Home › Certifications › Microsoft Azure Administrator AZ-104 › Compute — Containers and App Service
25 multiple-choice questions and 13 flashcards on Compute — Containers and App Service, about 9% of the Microsoft Azure Administrator AZ-104 bank. Every one carries a written rationale.
Compute — Containers and App Service is one of 6 chapters in CoStudy's Microsoft Azure Administrator (AZ-104) bank, and it holds 25 of the bank's 280 multiple-choice questions — roughly 9% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
A web app must reach a database that only accepts traffic from a specific subnet in a virtual network. The app runs on a Standard App Service plan. Which action is required?
Answer: C — Enable regional virtual network integration on a plan tier that supports it
C) Correct — virtual network integration routes the app's outbound traffic through a delegated subnet, which is the mechanism for reaching resources restricted to the network; the plan must be on a supporting tier. A) A private endpoint controls inbound access to the app, which is the opposite direction to the requirement. B) Service endpoints are configured on the subnet that hosts the client, and they do not accept an app's public IP as a source. D) Resource groups are a management boundary and never place compute inside a virtual network.
A web app on an App Service plan is running out of memory per request, though the number of concurrent users is stable and low. Which action addresses the problem MOST directly?
Answer: A — Scale up the plan to a tier with more memory per instance
A) Correct — scaling up changes the size of each worker, which is the answer when a single instance lacks resources rather than when there are too many requests. B) Scaling out multiplies instances and helps with concurrency, but each instance still has the same insufficient memory. C) A slot swap restarts the app and may mask the symptom briefly; it changes no resource limit. D) Always On prevents idle unloading and does not add memory.
A nightly batch job runs for about twenty minutes in a single container, needs no ingress, and should incur no cost between runs. Which compute option is the MOST appropriate?
Answer: D — Azure Container Instances with a container group whose restart policy is never
D) Correct — Container Instances runs a container group on demand and bills per second while it runs, and a restart policy of never suits a job that should exit and stop billing. C) Container Apps suits long-lived or event-driven microservices, and an HTTP rule with a minimum replica keeps capacity, and cost, running. A) An App Service plan reserves compute continuously, so idle time is still charged. B) A scale set adds virtual machine management overhead for a task that needs one short-lived container.
A container group in Azure Container Instances must expose two containers that talk to each other over localhost and share a mounted file share. Which statement is accurate?
Answer: A — Containers in one container group share a lifecycle, network namespace and mounted volumes
A) Correct — a container group is the scheduling unit; its containers are co-located on the same host, share the network namespace and can mount the same volumes. B) The group has one address, and containers reach each other on localhost with different ports. C) Multiple containers in a group can mount the same file share volume. D) Traffic between containers in a group stays local and never leaves through the public address.
A custom domain must be bound to a web app, and the certificate authority requires proof that the organisation controls the domain. Which record type is used to prove domain ownership to App Service?
Answer: A — A TXT record containing the verification identifier for the app
A) Correct — App Service domain verification uses a TXT record holding the app's custom domain verification identifier, alongside a CNAME or A record for traffic. B) MX records route mail and have no role in web domain verification. C) SRV records advertise service endpoints for protocols such as SIP, not web app ownership. D) Delegating the zone to Azure DNS is optional and is not itself the ownership proof.
An App Service autoscale rule adds one instance when average processor time exceeds a threshold. Users still report slow responses during traffic peaks, and the metric chart shows the threshold is crossed only briefly each time. Which change is the MOST appropriate NEXT step?
Answer: B — Lower the threshold and increase the instance count added per scale-out action
B) Correct — a threshold crossed only briefly with a single-instance increment means capacity arrives too late and too small, so lowering the trigger point and adding more instances per action is the targeted fix. A) A fixed maximum removes elasticity and inflates cost, which is a heavier change than the evidence warrants. C) Lower tiers offer fewer instances and weaker hardware, and some do not support autoscale at all. D) There is no platform request queue that substitutes for capacity.
Which App Service plan tier is the minimum required to use deployment slots?
Answer: C — Standard or any higher tier, which includes deployment slots.
C is right because deployment slots first appear at Standard, and higher tiers simply raise the slot count. A is wrong because Free and Shared plans have no slot capability and no dedicated instances to host one. B is the classic off-by-one tier answer: Basic gives dedicated compute and custom TLS but no slots. D is true that Premium supports slots, but it is not the minimum tier the question asks for.
An ACI container instance is created with restart policy 'Always'. The container exits with code 0. What happens?
Answer: A — Container is restarted.
'Always' restart policy restarts regardless of exit code. 'OnFailure' restarts only on non-zero exit. 'Never' never restarts. Off-by-one policy trap: candidates conflate Always with OnFailure.
A team uses a staging deployment slot and swaps it into production. Some application settings must always stay with the slot they are configured in rather than following the code during a swap. How is this achieved?
Answer: A — Mark those settings as deployment slot settings so they remain bound to the slot
A) Correct — a setting marked as a slot setting is sticky and does not move during a swap, which is how environment-specific connection strings and settings are kept correct. B) Leaving staging without a value means staging runs against production configuration before the swap. C) Swap with preview lets you validate with the target configuration applied, but it does not make settings sticky. D) App Service plans hold compute configuration, not application settings.
During a slot swap, the team wants the incoming code warmed up and validated against production configuration before any traffic moves. Which approach meets this?
Answer: B — Perform a swap with preview, completing the swap after validating the staging URL
B) Correct — swap with preview applies the production configuration to the staging slot and warms it, letting the team test before completing the swap. C) Traffic routing is useful for gradual exposure but it sends real users to the untested build, which the requirement avoids. A) Always On keeps an app loaded but does not apply target configuration for validation. D) Restarting production adds an outage and validates nothing about the incoming build.
4 cards from the 13 in this chapter.
What are the Azure Container Registry service tiers and what mainly separates them?
Basic, Standard and Premium. They differ in included storage, throughput and image throughput limits; Premium adds geo-replication, content trust, private endpoints and customer-managed keys. All tiers offer the same programmatic capabilities and the same registry API.
App Service plan tiers?
Free, Shared, Basic, Standard, Premium, Isolated. Scale up/out depending on tier.
What happens during an App Service slot swap, and what is the benefit of warm-up?
The slots exchange their virtual IP mappings after the target settings are applied to the source instances and the source is warmed up. Because the workers are already started and warm when traffic moves, the swap avoids cold-start latency, and a swap back restores the previous version almost instantly.
What does marking an app setting or connection string as a deployment slot setting do?
It pins that setting to the slot, so it does not travel during a swap. Settings not marked as slot settings move with the application content. This is how a staging slot keeps pointing at a test database while production keeps its own connection string across repeated swaps.
These are a sample. The full Compute — Containers and App Service chapter runs 38 items with per-chapter progress tracking, on the web and in the iOS app.
Open Microsoft Azure Administrator AZ-104 in CoStudy →
All Microsoft Azure Administrator AZ-104 practice questions →