Examkin

Question

Difficulty: Very hardContainer-Based Workloads

A financial services company is designing a new event-driven transaction reconciliation system. The system consists of 15 microservices that run as Docker containers and scale dynamically based on the volume of messages in an Azure Service Bus queue.

The design must meet the following requirements:
- Support event-driven autoscaling using Kubernetes Event-driven Autoscaling (KEDA) specifications.
- Minimize administrative effort by avoiding the provisioning, patching, and management of container clusters, nodes, or control planes.
- Ensure strict network isolation between the development and production environments by routing all egress traffic through a centralized Azure Firewall.
- Isolate production logs from development logs in separate storage repositories to meet regulatory compliance, while preventing administrative overhead associated with managing log workspaces.

Which container hosting and logging solution should you recommend?

  1. A
    Deploy the microservices to a single Azure Container Apps Environment. Create separate container apps for development and production within the environment, and configure custom network security groups (NSGs) to control egress traffic through the Azure Firewall while routing all logs to a single Log Analytics workspace.
  2. B
    Deploy the microservices to a single Azure Kubernetes Service (AKS) cluster. Use Kubernetes namespaces to segregate the development and production workloads, configure network policies to control egress, and forward all logs to a single Log Analytics workspace.
  3. Deploy the microservices to two separate Azure Container Apps Environments (one for development and one for production) integrated with dedicated virtual networks. Configure virtual network routing to direct egress traffic through the central Azure Firewall, and associate each environment with a separate Log Analytics workspace.Answer
  4. D
    Deploy the microservices to two separate Azure Kubernetes Service (AKS) clusters with virtual nodes enabled. Configure virtual network peering to route traffic through the central Azure Firewall, and configure Azure Monitor Container Insights to route logs to a single centralized Log Analytics workspace.

Answer

Deploy the microservices to two separate Azure Container Apps Environments (one for development and one for production) integrated with dedicated virtual networks. Configure virtual network routing to direct egress traffic through the central Azure Firewall, and associate each environment with a separate Log Analytics workspace.
The correct design utilizes Azure Container Apps (ACA) because it is a serverless container platform that natively supports Kubernetes Event-driven Autoscaling (KEDA) scaling rules without the operational overhead of managing clusters, nodes, or control planes. To achieve strict network isolation, each environment is deployed into its own virtual network with custom route tables directing egress through the Azure Firewall. To satisfy regulatory logging compliance, separate Log Analytics workspaces are used for each Container Apps Environment, ensuring production data isolation while keeping management overhead low compared to managing a cluster-based logging agent configuration.

Step-by-Step Solution

1
Analyze compute and infrastructure management requirements.
Determine that the serverless requirement and the aversion to cluster/node provisioning rule out standard AKS, leading to Azure Container Apps (ACA) as the primary compute candidate.
ACA provides a fully managed, serverless container platform that automatically abstracts node management while supporting native KEDA-based scaling.
2
Evaluate network isolation and egress routing constraints.
Determine that a dual-environment virtual network configuration is required to separate development and production, allowing custom route tables to direct egress traffic through Azure Firewall.
Strict environment-level network boundaries cannot be securely maintained within a single Container Apps Environment or a single shared VNet without complex, error-prone configurations.
3
Assess the logging compliance and administrative overhead constraints.
Conclude that two separate Log Analytics workspaces must be deployed (one per Container Apps Environment).
This satisfies the regulatory segregation of production logs from development logs, while avoiding the overhead of managing a massive multi-workspace mesh or a single workspace that violates the compliance boundary.

Key Concept

Selecting the optimal container platform and isolation boundary under strict administrative, networking, and compliance constraints in Microsoft Azure.
Rate this question

Topics

Container-Based Workloads

More questions from this topic