Question 4 of 10Deploy and Manage Azure Compute Resources
CramHQ needs to run a containerized image-processing API for hospital apps in Azure Container Instances. Callers arrive through existing private network paths from spokes and clinics; no direct internet entry is allowed. The API must also call a vendor endpoint that accepts traffic only from an allowlisted Azure address. Which deployment should you recommend?
- AA. Deploy the container group to a delegated subnet in the spoke virtual network and assign the container group a public IP address with a DNS name label.
- BB. Deploy the container group to a delegated subnet in the spoke virtual network and associate Azure NAT Gateway with a static public IP address to that subnet.
- CC. Add the container group's private IP to an Azure Standard Load Balancer backend pool and configure an outbound rule with a static public frontend IP address.
- DD. Deploy the container group with a public IP address and DNS name label, then use NSG rules to allow only CramHQ network address ranges.
Show answer and explanation
Answer: B
A delegated subnet gives the container group private reachability from connected networks. Azure NAT Gateway provides supported outbound source translation through a stable public IP without opening inbound internet access.
If you picked AWhy it is tempting: The delegated subnet satisfies private reachability, and a public IP with DNS label sounds like an easy way to give the vendor a stable address.
Why it is wrong: For ACI in a virtual network, private placement and direct public IP or DNS label exposure are not combined on the container group.
If you picked CWhy it is tempting: A static public frontend IP sounds like it could provide the vendor with the stable address the stem requires.
Why it is wrong: For ACI container groups in a virtual network, use the supported subnet egress pattern instead of assuming a load balancer outbound rule supplies the documented path.
If you picked DWhy it is tempting: NSG rules can look like they satisfy the no-internet-entry requirement by allowing only known CramHQ address ranges.
Why it is wrong: A public IP and DNS label make the container group internet-addressable; private access requirements require private network placement instead.
Question 5 of 10Deploy and Manage Azure Compute Resources
CramHQ's lab runs a two-container Azure Container Instances group in a delegated subnet: an API and a small telemetry sidecar. During product demos, the API is throttled at 1 vCPU while the sidecar remains below 0.1 vCPU. The team wants the least operational change that preserves the sidecar pattern and private access for the next demo. What should you recommend?
- AA. Redeploy the existing Azure Container Instances container group with az container create, increasing only the API container CPU request so the private IP is retained.
- BB. Delete and recreate the Azure Container Instances container group, increasing the telemetry sidecar CPU request so unused capacity is available to the API container.
- CC. Delete and recreate the Azure Container Instances container group in the subnet, increasing the API container CPU request and leaving the telemetry container request unchanged.
- DD. Create separate Azure Container Instances container groups in the subnet, assigning a larger CPU request to the API and a minimal request to telemetry.
Show answer and explanation
Answer: C
Azure Container Instances assigns CPU and memory per container and totals the requests for the group. CPU changes require deleting and recreating the group, so only the throttled API container needs the higher request.
If you picked AWhy it is tempting: The command looks like a low-disruption way to change a single container while keeping the deployment shape familiar.
Why it is wrong: ACI CPU and memory changes require deleting and recreating the container group.
If you picked BWhy it is tempting: The group has a total allocation, so it can look as if raising any container's request increases a shared pool.
Why it is wrong: Each ACI container receives the resources specified for that container; the group total is the sum of those per-container requests.
If you picked DWhy it is tempting: The API gets more CPU and both groups can still be privately reachable in the subnet.
Why it is wrong: If the requirement is to preserve the sidecar pattern, keep the containers in the same container group and adjust the constrained container's request there.
Question 6 of 10Deploy and Manage Azure Compute Resources
CramHQ runs an Azure Container Apps processor for 5G edge telemetry. Devices publish bursts to an Azure Event Hubs namespace; the container reads from a consumer group and has no inbound listener. Idle periods can last hours, but accumulated messages must drain quickly when bursts arrive. Which recommendation best controls replicas?
- AA. Configure a CPU scale rule with Utilization, set minReplicas to 1, and set maxReplicas for burst drain capacity.
- BB. Configure a custom Azure Event Hubs scale rule, set minReplicas to 0, and set maxReplicas for burst drain capacity.
- CC. Enable TCP ingress and configure a TCP scale rule with concurrentConnections, set minReplicas to 0, and set maxReplicas for burst drain capacity.
- DD. Enable internal ingress and configure an HTTP scale rule with concurrentRequests, set minReplicas to 0, and set maxReplicas for burst drain capacity.
Show answer and explanation
Answer: B
This aligns scaling with the Event Hubs demand seen by the consumer group. Azure Container Apps uses KEDA-backed custom rules for supported event sources and can create replicas from zero when external work appears.
If you picked AWhy it is tempting: CPU utilization feels useful for burst drain capacity because busy processors often need more replicas.
Why it is wrong: Use a scale signal that reflects the incoming work source. CPU rules react after replicas are running and do not provide scale-to-zero behavior for this event backlog pattern.
If you picked CWhy it is tempting: The option includes minReplicas set to 0 and maxReplicas for burst capacity, so part of the scaling shape looks right.
Why it is wrong: A TCP scale rule follows concurrent TCP connections to the app revision, not backlog in an Event Hubs consumer group.
If you picked DWhy it is tempting: HTTP scaling is a common Container Apps pattern, and minReplicas set to 0 matches the idle-period requirement.
Why it is wrong: Use HTTP scaling when workload arrives as HTTP requests to the app. Use an event-source custom rule when workload waits in Event Hubs.
Question 7 of 10Deploy and Manage Azure Compute Resources
CramHQ's AI Research Lab updated an ARM template for a resource group deployment. The run failed after creating some resources, and the next attempt must show whether the revised template would change or remove existing resources before it runs. Which recommendation best supports both decisions?
- AA. Run an Azure Resource Manager template validation operation for the failed template, then export the resource group template before starting the revised deployment.
- BB. Review the deployment operation details in Azure Resource Manager deployment history, then run an Azure Resource Manager template deployment what-if operation for the revised template.
- CC. Run an Azure Resource Manager template deployment what-if operation against the failed deployment, then review Azure Resource Manager deployment history before starting the revised deployment.
- DD. Review the Azure Activity log for the resource group, then run an Azure Resource Manager template validation operation for the revised template.
Show answer and explanation
Answer: B
Deployment history records the operations from the failed run and identifies the failed operation. The what-if operation evaluates the revised template against current state before deployment and reports planned creates, changes, and deletes.
If you picked AWhy it is tempting: Exporting a resource group can look useful because it produces template content based on existing resources.
Why it is wrong: Exported templates are reuse starting points; deployment what-if is the tool that previews planned creates, modifications, and deletes before deployment.
If you picked CWhy it is tempting: What-if sounds diagnostic because it compares templates with current state and reports changes.
Why it is wrong: What-if previews a proposed deployment before it runs; deployment history diagnoses operations from a run that already completed or failed.
If you picked DWhy it is tempting: The Activity log contains management events, so it can seem like the general troubleshooting place for resource group changes.
Why it is wrong: Use ARM deployment history and operation details to isolate the failed resource operation in a deployment.
Question 8 of 10Deploy and Manage Azure Compute Resources
CramHQ is moving a payments risk-scoring component from a test VM to production. During market hours it keeps most vCPUs busy for hours, uses only moderate memory, and has no dependency on locally attached data disks. The team wants predictable throughput without paying for memory it will not use. Which VM recommendation best fits the workload?
- AA. Use a Standard_Lsv3-series VM size and configure SSH public key authentication.
- BB. Use a Standard_Bsv2-series VM size and configure SSH public key authentication.
- CC. Use a Standard_Esv5-series VM size and configure SSH public key authentication.
- DD. Use a Standard_Fsv2-series VM size and configure SSH public key authentication.
Show answer and explanation
Answer: D
Fsv2 sizes are compute optimized and provide a high CPU-to-memory ratio, which fits a CPU-heavy service that needs predictable throughput without buying excess memory.
If you picked AWhy it is tempting: L-series sizes can look powerful for production workloads because they target high-throughput storage scenarios.
Why it is wrong: Use a storage-optimized family only when local disk latency, IOPS, or throughput is a stated workload driver.
If you picked BWhy it is tempting: Burstable sizes can be attractive for variable or low-average CPU workloads because they may reduce cost when demand is intermittent.
Why it is wrong: Use burstable VM sizes for workloads with occasional CPU spikes, not for sustained high CPU usage requiring predictable throughput.
If you picked CWhy it is tempting: Memory-optimized sizes can sound appropriate for important production systems because they provide more capacity headroom.
Why it is wrong: Choose memory-optimized sizes when high memory-to-vCPU ratio is a stated need, such as large databases, caches, or in-memory analytics.
Question 9 of 10Deploy and Manage Azure Compute Resources
CramHQ packages a root Bicep file that calls internal modules for a grid operations rollout. A release engineer renamed a parameter inside one module and put that new name in the pipeline's JSON parameter file. The run fails before resources are changed, even though the root file compiles. The team wants the smallest correction while keeping environment values outside source. What should you recommend?
- AA. Use az deployment group create with --template-file main.bicep and --parameters prod.parameters.json; add Bicep var declarations matching the renamed module input.
- BB. Use az deployment group create with --template-file modules/grid.bicep and --parameters prod.parameters.json; move the values to the module's param declarations.
- CC. Use az deployment group create with --template-file main.bicep and --parameters prod.parameters.json; update the file to set only the param declarations in main.bicep.
- DD. Use az deployment group create with --template-file main.bicep and --parameters prod.parameters.json; add the module's nested deployment parameters block to prod.parameters.json.
Show answer and explanation
Answer: C
This keeps the operation on the orchestrating file, so the rollout remains intact. The runtime values are accepted only for parameters declared by that file, which can then pass values inward.
If you picked AWhy it is tempting: The choice keeps the root file and external parameter file, so it appears to preserve the deployment structure.
Why it is wrong: Use parameters for environment-specific values supplied at deployment time; use variables only for values calculated inside the Bicep file.
If you picked BWhy it is tempting: Deploying the module can make the parameter names line up with the renamed input.
Why it is wrong: The parameters file must match the file submitted as the deployment entrypoint, and the entrypoint should remain the file that defines the intended rollout.
If you picked DWhy it is tempting: The root file still remains the entrypoint, and the module input name appears related to the failure.
Why it is wrong: The deployment parameters file binds to the submitted Bicep file only; nested module inputs are supplied by the root file's module params block.
Question 10 of 10Deploy and Manage Azure Compute Resources
CramHQ runs a stateful game backend on Azure VMs. Its data volume has tournament bursts, but measurements stay below 80,000 IOPS and 1,200 MB/s per disk. The storage team wants to tune purchased performance as seasons change without rebuilding striped sets or overbuying capacity. Which recommendation is best?
- AA. Use Premium SSD managed disks for the data volume and increase the disk size until the required performance tier is reached.
- BB. Use Standard SSD managed disks with Performance Plus enabled for the data volume and resize during tournaments.
- CC. Use Ultra Disk managed disks for the data volume and provision IOPS and throughput for the tournament peak.
- DD. Use Premium SSD v2 managed disks for the data volume and provision capacity, IOPS, and throughput independently.
Show answer and explanation
Answer: D
Premium SSD v2 supports production workloads with low latency and lets you adjust IOPS and throughput separately from disk size. The stated peaks fit within its documented per-disk limits, so it meets demand without capacity-driven overbuying.
“tune purchased performance as seasons change without rebuilding striped sets or overbuying capacity”
What to noticeThis points to a disk option where performance can be adjusted separately from disk size, so the team does not have to buy extra capacity just to get more IOPS or throughput.
How to decideCompare the choices by whether capacity, IOPS, and throughput can be provisioned independently, then eliminate options that rely on resizing or striping to reach performance.
If you picked AWhy it is tempting: Premium SSD managed disks are suitable for many production workloads, so resizing can look like a straightforward performance path.
Why it is wrong: When capacity, IOPS, and throughput must be tuned independently, choose a SKU that decouples performance from disk size.
If you picked BWhy it is tempting: Performance Plus makes Standard SSD sound more capable, and resizing during tournaments seems operationally flexible.
Why it is wrong: A disk SKU must meet the stated IOPS and throughput requirements before cost or resizing convenience can make it the best choice.
If you picked CWhy it is tempting: Ultra Disk supports very high performance and independent provisioning, so it can appear to satisfy every technical requirement.
Why it is wrong: Choose Ultra Disk when the workload needs its higher ceiling; choose Premium SSD v2 when its limits meet the measured demand and independent tuning is required.
