Case study

Northwind Health — regulated container platform

Northwind Health runs a patient-facing intake application and several internal batch jobs on Azure Kubernetes Service, with images stored in Azure Container Registry.

A recent audit produced three findings. First, deployments reference image tags such as api:latest, and the audit could not prove which build was running in production during an incident. Second, several pods read a database password from a Kubernetes Secret that was committed to the deployment repository. Third, container images are pulled over the public internet, and the auditor requires that registry traffic never traverse it.

The intake workload is bursty: near zero overnight, then a sharp spike each morning. The batch jobs are interruptible and cost is a concern. The platform team also needs each workload to hold only the Azure permissions it actually needs, and must be able to prove which identity performed a given action.

Requirements

Provably immutable, verifiable image references in production
No long-lived secrets in the cluster or in source control
Registry traffic must not traverse the public internet
Scale to near zero overnight, absorb a morning spike
Reduce cost for interruptible batch workloads
Per-workload Azure identity with least privilege and an audit trail

Q48 Container Apps Domain 1 · 20–25% of exam Priority · Real Exam

A separate internal API is being moved to Container Apps and must scale to zero overnight. Which scaling configuration achieves this?

A minReplicas 1 with a CPU rule
B minReplicas 0 with an HTTP concurrency rule (correct answer)
C A fixed replica count of 2
D A CPU rule alone with minReplicas 0

Shortcut: Scale to zero requires minReplicas 0 together with an event-driven or HTTP rule, because KEDA needs a signal that can be evaluated while no replica is running. A CPU rule cannot scale from zero: with no replica there is no CPU metric to read.

A separate internal API is being moved to Container Apps and must scale to zero overnight. Which scaling configuration achieves this?

More Container Apps questions