lived container group workload.
Explanation
Correct Answer
D:This option addresses the actual design defect: The workload's simple short-lived lifecycle did not require a full orchestration control plane. The correction is: Use Azure Container Instances for the supported short-lived container group workload. Confirm the outcome with: Launch an ephemeral container group and verify exit code and log retrieval after the test.
Incorrect Answers
A:That design instead addresses another observed condition: Operators spend excessive time maintaining cluster nodes for simple container services. Its technical cause is: The hosting choice exposes unnecessary Kubernetes cluster management obligations. The current workload exhibits: A dedicated AKS cluster remains running for a single sporadic one-container test. Its targeted remedy is: Use Azure Container Instances for the supported short-lived container group workload.
B:This choice mitigates an alternative scenario, where: AKS pods remain in ImagePullBackOff with registry authentication errors. The underlying issue there is: Cluster identity lacks the necessary ACR pull permission or registry connectivity. Here the root issue is: The workload's simple short-lived lifecycle did not require a full orchestration control plane. Choose the corresponding action: Use Azure Container Instances for the supported short-lived container group workload.
C:The option belongs to a different failure mechanism: The deployment lacks supported workload-to-Azure-identity federation and data-plane authorization. That situation exhibits: Containers fail when a hard-coded client secret expires. For the stated case, the remedy is: Use Azure Container Instances for the supported short-lived container group workload.
Question 722
The planned architecture is: Use Azure Container Instances for the supported short-lived container group workload. Workload context: A QA team must run one isolated Linux container for a short integration test without setting up a long-running cluster. Which acceptance test demonstrates that the required behavior works?
- Deploy two revisions and send load to validate traffic split and scaling behavior.
- Deploy a signed image tag to AKS and confirm pull succeeds while unauthorized identities are blocked.
- Access a test blob from the bound service account while an unbound pod is denied.
- Launch an ephemeral container group and verify exit code and log retrieval after the test.
Explanation
Correct Answer
D:This observation directly verifies the intended design: Launch an ephemeral container group and verify exit code and log retrieval after the test. The architecture being tested is: Use Azure Container Instances for the supported short-lived container group workload. The original symptom was: A dedicated AKS cluster remains running for a single sporadic one-container test.
Incorrect Answers
A:This check validates a different workload: Deploy two revisions and send load to validate traffic split and scaling behavior. Its associated design is: Choose Azure Container Apps with proper environment, ingress and KEDA-based scaling rules. The required acceptance test here is: Launch an ephemeral container group and verify exit code and log retrieval after the test.
B:That observation pertains to a separate failure: AKS pods remain in ImagePullBackOff with registry authentication errors. Its cause is: Cluster identity lacks the necessary ACR pull permission or registry connectivity. It does not confirm the result of this design. The direct proof would be: Launch an ephemeral container group and verify exit code and log retrieval after the test.
C:The alternative test targets: Use supported Kubernetes workload identity federation with a scoped Azure managed identity and Storage Blob Data permissions. The scenario's actual proposed remedy is: Use Azure Container Instances for the supported short-lived container group workload. Verify that one by: Launch an ephemeral container group and verify exit code and log retrieval after the test.
Question 723
The customer states: A QA team must run one isolated Linux container for a short integration test without setting up a long-running cluster. An incident reveals: A dedicated AKS cluster remains running for a single sporadic one-container test. What cause best accounts for this evidence?
- The hosting choice exposes unnecessary Kubernetes cluster management obligations.
- The workload's simple short-lived lifecycle did not require a full orchestration control plane.
- Cluster identity lacks the necessary ACR pull permission or registry connectivity.
- The deployment lacks supported workload-to-Azure-identity federation and data-plane authorization.
Explanation
Correct Answer
B:This is the failure mechanism rather than an incidental symptom: The workload's simple short-lived lifecycle did not require a full orchestration control plane. It accounts for: A dedicated AKS cluster remains running for a single sporadic one-container test. The architectural repair is: Use Azure Container Instances for the supported short-lived container group workload.
Incorrect Answers
A:This cause would explain a different symptom: Operators spend excessive time maintaining cluster nodes for simple container services. The mechanism for that event is: The hosting choice exposes unnecessary Kubernetes cluster management obligations. Here the stated symptom is: A dedicated AKS cluster remains running for a single sporadic one-container test. Its cause is: The workload's simple short-lived lifecycle did not require a full orchestration control plane.
C:The alternative weakness is: Cluster identity lacks the necessary ACR pull permission or registry connectivity. Its associated failure is: AKS pods remain in ImagePullBackOff with registry authentication errors. Neither explains the present observation: A dedicated AKS cluster remains running for a single sporadic one-container test. The direct cause here is: The workload's simple short-lived lifecycle did not require a full orchestration control plane.
D:This cause would explain a different symptom: Containers fail when a hard-coded client secret expires. The mechanism for that event is: The deployment lacks supported workload-to-Azure-identity federation and data-plane authorization. Here the stated symptom is: A dedicated AKS cluster remains running for a single sporadic one-container test. Its cause is: The workload's simple short-lived lifecycle did not require a full orchestration control plane.
Question 724
Workload context: A QA team must run one isolated Linux container for a short integration test without setting up a long-running cluster. The implemented remedy is: Use Azure Container Instances for the supported short-lived container group workload. Which ongoing practice most specifically prevents recurrence of this failure: A dedicated AKS cluster remains running for a single sporadic one-container test.?
- Audit service account federation subjects and Storage RBAC roles during deployments.
- Monitor container group time limits, network and image pull authentication.
- Monitor app revisions, scale-to-zero caveats and secrets as services evolve.
- Review image tag immutability and pull permissions after rotating node pools.
Explanation
Correct Answer
B:This is an ongoing protection specific to the fault: Monitor container group time limits, network and image pull authentication. The recurrence risk is: The workload's simple short-lived lifecycle did not require a full orchestration control plane. It should be checked using: Launch an ephemeral container group and verify exit code and log retrieval after the test.
Incorrect Answers
A:That safeguard manages another risk: The deployment lacks supported workload-to-Azure-identity federation and data-plane authorization. Its scenario is: Containers fail when a hard-coded client secret expires. The present recurring risk is: The workload's simple short-lived lifecycle did not require a full orchestration control plane. The proper ongoing control is: Monitor container group time limits, network and image pull authentication.
C:The proposed control focuses on: The hosting choice exposes unnecessary Kubernetes cluster management obligations. For the design in the question, recurrence comes from: The workload's simple short-lived lifecycle did not require a full orchestration control plane. A precise prevention step is: Monitor container group time limits, network and image pull authentication.
D:That safeguard manages another risk: Cluster identity lacks the necessary ACR pull permission or registry connectivity. Its scenario is: AKS pods remain in ImagePullBackOff with registry authentication errors. The present recurring risk is: The workload's simple short-lived lifecycle did not require a full orchestration control plane. The proper ongoing control is: Monitor container group time limits, network and image pull authentication.
Question 725
A solution architect is reviewing a workload: A finance team processes 20,000 independent end-of-day simulation jobs requiring queued scheduling and distributed compute nodes. The observed incident is: A single VM serializes thousands of independent jobs and misses the daily SLA. Which architecture choice most directly removes the identified weakness?
- Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
- Use Azure Spot Virtual Machines with interruption-tolerant queues and checkpointing when suitable.
- Use an appropriate VM temporary/local scratch disk only for disposable files and store durable results on managed disks or services.
- Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
Explanation
Correct Answer
A:The evidence (A single VM serializes thousands of independent jobs and misses the daily SLA.) identifies the following cause: The workload lacks managed parallel task scheduling and scalable compute pools. The design that removes it is: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads. The acceptance check is: Submit a representative batch and check task distribution, failures and output aggregation.
Incorrect Answers
B:The option belongs to a different failure mechanism: The workload lacks eviction handling and assumes spot capacity is guaranteed. That situation exhibits: Rendering jobs stop permanently when discounted spot capacity is reclaimed. For the stated case, the remedy is: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
C:That design instead addresses another observed condition: The application loses business files after a VM host maintenance event. Its technical cause is: Critical state was stored on nonpersistent temporary local storage. The current workload exhibits: A single VM serializes thousands of independent jobs and misses the daily SLA. Its targeted remedy is: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
D:This choice mitigates an alternative scenario, where: Inference falls below performance target on CPU-only VMs. The underlying issue there is: Compute selection does not meet model accelerator requirements. Here the root issue is: The workload lacks managed parallel task scheduling and scalable compute pools. Choose the corresponding action: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
Question 726
An architect proposes this change: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads. The workload context is: A finance team processes 20,000 independent end-of-day simulation jobs requiring queued scheduling and distributed compute nodes. Which evidence would most directly validate the change?
- Simulate task eviction and verify unfinished work retries or resumes without data corruption.
- Submit a representative batch and check task distribution, failures and output aggregation.
- Benchmark inference throughput and verify GPU device use and memory under load.
- Redeploy the worker and confirm business results remain while disposable scratch may disappear.
Explanation
Correct Answer
B:The decisive evidence is: Submit a representative batch and check task distribution, failures and output aggregation. This measures the mechanism of the planned change, not an unrelated Azure service: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
Incorrect Answers
A:That observation pertains to a separate failure: Rendering jobs stop permanently when discounted spot capacity is reclaimed. Its cause is: The workload lacks eviction handling and assumes spot capacity is guaranteed. It does not confirm the result of this design. The direct proof would be: Submit a representative batch and check task distribution, failures and output aggregation.
C:This check validates a different workload: Benchmark inference throughput and verify GPU device use and memory under load. Its associated design is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas. The required acceptance test here is: Submit a representative batch and check task distribution, failures and output aggregation.
D:That observation pertains to a separate failure: The application loses business files after a VM host maintenance event. Its cause is: Critical state was stored on nonpersistent temporary local storage. It does not confirm the result of this design. The direct proof would be: Submit a representative batch and check task distribution, failures and output aggregation.
Question 727
During architecture troubleshooting, a team reports: A single VM serializes thousands of independent jobs and misses the daily SLA. Context: A finance team processes 20,000 independent end-of-day simulation jobs requiring queued scheduling and distributed compute nodes. Which underlying design mistake explains the observed behavior most precisely?
- The workload lacks managed parallel task scheduling and scalable compute pools.
- Critical state was stored on nonpersistent temporary local storage.
- Compute selection does not meet model accelerator requirements.
- The workload lacks eviction handling and assumes spot capacity is guaranteed.
Explanation
Correct Answer
A:This is the failure mechanism rather than an incidental symptom: The workload lacks managed parallel task scheduling and scalable compute pools. It accounts for: A single VM serializes thousands of independent jobs and misses the daily SLA. The architectural repair is: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads.
Incorrect Answers
B:The alternative weakness is: Critical state was stored on nonpersistent temporary local storage. Its associated failure is: The application loses business files after a VM host maintenance event. Neither explains the present observation: A single VM serializes thousands of independent jobs and misses the daily SLA. The direct cause here is: The workload lacks managed parallel task scheduling and scalable compute pools.
C:This cause would explain a different symptom: Inference falls below performance target on CPU-only VMs. The mechanism for that event is: Compute selection does not meet model accelerator requirements. Here the stated symptom is: A single VM serializes thousands of independent jobs and misses the daily SLA. Its cause is: The workload lacks managed parallel task scheduling and scalable compute pools.
D:The proposed diagnosis fits another scenario: The workload lacks eviction handling and assumes spot capacity is guaranteed. It would typically be reflected by: Rendering jobs stop permanently when discounted spot capacity is reclaimed. The current evidence instead supports: The workload lacks managed parallel task scheduling and scalable compute pools.
Question 728
The design change is: Use Azure Batch with pools, job/task scheduling and autoscaling for parallel batch workloads. The original failure was: A single VM serializes thousands of independent jobs and misses the daily SLA. Which ongoing control best prevents recurrence of the same root cause?
- Audit GPU driver compatibility and regional SKU quota during scaling.
- Audit scratch versus persistent paths in application configuration before image changes.
- Monitor eviction signals and maintain fallback capacity for urgent deadlines.
- Review task retries and pool scaling quotas before peak runs.
Explanation
Correct Answer
D:This is an ongoing protection specific to the fault: Review task retries and pool scaling quotas before peak runs. The recurrence risk is: The workload lacks managed parallel task scheduling and scalable compute pools. It should be checked using: Submit a representative batch and check task distribution, failures and output aggregation.
Incorrect Answers
A:This is a reasonable safeguard for a different fault: Inference falls below performance target on CPU-only VMs. That different mechanism is: Compute selection does not meet model accelerator requirements. The original incident here instead arises from: The workload lacks managed parallel task scheduling and scalable compute pools. The directly relevant safeguard is: Review task retries and pool scaling quotas before peak runs.
B:The proposed control focuses on: Critical state was stored on nonpersistent temporary local storage. For the design in the question, recurrence comes from: The workload lacks managed parallel task scheduling and scalable compute pools. A precise prevention step is: Review task retries and pool scaling quotas before peak runs.
C:That safeguard manages another risk: The workload lacks eviction handling and assumes spot capacity is guaranteed. Its scenario is: Rendering jobs stop permanently when discounted spot capacity is reclaimed. The present recurring risk is: The workload lacks managed parallel task scheduling and scalable compute pools. The proper ongoing control is: Review task retries and pool scaling quotas before peak runs.
Question 729
A design workshop has this requirement: A machine-learning service must run an inference model requiring GPU acceleration at predictable throughput. Operators currently observe: Inference falls below performance target on CPU-only VMs. Select the ONE design remedy that best addresses the root cause.
- Evaluate eligible Azure Reservations or savings plans based on actual steady usage and flexibility needs.
- Evaluate Azure confidential VMs or supported confidential compute backed by hardware-based trusted execution appropriate to workload.
- Deploy Azure Virtual Machine Scale Sets with a suitable autoscale rule, image and load-balancing integration.
- Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
Explanation
Correct Answer
D:The targeted implementation is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas. The problem is not generic resource availability: Compute selection does not meet model accelerator requirements. Verify the result by: Benchmark inference throughput and verify GPU device use and memory under load.
Incorrect Answers
A:The option belongs to a different failure mechanism: No committed-use discount decision was evaluated for predictable demand. That situation exhibits: Annual compute spending remains on pay-as-you-go rates despite a stable baseline. For the stated case, the remedy is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
B:That design instead addresses another observed condition: Highly sensitive data are processed without the required isolation boundary for memory in use. Its technical cause is: Ordinary VM encryption at rest alone does not provide the required in-use protection. The current workload exhibits: Inference falls below performance target on CPU-only VMs. Its targeted remedy is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
C:This choice mitigates an alternative scenario, where: The API exhausts capacity because two manually provisioned VMs never scale. The underlying issue there is: Capacity management lacks automated VM instance scaling and health integration. Here the root issue is: Compute selection does not meet model accelerator requirements. Choose the corresponding action: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
Question 730
The planned architecture is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas. Workload context: A machine-learning service must run an inference model requiring GPU acceleration at predictable throughput. Which acceptance test demonstrates that the required behavior works?
- Apply controlled CPU load and verify new scale-set instances join the healthy serving pool.
- Verify eligible confidential-computing capability and attestation expectations in a test workload.
- Compare effective costs and coverage reports for baseline VMs against on-demand usage.
- Benchmark inference throughput and verify GPU device use and memory under load.
Explanation
Correct Answer
D:The decisive evidence is: Benchmark inference throughput and verify GPU device use and memory under load. This measures the mechanism of the planned change, not an unrelated Azure service: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas.
Incorrect Answers
A:The alternative test targets: Deploy Azure Virtual Machine Scale Sets with a suitable autoscale rule, image and load-balancing integration. The scenario's actual proposed remedy is: Select eligible GPU VM sizes or supported GPU-backed managed compute with compatible drivers and allocation quotas. Verify that one by: Benchmark inference throughput and verify GPU device use and memory under load.
B:This check validates a different workload: Verify eligible confidential-computing capability and attestation expectations in a test workload. Its associated design is: Evaluate Azure confidential VMs or supported confidential compute backed by hardware-based trusted execution appropriate to workload. The required acceptance test here is: Benchmark inference throughput and verify GPU device use and memory under load.
C:That observation pertains to a separate failure: Annual compute spending remains on pay-as-you-go rates despite a stable baseline. Its cause is: No committed-use discount decision was evaluated for predictable demand. It does not confirm the result of this design. The direct proof would be: Benchmark inference throughput and verify GPU device use and memory under load.
Designing Microsoft Azure Infrastructure Solutions (AZ-305) Practice Tests