Microsoft AZ-104 Exam Dumps, Practice Test Questions

The Failed container-group state signals an unsuccessful run or provisioning/runtime failure, not the ordinary successful end of a one-shot task. A process that exits with code 0 has met the job completion condition. Interpreting every Terminated container as a failed group would trigger unnecessary incident response and duplicate exports.

Running describes a container group currently operating. The Never restart policy is designed to allow a one-off workload to stop after a successful exit, so Azure does not keep an empty application process running forever merely because completion was successful. An operator should inspect exit code and the group state rather than infer work from the old resource existence.

Pending applies while a container group is waiting to initialize or complete launch prerequisites, not after a process has finished successfully with exit code 0. A finished Never-policy job can reach Succeeded. Treating completed work as an image-pull or scheduling wait misdirects troubleshooting and may cause the operator to start the workload twice.

The policy is not an exact three-retry scheduling system. Azure does not promise the specific pattern in the proposed option.

Never is one of the supported ACI container-group restart policy choices; it is not confined to VM scale sets.

The absolute no-restart guarantee is stronger than the platform documentation supports for failures. Critical at-most-once processing needs idempotency or external execution control.

A name does not supply supported public routing to an ACI group injected into a private VNet. The design requires a separately supported ingress path such as an appropriate proxy or gateway.

An NSG rule only controls flows through the existing private subnet; it does not allocate an Internet-routable frontend address. Public ingress needs an explicitly deployed ingress design.

Peering permits eligible private cross-VNet traffic, not global public access. Public clients still need a supported reachable frontend and routing path.

Opening a port inside the container is necessary for the TLS listener but cannot create an Internet-routable address or discoverable hostname when the group remains private. External clients still cannot reach it without the supported public ingress configuration.

A DNS label does not create Internet routing for a private endpoint. Clients need a public IP address, DNS label and the appropriate exposed listening port on a container group that supports public ingress.

A public address and hostname are not enough for clients to reach the TLS listener if no corresponding inbound TCP port is exposed. Public IP, discoverable label, and listener port must match the application endpoint.

Replacing a single revision moves essentially all routed requests to the candidate at once. It does not preserve the required 90 percent old-version exposure during a canary.

Replicas add scale for one revision. They cannot split ingress requests between two distinct application revisions while only one revision remains active.

DNS records do not implement deterministic percentage routing for requests across active Container Apps revisions. The native traffic weights are the direct feature.

A nonzero minimum keeps a replica running, so it fails the stated ability to scale to zero during idle periods. A Service Bus event-driven KEDA rule enables scale-out when queued messages arrive.

Event Hubs and Service Bus are different trigger sources; using the wrong scaler cannot correctly track this Service Bus queue's pending messages. Configure the Service Bus scaler and its authentication.

The worker receives Service Bus messages rather than HTTP requests; an HTTP-only trigger cannot reliably observe the queued work needed to scale it.

An externally accessible ingress endpoint remains reachable even if its name is hard to guess. Naming obscurity is not the required network boundary.

Without ingress the app does not expose the expected HTTP receiving endpoint to other environment services. This fails its internal service role.

Azure RBAC governs management operations on the Container App resource, not whether the public ingress endpoint is published. On a public environment, external ingress remains publicly reachable; internal ingress limits traffic to other apps in the same environment, as required.

Ingress is a shared application-scope configuration. Revision creation is driven by changes to the revision-scope template, such as an image or scale template edit, not by every ingress update.

A container image is a revision-scope template property; changing it is a common reason for a new revision.

Application-scope secret updates do not by themselves create a new revision; existing containers may need a restart or revision deployment to consume new secret values. Image changes are revision-scoped.

Revision labels are routing metadata and do not serve as protected runtime secrets used for database authentication.

Base64 is reversible encoding; embedding it in an image layer or template leaves the credential exposed to anyone who can inspect that artifact.

This reproduces the original leak through source control and deployment manifests rather than referencing a protected secret setting.

A separate VM scale-set rule does not change how Container Apps decides replica count for incoming HTTP requests.

A fixed minimum raises baseline capacity but does not allow additional replicas to respond dynamically to bursts.

A Service Bus custom scaler can scale a container app when queue backlog changes, but the stem explicitly describes traffic arriving through HTTP ingress with no queue-processing workload. It would not track concurrent HTTP requests. The built-in HTTP scale rule is the mechanism that reacts to this scenario’s request-concurrency signal.

Process environment variables are set when the container starts. Updating the shared secret definition does not automatically replace their in-memory values.

Traffic splitting changes request routing across revisions; it does not restart the existing container process or refresh an already-read environment variable.

Changing the maximum replica limit does not force all existing containers to restart or reload their process environment. After rotating an app secret used via environment variables, restart the active revision or deploy an appropriate new revision.