Case study

Northwind Health — regulated container platform

Northwind Health runs a patient-facing intake application and several internal batch jobs on Azure Kubernetes Service, with images stored in Azure Container Registry.

A recent audit produced three findings. First, deployments reference image tags such as api:latest, and the audit could not prove which build was running in production during an incident. Second, several pods read a database password from a Kubernetes Secret that was committed to the deployment repository. Third, container images are pulled over the public internet, and the auditor requires that registry traffic never traverse it.

The intake workload is bursty: near zero overnight, then a sharp spike each morning. The batch jobs are interruptible and cost is a concern. The platform team also needs each workload to hold only the Azure permissions it actually needs, and must be able to prove which identity performed a given action.

Requirements

Provably immutable, verifiable image references in production
No long-lived secrets in the cluster or in source control
Registry traffic must not traverse the public internet
Scale to near zero overnight, absorb a morning spike
Reduce cost for interruptible batch workloads
Per-workload Azure identity with least privilege and an audit trail

Q47 AKS Domain 1 · 20–25% of exam Priority · Real Exam Choose 2

Which TWO node pool decisions best match the workload profile described?

A Run interruptible batch jobs on a Spot node pool with an eviction-tolerant controller (correct answer)
B Put system pods and the intake API on a Spot pool to cut cost
C Use a user node pool with the cluster autoscaler for the intake API (correct answer)
D Disable the cluster autoscaler and fix the node count at peak size
E Run everything on a single system node pool

Shortcut: Spot nodes are heavily discounted but can be evicted with 30 seconds' notice, which suits interruptible batch work only. The bursty intake API needs a user pool with the autoscaler so capacity follows the morning spike. System pods must never sit on Spot, and fixing the node count at peak wastes the overnight trough.

Which TWO node pool decisions best match the workload profile described?

More AKS questions