Task 3.3: Provision and manage containers in the Azure portal

• AUpgrade crcorp to Premium and add a replica

  Correct

  Geo-replication is a Premium feature; after the upgrade you add a replica in the second region.

• BImport the images into a second Standard registry

  Incorrect

  Two registries would need separate names and pushes; that isn't one registry with replicas.

• CTurn on zone redundancy for crcorp

  Incorrect

  Zone redundancy, on by default for every SKU in supported regions, spreads a registry across zones in one region; it doesn't create a replica in another region.

• DEnable the admin user on crcorp

  Incorrect

  The admin account is a sign-in option; it has no effect on where images are stored.

Basic, Standard and Premium share the same APIs, but Premium adds features such as geo-replication and private endpoints. A geo-replicated registry is one registry name with replicas in several regions.

• AAlways

  Incorrect

  Always restarts the container whenever it exits, even after success, so the job would run again and again.

• BOnFailure

  Correct

  OnFailure restarts the containers only when the process exits with an error, and leaves them stopped after success.

• CNever

  Incorrect

  Never only guarantees no restart after a successful exit; it doesn't promise a restart when the job fails, as OnFailure does.

• DUnless-stopped

  Incorrect

  Unless-stopped is a Docker restart policy; Container Instances supports Always, OnFailure and Never.

Container Instances offers three restart policies: Always (the default), OnFailure and Never. Run-to-completion work uses OnFailure or Never, and OnFailure adds retries when the process fails.

• AAzure Container Apps with minimum replicas 0 and an HTTP rule

  Correct

  Container Apps scales on concurrent HTTP requests and can scale to zero, and there are no usage charges at zero replicas.

• BAzure Container Instances with the Always restart policy

  Incorrect

  A container group bills while its containers run, and the restart policy adds no scaling on HTTP requests.

• CAzure Container Apps with minimum replicas 1 and a CPU scale rule

  Incorrect

  One replica stays running at all times, so the app is billed while idle.

• DAzure Container Instances with a liveness probe on the API port

  Incorrect

  Probes restart unhealthy containers; they don't scale the group on HTTP load or to zero.

Container Apps uses KEDA-based scale rules, including HTTP concurrency, and can scale in to zero replicas, at which point no usage charges apply. Container Instances runs a fixed container group without autoscaling.

• AA standard environment variable

  Incorrect

  Standard variables are visible in the container's properties.

• BA label on the container group

  Incorrect

  Labels are metadata and aren't secret.

• CA command-line argument with the password

  Incorrect

  Arguments appear in the container's configuration.

• DA secure environment variable

  Correct

  Secure values hide sensitive data such as passwords from the container's properties.

Container Instances supports secure values for environment variables, for both Linux and Windows containers, so secrets aren't shown with the rest of the configuration.

• AA CPU scale rule with min replicas 0

  Incorrect

  A CPU rule measures load on running replicas, so it can't see messages waiting while the app is at zero.

• BAn HTTP scale rule on concurrent HTTP requests

  Incorrect

  The worker receives no HTTP requests, so the rule would never trigger.

• CA TCP scale rule on concurrent connections

  Incorrect

  TCP rules scale on network connections, not queue depth.

• DA custom scale rule for the Service Bus queue

  Correct

  Custom KEDA rules scale on event sources such as a Service Bus queue's message count.

Container Apps uses KEDA. Custom rules cover event sources such as Service Bus queues and can scale in to zero; HTTP and TCP rules follow traffic.

• AA Dedicated workload profile for the demanding apps

  Correct

  Dedicated profiles run on reserved compute of a chosen size, alongside the default Consumption profile.

• BMore replicas on the Consumption profile

  Incorrect

  More replicas add capacity but not a larger or reserved machine type.

• CA virtual network with a NAT gateway

  Incorrect

  Networking changes don't change the compute an app runs on.

• DA second environment with a Premium App Service plan

  Incorrect

  App Service plans don't host Container Apps.

Each environment has a Consumption profile. You can add Dedicated profiles, with a chosen VM size, and assign apps to the profile that fits them.

• AEnable the admin user and publish its credentials

  Incorrect

  The admin account always has push as well as pull access and is meant for a single user, so sharing it would let anyone push.

• BAssign AcrPull on crtools to all users in your tenant

  Incorrect

  Role assignments apply to identities that authenticate with Microsoft Entra ID; people who don't sign in get nothing from them.

• CAllow public network access to crtools from all networks

  Incorrect

  Network access only decides who can reach the registry; pulls still need authentication by default.

• DUpgrade crtools to Standard and enable anonymous pull access

  Correct

  Anonymous pull is offered in the Standard and Premium tiers and opens only pull to unauthenticated clients; pushes still need an identity.

By default only authenticated clients can pull from or push to a registry. Anonymous pull access, available in Standard and Premium, makes all of the registry's content publicly readable while every other operation still requires sign-in. It applies to all repositories in the registry, so keep private images in a different registry.