A developer changes the image tag of an Azure Container Apps app, and the new revision fails to provision. Running az containerapp logs show --name api --resource-group rg-ai --follow prints nothing about the failure. What should the developer do to see the messages the platform wrote about the revision?
Show answerHide answer
Answer: A
Why
az containerapp logs show streams console logs unless --type system is given. Console logs are what the containers write to stdout and stderr; system logs come from the Container Apps runtime and include revision provisioning events, such as Error provisioning revision with an error code like ErrImagePull.
Why not the others
BHTTP logs come from the ingress layer and describe request traffic, not revision provisioning.
CTelemetry from instrumented code covers what the application does once it runs; provisioning messages come from the platform and land in the system log.
D--tail only sets how many past messages are shown, from 0 to 300; the stream is still the console log.
A RAG service retrieves context from an Azure Cosmos DB for NoSQL container that holds about 5 million document chunks and has a diskANN vector index on /embedding. Its query takes the 10 nearest chunks, ordered by VectorDistance. An offline comparison with exact search shows that, for a small set of compliance questions, some of the true 10 nearest chunks are missing from the results. The team accepts higher latency and RU cost for those questions, but not a scan of every vector, and will not change the indexing policy. What should the service do for those questions?
Show answerHide answer
Answer: B
Why
diskANN is an approximate index whose recall can be tuned per query. A larger searchListSizeMultiplier in the options object of VectorDistance enlarges the search list, trading higher latency and RU cost for higher recall, and leaves other queries and the index unchanged.
Why not the others
Atrue makes VectorDistance use brute force instead of the index, a scan of every vector in scope, which the team ruled out.
CThat changes the indexing policy, which the team ruled out, and quantizedFlat is a brute-force index recommended when a search is scoped to 50,000 vectors or fewer.
DProvisioned throughput sets how many request units per second the container can serve; it does not change which neighbors the index returns.
A Python service in Azure Container Apps must connect to an Azure Database for PostgreSQL flexible server as the container app's system-assigned managed identity, with no stored database password. Signed in as the Microsoft Entra administrator, a DBA ran SELECT * FROM pgaadauth_create_principal('ca-rag-api', false, false); in the postgres database, where ca-rag-api is the container app's name. Which two values should the service use when it opens the connection? Choose two.
Show answerHide answer
Answers: A and C
Why
pgaadauth_create_principal created a database role named for the identity, and the flexible server accepts a Microsoft Entra access token in the password field. The identity signs in with that role name as the user name and a token issued for https://ossrdbms-aad.database.windows.net as the password.
Why not the others
BThat token is issued for Azure Resource Manager; the server takes tokens issued for https://ossrdbms-aad.database.windows.net.
DThat is a stored password for another login; the requirement is to sign in as the managed identity without one.
EThe role was created under the name ca-rag-api; no database role is named after the client ID.
Domain 3 / Task 3.1 Event- and message-based AI solutions
A Python service in Azure Container Apps publishes custom events to an Event Grid custom topic through EventGridPublisherClient with DefaultAzureCredential, which picks up the app's managed identity. Local authentication (access keys and SAS tokens) is disabled on the topic, and every publish call is rejected as unauthorized. Which role assignment lets the service publish with the least privilege?
Show answerHide answer
Answer: D
Why
Event Grid accepts a Microsoft Entra token for publishing only when the identity holds the Microsoft.EventGrid/events/send/action permission, which the built-in EventGrid Data Sender role carries. The role can be scoped to a single topic, the narrowest scope that covers this publisher.
Why not the others
AEventGrid Contributor manages Event Grid resources; its definition has no data actions, so it does not include the events/send permission.
BEventGrid EventSubscription Contributor manages event subscriptions and grants no permission to send events.
CThe role is right, but a subscription scope lets the identity publish to every topic in the subscription.
Domain 4 / Task 4.2 Monitor and troubleshoot Azure solutions
Each replica of a Python API writes a log line every minute to a workspace-based Application Insights resource. The lines land in the AppTraces table with the replica name in AppRoleInstance. During an incident, an operator wants one row per replica: that replica's most recent log line, with all of its columns. Which query returns that?
Show answerHide answer
Answer: A
Why
arg_max(TimeGenerated, *) finds the row with the largest TimeGenerated in each group and returns all of that row's columns, so grouping by AppRoleInstance gives each replica's latest line.
Why not the others
Bdistinct returns every distinct pair of replica and timestamp, one row per log line rather than one per replica.
Ctake_any picks an arbitrary record from each group, not the most recent one.
Dmax returns only the largest TimeGenerated for each replica; the other columns of that row are not returned.
The study bundle has two practice exams with 120 original questions, an answer key and an explanation for every answer, plus the 56-page study guide. Practice exam explanations are shorter than the ones on this page: a short paragraph per question, with no source links.
Study bundle
$19
120 practice questions / Study guide / Answer keys
Every bundle includes 6 months of access: download the PDFs, and any new editions, until 6 months after your purchase date. Your receipt has a license key. Enter it at overqual.com/download for the three PDFs, stamped with your email and order number. They are yours to keep.