AI-200 cram sheet
Every flashcard fact for AI-200, condensed into one scannable page and grouped by exam domain. Built for the last hour before the exam — and for printing: use your browser's print or save-as-PDF and the navigation, sidebar, and controls drop away.
D1 · Containerized solutions 20–25%
| How do you build a container image in the cloud and push it to ACR with no local Docker? | az acr build --registry <reg> --image <name:tag> . — runs an ACR Task on managed compute and pushes the result. |
|---|---|
| Reduce image-pull latency for a multi-region app on one registry endpoint? | Enable geo-replication (Premium SKU): replicas per region behind one login server, network-close routing. |
| Copy a public image into ACR with no Docker engine and no rebuild? | az acr import (copies image bits between registries). az acr build rebuilds from a Dockerfile. |
| Guarantee every node pulls identical immutable image bits? | Reference the image by manifest digest (repo@sha256:...), not a mutable tag like :latest. |
| Requirements for Docker Content Trust (signed images)? | Premium tier + the AcrImageSigner role (in addition to AcrPush) to sign/push. |
| ACR: how do you store a signature or SBOM so it travels with its image? | As OCI referrers. `oras attach <image> --artifact-type sbom/example ./sbom.json:application/json` pushes the file as a reference to the subject image; `oras discover -o tree <image>` lists the graph (which can nest, e.g. a signature over an SBOM); `oras copy -r` promotes the whole graph between registries. Standalone artifacts use `oras push --artifact-type`. |
| Secret-free way for an Azure service to pull from ACR? | Managed identity + the AcrPull RBAC role on the registry. Avoid the shared admin user in production. |
| ACR connected registry: tier, default mode, and token types? | Premium tier only. Modes are ReadOnly (default, pull only) and ReadWrite (pull + push, synced up to the parent). A ReadOnly parent forces its children to ReadOnly. Two token types: client tokens (non-Entra, scope-mapped, for on-premises Docker clients) and an auto-generated sync token used to talk to the parent registry, which needs both the login server and the regional data endpoint. |
| ACR: what is a manifest list, and how do you build one? | A manifest list (OCI: image index) is a collection referencing one manifest per OS/architecture, so a single tag serves every platform and clients pull only their variant. Build the per-arch images (az acr build --platform Linux/arm64, default is Linux/AMD64), then `docker manifest create` + `docker manifest push`; the same commands work as `cmd` steps in a multi-step task. Inspect with docker manifest inspect or az acr manifest list-metadata. |
| Default retention for the ACR soft delete policy, and its main restriction? | 7 days by default, configurable 1–90 (az acr config soft-delete update --days N --status enabled). You cannot enable both soft delete and the retention policy, and it is unsupported on geo-replicated or artifact-cache registries. Restore with az acr manifest restore. |
| Three trigger types for ACR Tasks? | Source-code commit (git), base image update, and scheduled (timer). Base-image triggers auto-rebuild to apply OS/base patches. |
| Build → test → push in one ACR Task? | A multi-step task defined in a YAML file (build, cmd, push steps with dependencies). |
| ACR Tasks: how quickly does a base image update trigger a dependent task run? | Base image in an Azure container registry (same or any other region): immediately. Base image in a public Docker Hub or MCR repo: ACR Tasks polls at a random interval between 10 and 60 minutes. The task must have run at least once so the dependency was discovered, and the base image must carry a stable tag (node:20-alpine, not a new version tag). |
| ACR Tasks: does a build publish the image automatically? | az acr build (quick task) pushes to the registry by default. A `build` step inside a multi-step task does NOT — the design assumes build, then validate, then push, so you must add an explicit `push` step. Step type reference: build, push, cmd. |
| ACR Tasks: how many fields does a --schedule cron expression take, and in which time zone? | Five fields — {minute} {hour} {day} {month} {day-of-week} — interpreted by NCronTab, always in UTC with 24-hour times. The {second} and {year} fields used by Functions/Quartz expressions are NOT supported and must be stripped. Manage timers after creation with az acr task timer add / update / list / remove; multiple timers are allowed as long as their schedules differ. |
| ACR Tasks multi-step YAML: what does the `when` step property control? | Step ordering. when: ["-"] means no dependencies, so the step starts immediately (this is how you get parallel steps). when: ["id1","id2"] waits for those step ids. If `when` is omitted, the step depends on the step immediately above it in the file. Step ids also become the container name and its DNS host name for other steps. |
| Manifest objects for a stateless, replicated service with a stable endpoint? | A Deployment (replicas + rolling updates) plus a Service (stable virtual IP/DNS, load balancing). |
| Who adds nodes when pods are unschedulable vs scales pod replicas? | Cluster autoscaler adds/removes nodes; the Horizontal Pod Autoscaler scales pod replicas. |
| Withhold traffic during warm-up without restarting the container? | Readiness probe (removes pod from Service endpoints). A liveness probe failure restarts it. |
| Container exceeds its memory limit vs CPU limit — what happens? | Memory: OOMKilled (incompressible). CPU: throttled (compressible). |
| Which field does the scheduler use to place a pod, and what if none fits? | resource requests; if no node has enough allocatable capacity the pod stays Pending. |
| Expose a Secret as a file path (not an env var)? | Mount the Secret as a volume (each key becomes a file). secretKeyRef injects an env var instead. |
| Default Service type for internal-only, in-cluster access? | ClusterIP. LoadBalancer = public external IP; NodePort = per-node port. |
| AKS: one command to prove the cluster can reach and authenticate to an ACR? | az aks check-acr --name <cluster> --resource-group <rg> --acr <registry>.azurecr.io — validates DNS resolution, network routing and authentication from the cluster (optionally on a named node via --node-name). Note az acr check-health tests the machine you run it from, and --attach-acr is a fix (grants AcrPull to the kubelet identity), not a diagnostic. |
| AKS: the supported way to customize cluster DNS? | A ConfigMap named coredns-custom in the kube-system namespace — AKS owns the coredns ConfigMap and overwrites direct edits on upgrade/reconcile. Add .server or .override entries, kubectl apply, then kubectl -n kube-system rollout restart deployment coredns to reload without downtime. Check CoreDNS pods with kubectl get pods -n kube-system -l k8s-app=kube-dns. |
| See logs from a crashed (previous) container instance? | kubectl logs <pod> --previous — essential for diagnosing CrashLoopBackOff. |
| Get AKS container logs/metrics queryable with KQL? | Enable Azure Monitor Container Insights; data lands in a Log Analytics workspace. |
| How are App Service app settings surfaced to a container? | As environment variables at runtime — change config without rebuilding the image. Use WEBSITES_PORT to set the listening port. |
| Minimum plan tier for deployment slots? Which settings stay put on swap? | Standard+ (Std/Premium/Isolated). Slot-marked ("deployment slot setting") settings and custom domains do NOT move. |
| Which site setting tells App Service to pull its container image with a managed identity? | acrUseManagedIdentityCreds = true (az webapp config set --generic-configurations). For a user-assigned identity also set acrUserManagedIdentityID to its client ID. Grant AcrPull on the registry first. |
| App Service custom container: which app setting tells the platform which port your container listens on? | WEBSITES_PORT. App Service assumes port 80 unless this is set, and only one port can be exposed for HTTP. TLS is terminated at the front ends, so the container never sees TLS. (The portal SSH console uses port 2222 inside the container, configured in sshd_config.) |
| What exact syntax makes an App Service app setting resolve to a Key Vault secret? | @Microsoft.KeyVault(SecretUri=https://<vault>.vault.azure.net/secrets/<name>) or @Microsoft.KeyVault(VaultName=<vault>;SecretName=<name>[;SecretVersion=<ver>]). No code changes — the app reads it as a normal setting. |
| How long can a rotated Key Vault secret take to reach an App Service app, and how do you force it? | Up to 24 hours — App Service caches resolved references and refetches every 24 hours. Any config change restarts the app and refetches immediately; there is also a configreferences/appsettings/refresh POST. |
| Two prerequisites for an App Service Key Vault reference to resolve? | (1) A managed identity on the app — system-assigned by default, or a user-assigned one named in keyVaultReferenceIdentity. (2) Read access: Key Vault Secrets User (RBAC) or Get secrets (access policy). If it fails, the literal @Microsoft.KeyVault(...) string is passed through. |
| Two commands to stream a Linux custom container's own console output? | az webapp log config --docker-container-logging filesystem (turn it on), then az webapp log tail. Platform/Docker-host logs are on by default; application console logs are not. |
| App Service: image pulls fail from an ACR that is only reachable via private endpoint, even though the app is VNet-integrated. What is missing? | The site property vnetImagePullEnabled — VNet integration governs the app's own outbound traffic, but the platform image pull is a separate path that must be opted in: az resource update ... --resource-type "Microsoft.Web/sites" --set properties.vnetImagePullEnabled true. DNS inside the VNet must also resolve the registry to its private IP. |
| How many sidecar containers can a Linux App Service app have, and what do they share? | Up to nine sidecars per app, added in the Deployment Center, running in the same App Service plan as the one main container. The app's app settings are accessible to all containers. Sidecars supersede Docker Compose multi-container apps. |
| Default and range for WEBSITES_CONTAINER_START_TIME_LIMIT on Linux? | Default 230 seconds; range 10–1800. When exceeded the platform fails the startup attempt and retries, surfacing as 503s. Windows containers default to 10 minutes (00:01:00–00:15:00). |
| What powers event-driven autoscaling (incl. scale-to-zero) in Azure Container Apps? | KEDA scale rules (e.g., Service Bus queue length, Event Hubs, CPU/HTTP). Queue-based rules can scale to zero. |
| Requirement for splitting traffic across two revisions (canary)? | The app must be in multiple-revision mode; assign percentage traffic weights per revision. |
| Keep an internal microservice private to the Container Apps environment? | Set ingress to internal (environment/VNet-only) instead of external. |
| Default concurrent-request threshold for an HTTP scale rule? | 10 (--scale-rule-http-concurrency). Set it to tune when a replica is added. |
| Container Apps: revision labels vs traffic splitting? | A label gives a revision its own stable URL; move the label to another revision and the URL is unchanged. A label applies to exactly one revision at a time and needs no traffic allocation. Traffic splitting instead divides requests to the app's main URL by percentage weight. They are independent and can both be enabled — most useful in multiple revision mode. |
| Which Log Analytics table holds each Container Apps log type? | ContainerAppConsoleLogs_CL = app stdout/stderr (and Dapr sidecar). ContainerAppSystemLogs_CL = service events (revision provisioning, ErrImagePull, traffic weights, volume mounts). ContainerAppHTTPLogs = ingress records, enabled via a diagnostic setting on the environment. |
| Flags for az containerapp logs show, and what does 'This revision is scaled to zero' mean in Log stream? | --follow (real time), --tail 0–300 (default 20), --type console|system, --revision/--replica/--container. Streaming needs a running replica, so deploy a revision with min replicas ≥ 1 (or query Log Analytics for history). |
| What probes does Container Apps add when ingress is enabled and you define none? | Default startup, readiness and liveness probes — all TCP against the ingress target port (startup: failure threshold 240; readiness: timeout 5s, period 5s, initial delay 3s, failure threshold 48). A port mismatch or slow start yields a Degraded revision with 0/1 replicas ready. exec probes are not supported. |
| Azure Container Apps Sandboxes (preview): what are they and how are they structured? | A first-class Container Apps resource type (Microsoft.App/SandboxGroups) for fast, strongly isolated, ephemeral compute with suspend/resume. A sandbox group is the ARM management boundary; sandboxes, disk images (OCI), snapshots, volumes and secrets live inside it and are managed via a separate data plane. Snapshots capture memory + disk for sub-second resume; auto-suspend and auto-delete policies are configurable. Requires the Container Apps SandboxGroup Data Owner role. |
| What happens to running replicas when you change a Container Apps secret value? | Nothing automatically. Secrets are scoped to the application, not a revision, and adding/changing/removing one creates no new revision. Deploy a new revision or restart the existing one. (Key Vault-backed secrets without a pinned version do auto-refresh within 30 minutes and restart referencing revisions.) |
| Container Apps workload profiles: the three types and how each is allocated? | Consumption — serverless, scale to zero, billed per replica; includes serverless GPU (T4/A100) in select regions. Dedicated — reserved single-tenant pool, billed per node; general purpose (D), memory optimized (E), confidential compute (DC) and GPU (NC/A100). GPU-enabled Dedicated profiles must be configured at environment creation and need a support ticket for capacity. Flexible (preview) — Consumption-style billing on single-tenant compute, /25 subnet, cannot scale to zero. Every environment has a default Consumption profile. |
| How does the Dapr runtime reach app code in Container Apps? | As an injected sidecar exposing Dapr APIs over HTTP (port 3500) / gRPC (50001); components shared via the scopes array. |
| Container Apps + Dapr: where does the sidecar listen, and at what level is Dapr enabled? | Dapr is enabled at the container app level (the settings apply to every revision in multiple revision mode). The sidecar runs inside each replica on HTTP port 3500 and gRPC port 50001, so app code calls http://localhost:3500/v1.0/... . Components are environment-level resources whose `scopes` list Dapr application IDs (not container app names). Dapr is not supported for jobs, and actor reminders need minReplicas >= 1. |
| What does KEDA add over the default Kubernetes HPA? | Scaling on external event sources (queues/streams) and scale-to-zero, not just CPU/memory. |
| Scale on a clock (business hours), no event source? | KEDA cron scaler: timezone, start, end, desiredReplicas. |
D2 · Data management services 25–30%
| What are the default lease acquire, expiration, and renewal intervals for the Azure Cosmos DB change feed processor? | Lease acquire: every 17 seconds (a query on the lease container). Lease expiration: 60 seconds without renewal before another host can take the lease. Lease renewal: every 13 seconds (a replace on the lease). Lowering acquire or renewal speeds rebalancing and crash recovery but increases request unit consumption on the lease container; expiration must never be lower than the renewal interval. |
|---|---|
| Azure Cosmos DB change feed: latest version mode vs all versions and deletes mode. | Latest version (default): creates + updates only, latest version of each item, no deletes, no intermediate changes, but can start from the beginning of the container. All versions and deletes: every create/update/delete in order with operation-type metadata; NoSQL only; REQUIRES continuous backups; can start only from "now" or a saved lease/continuation. |
| PostgreSQL: is character(n) faster than text? | No — it is usually the SLOWEST of the three. character(n) blank-pads values to width n and stores them padded. text and varchar carry a 1-byte length header (4 bytes over 126 bytes) and no padding. The docs say to use text or varchar in most situations. |
| Azure Cosmos DB: why does an identity with Azure RBAC Contributor still get 403 on read_item? | Cosmos DB's data plane uses its OWN native RBAC, stored inside the account and separate from Azure RBAC. Control-plane roles manage the account but grant no data access. Assign a data-plane role — Cosmos DB Built-in Data Reader / Data Contributor (id ...0002) — with az cosmosdb sql role assignment create. |
| Azure Cosmos DB SDK: three client rules to remember. | Three rules: one client per app, match the concurrency model, and scope every query to a partition. Shared: create one CosmosClient per application and reuse it for the app's lifetime — it is thread-safe. Omit the partition key and the query fans out cross-partition, and you pay for it. C#: register the client as a singleton (AddSingleton / AddAzureClients). The v3 SDK is async-only — ReadItemAsync, GetItemQueryIterator. Scope a query with QueryRequestOptions.PartitionKey; omit it and v3 fans out cross-partition automatically. Python: hold one module-level instance. The sync client must never be used inside an async event loop — use azure.cosmos.aio.CosmosClient, install aiohttp, and close it (async with / await client.close()). query_items needs partition_key or enable_cross_partition_query=True. |
| Which operations does the default (latest-version) change feed emit? | Inserts and updates — NOT deletes. Use all-versions-and-deletes mode or soft deletes to capture deletes. |
| Reliable way to process the change feed with checkpointing? | The change feed processor (leases + checkpoints) or the Functions Cosmos DB trigger built on it. |
| Hierarchical partition key /Tenant/User/Session — which query is targeted? | One that filters a prefix starting at the first level (e.g. TenantId). Skipping the leading level fans out. |
| Combine vector + keyword (BM25) ranking in Cosmos NoSQL? | ORDER BY RANK RRF(VectorDistance(...), FullTextScore(...)); optional trailing weight array [2,1]. |
| Constraint on TransactionalBatch atomicity? | All operations must share one logical partition key (single partition). Bulk execution is cross-partition but NOT transactional. |
| Prevent a lost update on concurrent writes? | Optimistic concurrency: pass the item _etag as an If-Match condition; mismatch → HTTP 412. |
| Which Cosmos consistency gives read-your-writes at lower cost than strong? | Session consistency (per session token: read-your-writes + monotonic reads). |
| How do you avoid hot partitions in Cosmos DB? | Pick a high-cardinality partition key that evenly distributes request + storage load. |
| What does an HTTP 429 from Cosmos DB mean? | Request Units/s exhausted (throttling). Increase RU/s or enable autoscale; SDK retries with backoff. |
| Two key Cosmos SDK performance practices? | Reuse a singleton CosmosClient, and prefer point reads (id + partition key) over cross-partition queries. |
| Auto-expire ephemeral items in Cosmos DB? | Set Time to Live (TTL) at the container level or per item — the engine deletes them. |
| What must you configure for native vector search in Cosmos DB for NoSQL? | A vector embedding policy + a vector index; query with the VectorDistance() function. |
| Vector index type for large, high-dimensional sets in Cosmos DB for NoSQL? | DiskANN (flat / quantizedFlat exist for smaller sets). |
| Index type for >505-dimension embeddings at scale? | diskANN (or quantizedFlat) up to 4096 dims; flat is capped at 505 dims. |
| Fix connection exhaustion from bursty serverless clients on PostgreSQL? | Use a connection pooler (PgBouncer / built-in pooling) to multiplex clients onto fewer backend connections. |
| First step to do vector search on Azure Database for PostgreSQL? | Allow-list and CREATE EXTENSION vector (pgvector); store embeddings in a vector column. |
| Improve HNSW recall at query time (trading latency)? | Raise hnsw.ef_search (query-time candidate list). Build quality = m and ef_construction. |
| pgvector distance operators? | <-> L2, <=> cosine, <#> negative inner product — match the operator class (vector_l2_ops / vector_cosine_ops / vector_ip_ops). |
| HNSW vs IVFFlat build timing? | HNSW can build on an empty table; IVFFlat needs data loaded first (k-means centroids). HNSW defaults m=16, ef_construction=64. |
| Index types for ANN search in pgvector? | HNSW and IVFFlat, created with the matching operator class (e.g., vector_cosine_ops). |
| Scale out read-heavy retrieval on PostgreSQL? | Add read replicas and route read-only similarity queries to them. |
| Generate embeddings inside Postgres? | azure_ai extension: azure_openai.create_embeddings(deployment, text) → real[] (cast to vector). |
| Efficiently restrict RAG similarity search to one tenant in PostgreSQL? | Combine vector ORDER BY with a metadata WHERE filter (tenant_id = ...), supported by indexing. |
| Prevent a cache stampede on a hot key? | Single-flight/lock so one caller recomputes while others wait/serve stale, plus jittered TTLs. |
| Default eviction policy of Azure Managed Redis, and its gotcha? | volatile-lru — only evicts keys with a TTL; with no TTLs, writes eventually fail. Use allkeys-lru to evict any key. |
| Cache model responses with a 1-hour auto-expiry in Redis? | SET key value EX 3600 (TTL). Invalidate by deleting/overwriting the key. |
| Make Azure Managed Redis do similarity search? | Use the Redis query engine: create a vector index over embedding fields and run KNN/vector search. |
| Azure Database for PostgreSQL + Entra ID: what scope, and where does the token go? | Scope https://ossrdbms-aad.database.windows.net/.default (IMDS resource https://ossrdbms-aad.database.windows.net). The token is the PASSWORD; the user is the Entra principal or managed identity name. Tokens expire, so production code needs a refresh policy — reuse one credential object for token caching. |
| Azure Managed Redis Flash Optimized: what does it not support, and what breaks with big values? | RedisJSON is the ONLY module supported — no RediSearch/vector search, RedisBloom, RedisTimeSeries, active geo-replication or non-clustered mode. ~20% RAM / 80% flash; all key names live in RAM and oversized values are pinned to RAM, so keep values under ~512 KB or you get OOM while flash sits free. |
| PostgreSQL: which GIN operator class for jsonb, and what is the trade-off? | Default jsonb_ops supports ? ?| ?& @> @? @@. jsonb_path_ops indexes only path/value pairs — smaller and faster for containment (@>) but drops the key-existence operators. B-tree on jsonb only does whole-document equality/ordering, so it cannot serve a metadata filter. |
| pgvector: what is halfvec and when do you need it? | Half-precision vectors — 2 bytes per dimension instead of 4, so roughly half the storage. Also the route past the index ceiling: the vector type can be indexed up to 2,000 dimensions, halfvec up to 4,000, and binary quantization (bit) up to 64,000. Index with halfvec_cosine_ops / halfvec_l2_ops. |
| Which two parameters does Microsoft recommend setting to speed up index creation after a bulk load on Azure Database for PostgreSQL flexible server? | maintenance_work_mem (maximum 2 GB on flexible server) speeds index and foreign key creation, and max_parallel_maintenance_workers controls how many worker processes CREATE INDEX can use. Both can be set at the session level immediately before CREATE INDEX. |
| What starting values does Microsoft suggest for IVFFlat lists and probes? | lists = rows / 1000 for tables up to 1 million rows, and sqrt(rows) for larger datasets. probes = lists / 10 up to 1 million rows, and sqrt(lists) for larger datasets. lists is fixed at CREATE INDEX time; probes is set per connection or per transaction with SET / SET LOCAL ivfflat.probes. |
| PostgreSQL: when should you use json rather than jsonb? | Almost never. jsonb is decomposed binary — no reparsing, supports @> ? ?| ?& @? @@ and GIN indexing. json keeps the exact input text (whitespace, key order, duplicate keys) but has no index or containment support. Use json only when you genuinely depend on preserved key ordering. |
| Should you raise max_connections on Azure Database for PostgreSQL flexible server when you run out of connections? | No. Roughly 15 connections are reserved for replication and monitoring, and Microsoft advises against raising max_connections because each connection consumes memory and can cause crashes, high latency, and lock contention. Use the built-in PgBouncer in transaction mode instead, starting with a pool size of about 2 to 5 times the vCore count. |
| How much memory per vCore does each Azure Database for PostgreSQL compute tier provide? | Burstable: variable (credit-based, non-production). General Purpose: 4 GiB per vCore. Memory Optimized: 6.75 to 9.5 GiB per vCore. Memory Optimized is the choice when a vector index must stay resident in memory. |
| PostgreSQL: numeric vs double precision vs money — which for exact amounts? | numeric. It is exact and the docs recommend it for monetary amounts, at the cost of slow arithmetic. real/double precision are IEEE 754 and inexact — equality comparisons may not behave as expected. money has a fixed fractional precision set by lc_monetary (usually 2 dp). |
| PostgreSQL declarative partitioning: what must a primary key on a partitioned table include? | All partition key columns. Each partition's index can only enforce uniqueness within itself, so global uniqueness requires the partition key in the constraint. PARTITION BY RANGE (ingested_on) → PRIMARY KEY (chunk_id, ingested_on). Indexes created on the parent are propagated to every partition. |
| Azure Database for PostgreSQL: what automates creating and retiring monthly partitions? | pg_partman (allow it via azure.extensions) plus the pg_partman_bgw background worker in shared_preload_libraries. Register the parent in part_config; run_maintenance() pre-creates upcoming partitions and applies retention. pg_partman 5.x supports native range partitioning only — no trigger-based partitioning. |
| Entra auth to PostgreSQL fails with "Could not validate AAD user" — what is missing? | The matching database role. Connect to the postgres database as the Entra administrator and run: select * from pgaadauth_create_principal('<identity_name>', false, false); A plain CREATE ROLE creates a local role with no Entra binding and still fails. |
| How do you enable the built-in PgBouncer on Azure Database for PostgreSQL flexible server, what port does it use, and what is the default pooling mode? | Set pgbouncer.enabled to true on the Parameters pane — it is dynamic, so no restart is needed. PgBouncer listens on port 6432 on the same host name as the server (5432 remains the direct engine port). The default pgbouncer.pool_mode is transaction, which Microsoft recommends for most users. |
| What are the default values of pgbouncer.default_pool_size and pgbouncer.max_client_conn? | default_pool_size = 50 (server connections per user/database pair) and max_client_conn = 5000 (maximum client connections PgBouncer accepts). Other notable defaults: min_pool_size 0, query_wait_timeout 120 s, server_idle_timeout 600 s, max_prepared_statements 0. |
| Which Azure Database for PostgreSQL compute tier cannot use the built-in PgBouncer? | Burstable. Built-in PgBouncer is supported only on General Purpose and Memory Optimized; if you scale a server down to Burstable you lose the built-in PgBouncer capability. |
| What are the storage versus indexing dimension limits for pgvector on Azure Database for PostgreSQL? | You can store vectors with more than 2,000 dimensions, but you can only index a column with up to 2,000 dimensions (ivfflat or hnsw). The column must also have dimensions declared — indexing a bare 'vector' column fails with "column does not have dimensions". Use dimensionality reduction, partitioning, or sharding to work around the limit. |
| At what disk size does Premium SSD (v1) on Azure Database for PostgreSQL stop benefiting from host caching? | 4,096 GiB. Disks up to 4,095 GiB benefit from host caching (which can amplify read IOPS above the provisioned figure); at 4,096 GiB and above host caching is not supported, so reads come from the disk and count against disk IOPS and throughput limits. |
| What baseline IOPS and throughput does Premium SSD v2 provide on Azure Database for PostgreSQL, and what are the maximums? | Disks up to 399 GiB get 3,000 IOPS and 125 MB/s free; disks 400 GiB and larger get 12,000 IOPS and 500 MB/s free. You can scale up to 80,000 IOPS and 1,200 MB/s, configured independently of capacity (1 GiB increments, up to 64 TiB). Premium SSD v1 by contrast caps at 20,000 IOPS and 900 MB/s and ties IOPS to disk size. |
| How are keys distributed across shards in Azure Managed Redis, and how do you force related keys onto the same shard? | The keyspace is split into 16,384 hash slots distributed across cluster nodes; without a hash tag the whole key name is hashed, giving an even distribution. Enclose part of the key in braces to hash only that part — {key}1, {key}2, and {key}3 all land on the same shard. If you use hash tags, it is the application's responsibility to keep the distribution even. |
| Redis vector search: two gotchas that silently return the wrong number of results. | 1) FT.SEARCH's pagination LIMIT still defaults to 0 10, so a KNN 50 query returns 10 unless you add LIMIT 0 50. 2) EF_RUNTIME (default 10) is a per-query HNSW knob for recall, not a result cap — raise it for accuracy at the cost of latency. Vector queries also require DIALECT 2 or higher. |
| PostgreSQL: timestamptz vs timestamp — storage and semantics? | Both 8 bytes. timestamptz converts the input to UTC (using the given offset, or the TimeZone setting) and stores UTC, converting back to the session zone on output. timestamp without time zone silently DISCARDS any offset in the input. Use timestamptz for anything written from more than one place. |
D3 · Connect & consume services 20–25%
| What does continue-as-new do, and what is lost? | It restarts the orchestration with a new input, keeping the same instance ID but resetting the execution history — the way to write an infinite loop without unbounded history growth. Incomplete tasks (e.g. a pending timer) are discarded. C#: context.ContinueAsNew(input) — unprocessed external events are preserved by default (as in Java). Python: context.continue_as_new(input, save_events=True) — you must pass save_events=True or queued events are dropped. |
|---|---|
| What are the endpoint, header, and size limits for publishing to an Event Grid custom topic with an access key? | POST to https://<topic>.<region>.eventgrid.azure.net/api/events?api-version=2018-01-01 with the header aeg-sas-key and a JSON array body. Max 1 MB per array and per event; events over 64 KB are billed in 64-KB increments; batches delivered to subscribers cap at 5,000 events. Responses: 200 OK, 400 bad format, 401 bad key, 404 wrong endpoint, 413 too large. Microsoft Entra ID auth is recommended over keys. |
| Deliver only matching events to a subscriber? | Subject prefix/suffix filters or advanced filters on the event subscription. |
| Avoid losing events when a subscriber is down? | Event Grid retries with backoff; enable dead-lettering to a storage account for events that exhaust retries. |
| Interoperable, cross-platform event envelope in Event Grid? | The CloudEvents 1.0 schema (CNCF standard). |
| Consumer with no public endpoint that controls its own read pace? | Pull delivery on a namespace topic. Also: Event Grid has an MQTT v5 broker on namespaces. |
| How many triggers and bindings can a function have? | Exactly one trigger; zero or more input/output bindings. |
| Write to Cosmos DB from a function with minimal code? | Use a Cosmos DB output binding — declarative, no manual SDK CRUD. |
| Eliminate cold starts while keeping elastic scale for Functions? | Use the Premium plan (pre-warmed instances, VNet integration). |
| Run a function whenever Cosmos DB items change? | The Cosmos DB trigger (built on the change feed processor). |
| Coordinate a long, multi-step, stateful workflow in Functions? | Durable Functions: orchestrator + activity functions, wait-for-event, fan-out/in, durable state. |
| Run a function nightly at 02:00? | Timer trigger with NCRONTAB "0 0 2 * * *" (second minute hour day month day-of-week). |
| Serverless plan with scale-to-zero billing AND VNet integration? | Flex Consumption. Legacy Consumption has no VNet integration. |
| Which triggers honor [ExponentialBackoffRetry] natively? | Cosmos DB, Event Hubs, Kafka, Timer. Service Bus/Blob/Queue use their own extension retry/poison handling. |
| Reference an app setting vs trigger data in a binding? | App setting = %setting%; binding/trigger data = {queueTrigger}. HTTP admin authLevel needs the master (host) key. |
| Isolated worker vs in-process model? | Isolated runs out-of-process (LTS + non-LTS .NET), uses Microsoft.Azure.Functions.Worker.Extensions.*. In-process uses WebJobs.Extensions.*. |
| Millions of telemetry events/sec with replay? | Event Hubs (streaming ingestion + Capture). Service Bus = transactional msgs; Event Grid = reactive event routing. |
| Service Bus vs Event Grid — when to use each? | Service Bus = reliable commands/queues, ordering, sessions, transactions. Event Grid = lightweight reactive event fan-out with filtering + retries. |
| Where do poison messages go after exceeding max delivery count? | The dead-letter queue (DLQ) — inspect/remediate without blocking the main queue. |
| Deliver one event independently to multiple consumers? | Use a topic with multiple subscriptions (pub/sub); each subscription gets its own copy. A queue = one consumer. |
| Guarantee FIFO ordering for related messages? | Use sessions (set SessionId); the session locks to one receiver for ordered, stateful processing. |
| Avoid PeekLock expiry during long processing? | Renew the message lock periodically (or use automatic lock renewal). |
| Connect to Service Bus without SAS keys? | Entra ID auth via managed identity + RBAC (Azure Service Bus Data Sender/Receiver). |
| Lowest-overhead equality match on CorrelationId at a subscription? | A correlation filter (recommended over SQL filters, which lower throughput). SQL filters handle ranges/LIKE. |
| Can a subscription filter route on a value in the message body? | No — filters see properties only. Promote the value to a user property. |
| Scheduled vs deferred messages? | Scheduled = broker holds until ScheduledEnqueueTime. Deferred = receiver sets aside an already-received msg, retrieved later by sequence number. |
| Send 100 MB messages? | Premium tier over AMQP only. Standard caps at 256 KB; Premium over HTTP is 1 MB. |
| Which Azure Functions deployment methods require you to manually sync triggers? | External package URL, local Git, and FTPS. Sync by restarting the app or POSTing to the syncfunctiontriggers management API. You must also restart when you overwrite the package in place behind the same external URL — including on the first deployment. |
| How do you address a Service Bus dead-letter queue and a transfer dead-letter queue? | DLQ: <queue path>/$deadletterqueue or <topic path>/Subscriptions/<subscription>/$deadletterqueue. TDLQ (auto-forward / send-via failures) lives on the SOURCE entity: <queue path>/$Transfer/$DeadLetterQueue. In the .NET SDK set ServiceBusReceiverOptions.SubQueue to SubQueue.DeadLetter or SubQueue.TransferDeadLetter. DLQ messages ignore TTL, can't be dead-lettered again, and are never cleaned up automatically. |
| What is in the HTTP 202 payload returned by create-check-status-response? | id, statusQueryGetUri (also placed in the Location header — poll this for runtimeStatus and output), sendEventPostUri (raise an external event), terminatePostUri, and purgeHistoryDeleteUri. The client keeps getting 202 from the status URI until the instance finishes, then 200. |
| What are the tunable options on a Durable Functions automatic retry policy? | Max number of attempts (1 means no retries), first retry interval, backoff coefficient (rate of growth; defaults to 1), max retry interval (cap on any single wait), and retry timeout (cap on total time spent retrying; unlimited by default). Applies to activity and sub-orchestrator calls. |
| Which host.json settings throttle Durable Functions concurrency, and what are the Consumption defaults? | extensions.durableTask.maxConcurrentActivityFunctions (Consumption default 10) and maxConcurrentOrchestratorFunctions (Consumption default 5); on Dedicated/Premium both default to 10x the processor count. Lower maxConcurrentActivityFunctions to protect a rate-limited downstream API such as a model endpoint. |
| Durable entities: who can signal and who can call? | Calling is two-way (send an operation, wait for a result or error); signalling is one-way fire-and-forget with no observable result. Client functions can signal entities and read their state. Orchestrator functions can signal AND call. Entity functions can signal other entities. Each entity processes its operations serially, so there are no races within one entity. |
| What limits how many consumers can process an event hub in parallel? | The partition count. Within a consumer group, one exclusive (epoch) consumer owns a partition at a time, so processor instances beyond the partition count sit idle. Add consumer groups to let independent applications each read the whole stream; add partitions (Premium/Dedicated only, after creation) to add parallelism. A sender-supplied partition key keeps related events in one partition, in order. |
| How long does an event hub keep events, and what if you need them longer? | Retention is time-based and events cannot be deleted individually: Standard up to 7 days, Premium and Dedicated up to 90 days (default 1 hour). For long-term storage enable Event Hubs Capture, which writes the stream automatically to Blob Storage or Data Lake Storage (Avro by default, Parquet via the no-code editor). |
| Durable Functions: how do you wait for all tasks vs the first task, and what are the member names? | Wait-for-all resumes when every task has completed and returns their results — the fan-in half of fan-out/fan-in. Wait-for-any resumes on the first completion, used to race a durable timer against an external event or a slow activity to implement a timeout. C#: await Task.WhenAll(tasks) / await Task.WhenAny(tasks) over tasks created from the orchestration context (context.CreateTimer for the timer). Python: yield context.task_all(tasks) / yield context.task_any(tasks). |
| What do always-ready instances and instance memory size do in a Flex Consumption plan? | Always-ready keeps a minimum number of instances running per scale group (http, blob, durable, or function:<NAME>) to cut cold starts; default 0, billed even when idle, and minimum 2 per group when zone redundancy is on. Instance memory is 512 MB (0.25 core), 2048 MB (1 core), or 4096 MB (2 cores), changeable at any time; 2048 MB is the recommended default. |
| How is code deployed to a function app on the Flex Consumption plan? | Via one deploy, the only supported technology there. You choose a deployment storage blob container and an auth type (StorageAccountConnectionString, SystemAssignedIdentity, or UserAssignedIdentity) at app creation; tooling uploads the .zip there and the app runs from it. No deployment app settings are required, and a remote build is requested with a deploy-time parameter rather than ENABLE_ORYX_BUILD / SCM_DO_BUILD_DURING_DEPLOYMENT. |
| What are the two Azure Functions programming models in C# and in Python, and which is current? | C#: the ISOLATED WORKER model is the only one going forward — [Function] attributes on a class, running in a separate process from the host, so you pick the .NET version. The in-process model is retired; support ends 10 November 2026. Python: the V2 model is recommended — decorators on a func.FunctionApp in function_app.py (@app.route, @app.service_bus_queue_trigger, @app.cosmos_db_output) with no function.json; V1 (legacy) is one folder per function containing __init__.py with a main() plus a function.json describing the bindings. SDK type bindings are v2-only. |
| What is local.settings.json used for, and what is NOT published from it? | It configures the local Functions host only: IsEncrypted, a Values collection of app settings (AzureWebJobsStorage, FUNCTIONS_WORKER_RUNTIME, binding connections), a Host section (LocalHttpPort, CORS), and a ConnectionStrings object. It isn't deployed — everything the app needs at runtime must be added as an application setting in Azure. ConnectionStrings items are never published, and setting names can't contain a double underscore. |
| How must a Durable Functions orchestrator be declared? | C#: an async method taking the orchestration context — [Function(nameof(Run))] Task<T> Run([OrchestrationTrigger] TaskOrchestrationContext context) on the isolated worker (IDurableOrchestrationContext in-process) — and you await the context APIs: await context.CallActivityAsync(...). Python: an ordinary generator function, NEVER async def, using yield rather than await: yield context.call_activity(...). Coroutine semantics do not fit Python's replay model. In both languages the restriction applies only to the orchestrator; activity and client functions are unconstrained. |
| Which APIs must an orchestrator function avoid, and what replaces them? | Orchestrators replay, so they must be deterministic. Avoid: current date/time (use context.current_utc_datetime), random GUIDs (use the context's new_guid/new_uuid), random numbers and static variables, environment variables, input/output bindings, direct network I/O, and blocking sleeps (use durable timers). Anything nondeterministic belongs in an activity function, whose result is persisted in the history. |
| How does a function write to an output binding, and to more than one? | A single output can be returned directly from the function in both languages. A function has exactly one trigger but any number of other input and output bindings. Multiple outputs — C# (isolated): return a custom POCO whose properties each carry an output attribute ([QueueOutput], [BlobOutput], …), with the HTTP response as a separate property. The in-process model used out parameters and IAsyncCollector<T> instead. Python: declare them as parameters typed func.Out[str] / func.Out[bytes] / func.Out[func.Document] and write with .set(value). |
| How do you change one host.json value for a single environment without editing host.json? | Create an application setting named AzureFunctionsJobHost__<path>__to__<setting>, replacing each dot in the JSON path with a double underscore. Example: AzureFunctionsJobHost__logging__applicationInsights__samplingSettings__isEnabled = false. |
| What is Service Bus message session state and what are its limits? | An opaque, broker-stored binary annotation on a session, set and read with SetState / GetState on the session receiver, so a new processor can resume partially completed work. Size limit is one message: 256 KB on Standard, 100 MB on Premium. It counts toward the entity's storage quota, returns null when never set, is cleared by setting null, and survives even after every message in the session is consumed. |
| What makes Service Bus sessions work, and what do they guarantee? | The sender sets SessionId (AMQP group-id) on related messages and the queue or subscription is session-aware. A session receiver takes an exclusive lock on every message with that SessionId — present and future — so one session is strictly FIFO while other sessions run on other receivers. Standard and Premium tiers only; once enabled, clients can no longer send or receive non-session messages (peek still works). |
| How many deployment slots (including production) does each Functions hosting plan allow? | Consumption: 2. Premium: 3. Dedicated (App Service): 1–20. Container Apps uses revisions instead. Flex Consumption doesn't support slots — use rolling site updates for zero-downtime releases. |
| How do you split a large function app across multiple files? | C#: nothing special — the isolated worker discovers every [Function] attribute in the assembly, so put classes wherever you like. Python v2: blueprints. In another module create bp = func.Blueprint() and decorate functions on it, then in function_app.py call app.register_functions(bp) — without that registration the functions are simply not found. Durable Functions supports blueprints too via azure-functions-durable. |
| Which function app configuration is swapped between slots, and how do you stop a setting from swapping? | App settings and connection strings swap by default; publishing endpoints, custom domains, scale settings, IP restrictions, Always On, diagnostics, CORS, and private endpoints are always slot-specific. Mark a setting as a Deployment slot setting to make it sticky, and do it before the first swap for anything binding- or event-source-related. Define the same setting name with a different value in every slot. |
| Can an orchestration call an orchestrator in a different function app? | No. Sub-orchestrations (call-sub-orchestrator) must be defined in the same app as the parent. Across apps, start the remote orchestration over HTTP and follow the 202/Location polling pattern. Sub-orchestrations behave like activities to the caller: they return values, throw catchable exceptions, and support retry policies. |
| What is a task hub, and why change its name? | The task hub is the logical container for an app's queues, history, and instance tables. It is set by extensions.durableTask.hubName (default TestHubName). Give each app a distinct hub name to isolate multiple Durable Functions apps that share one storage back end — otherwise they consume each other's work items. |
| What do the two values of WEBSITE_RUN_FROM_PACKAGE mean, and which plans use which? | 1 = run from a local package in /home/data/SitePackages (recommended for Windows Consumption, and for Premium and Dedicated on either OS). <URL> = run from a package at a remote blob URL, and it is the only supported option for Linux Consumption. In both modes wwwroot becomes a read-only mount, portal editing is disabled, and remote build is suppressed. Never set it on Flex Consumption — it is deprecated there. |
D4 · Secure, monitor, troubleshoot 20–25%
| Alert processing rules: what do they do, and which action wins? | They modify alerts as they fire, rather than generating them. Two actions: Suppression (strips all action groups, so nothing notifies — the alert is still visible in the portal/API) and Apply action groups. Suppression has the higher priority when both apply. Scope + up to six filters, and an optional one-time or recurring schedule — the standard maintenance-window tool. Takes up to 30 minutes to take effect. |
|---|---|
| Detecting the absence of data — metric alert or log search alert? | Metric alert. Log search alerts are best at detecting the presence of specific data; log data is semi-structured and inherently more latent, so "query returned zero rows" rules misfire. If the signal only exists in logs, use metric alerts for logs to push it into the metric store first. |
| How do you make an app pick up Azure App Configuration changes without restarting? | Register a sentinel key for refresh and poll it; the default refresh interval is 30 seconds. C#: AddAzureAppConfiguration(o => o.Connect(...).ConfigureRefresh(r => r.Register("sentinel", refreshAll: true).SetRefreshInterval(TimeSpan.FromSeconds(30)))), then app.UseAzureAppConfiguration() so the middleware triggers the refresh per request. Python: load(..., refresh_on=[WatchKey("sentinel")], refresh_interval=30) then call config.refresh() yourself (e.g. at the top of each request handler); optionally pass on_refresh_success. Either way refresh returns immediately if the interval has not elapsed. Update the sentinel key LAST, after all other key-values — when it changes, all values are updated at once so the configuration stays consistent. |
| ChainedTokenCredential vs DefaultAzureCredential — when do you switch? | DefaultAzureCredential is a preconfigured chain you tear down with exclude_* keywords; ChainedTokenCredential is an empty chain you build up. Once you are setting several exclude_* flags, ChainedTokenCredential is the better choice and less code. Order it most- to least-used credential for performance, and in production prefer a single specific credential such as ManagedIdentityCredential. |
| In a DefaultAzureCredential chain, which failures skip to the next credential and which stop the chain? | Developer credentials (CLI, VS Code, Visual Studio, PowerShell, azd) are all attempted regardless of earlier failures. Deployed service credentials — EnvironmentCredential, ManagedIdentityCredential — stop the flow with a thrown exception if they are able to attempt token retrieval but do not get a token. So stale AZURE_CLIENT_SECRET variables on an Azure host block managed identity entirely. The distinction is the exception type: "not configured here" moves to the next credential, while a real authentication failure ends the chain. C#: CredentialUnavailableException moves on; AuthenticationFailedException ends the chain. Python: CredentialUnavailableError moves on; ClientAuthenticationError ends the chain. |
| DefaultAzureCredential: what order does it try credentials in, and where do C# and Python differ? | Same shape in both — deployed-service credentials first, then developer tooling, then interactive: Environment → Workload Identity → Managed Identity → [tooling] → Interactive browser (disabled by default). The first credential to return a token wins; nothing after it is attempted. The tooling segment is what differs. C#: Visual Studio → Azure CLI → Azure PowerShell → Azure Developer CLI. Python: Shared Token Cache (Windows) → Visual Studio Code → Azure CLI → Azure PowerShell → Azure Developer CLI, then Broker. |
| Centralize feature flags + config across services? | Azure App Configuration (keys with labels per environment, snapshots, dynamic refresh). |
| Store a sensitive value referenced from App Configuration? | Keep the secret in Key Vault and add a Key Vault reference in App Configuration. |
| Update a flag live without restarting apps? | Dynamic refresh with a sentinel/watched key and a poll interval. |
| Feature filter for specific users/groups + % rollout within a group? | Targeting filter. Time window filter = on during a time range only. |
| Immutable, named config set for controlled rollout / LKG rollback? | A snapshot — create + archive only (immutable). Labels are mutable. |
| Cut telemetry cost while keeping representative traces? | Adaptive sampling (reduces volume, corrects aggregate counts). |
| Share one identity across several apps, surviving recreation? | A user-assigned managed identity (standalone, attachable to many resources). |
| DefaultAzureCredential chain order (first few)? | Environment → Workload Identity → Managed Identity → developer tools. In production, prefer a specific deterministic credential. |
| Secret-free way for an app to read a Key Vault secret? | Managed identity + Key Vault Secrets User RBAC role (or get-secret access policy). |
| Pick up a rotated secret without redeploying? | Read the secret at runtime / use Key Vault references that re-resolve — never bake it into the image. |
| Keys vs Secrets vs Certificates? | Keys = crypto ops inside the vault/HSM (sign, wrap). Secrets = arbitrary values (passwords, conn strings). Certificates = X.509 lifecycle. |
| Least-privilege role to fully manage secrets (not keys/certs) under RBAC? | Key Vault Secrets Officer (read+set+delete secrets). Secrets User = read only; Administrator = everything. |
| Why does Key Vault Contributor fail to read a secret value? | It is a control-plane role (manage the vault), not data-plane. Need a data-plane role like Secrets User. |
| Risk when switching a vault from access policies to RBAC? | It invalidates all existing access-policy permissions — assign equivalent Azure roles first or callers lose access. |
| Soft-delete and purge protection defaults/behavior? | Soft-delete is on by default and can't be disabled. Purge protection blocks early permanent deletion even by admins. |
| Restrict Key Vault to your VNet only? | Add a private endpoint (Private Link) and disable public network access. |
| KQL pattern for the 10 newest exceptions in the last hour? | AppExceptions | where TimeGenerated > ago(1h) | order by TimeGenerated desc | take 10. |
| Count events per code in hourly buckets (KQL)? | summarize count() by ResultCode, bin(TimeGenerated, 1h). |
| Correlate two tables on operation_Id in KQL? | join on the shared key. (union just stacks rows; it does not match keys.) |
| Return the full most-recent row per group (not just the timestamp)? | summarize arg_max(TimeGenerated, *) by Key. max() returns only the value. |
| 95th-percentile duration per operation? | summarize percentile(DurationMs, 95) by OperationName — function is percentile(Column, Value). |
| Keep data queryable cheaply for 2 years beyond the analytics period? | Set the table's total retention (long-term, search-job access), keeping analytics retention short. |
| Alert when a KQL query crosses a threshold on a schedule? | A log search (scheduled query) alert rule with an action group. |
| Vendor-neutral standard for distributed tracing into App Insights? | OpenTelemetry SDKs/distro exporting traces, metrics, and logs to Azure Monitor / Application Insights. |
| Two services merge into one Application Map node — fix? | Give each a distinct cloud role name via the service.name resource attribute. |
| What links a child span to the originating request across services? | Propagated W3C trace context (traceparent: trace ID + parent span ID). |
| Client mitigation for HTTP 429 from a model endpoint? | Exponential backoff honoring Retry-After, plus batching/caching or higher quota. |
| Dynamic thresholds: what history do they need before they are trustworthy? | No alert fires before three days and at least 30 samples of data. About 10 days of history are used to learn hourly and daily seasonality; weekly seasonality needs roughly three weeks. Good for significant deviations, poor for slowly evolving drift. Not usable on multi-condition rules, nor on log search alerts with 1-minute frequency. |
| Where does the Azure Identity library cache access tokens, and what does that imply for your code? | In memory by default, scoped to the credential INSTANCE; persistent disk caching is opt-in. Construct the credential and the service client once at startup and reuse them — creating a new credential per request discards the cache and forces a fresh Entra token request every time. C#: opt into disk caching with TokenCachePersistenceOptions; register the credential and the client as singletons in DI (builder.Services.AddAzureClients(...)). Python: opt in with cache_persistence_options; hold module-level instances. |
| count() vs countif() vs dcount() vs count_distinct() in KQL? | count() counts rows in the group; countif(predicate) counts only rows matching the predicate, which lets you emit totals and subsets in one summarize (summarize total=count(), failed=countif(success == false)). dcount()/dcountif() give an APPROXIMATE distinct count (HyperLogLog based, with an accuracy parameter); count_distinct()/count_distinctif() give the exact unique count — use it when the number must be exact. |
| Why can a let-bound expression referenced three times in one query cost three times as much, and what fixes it? | let binds a name to a calculation, not to the evaluated value, so each reference re-evaluates it. Wrap the sub-query in materialize() to cache the result for the duration of query execution. (toscalar() is only for single scalar values; the view keyword only makes a parameter-less let participate in wildcard union.) let statements must end with a semicolon and cannot have blank lines between them. |
| What does mv-expand do, and what is its inverse? | mv-expand expands a dynamic array or property bag into multiple records — one row per element, with the non-expanded columns duplicated onto each row. Its inverse is summarize make_list()/make_set()/make-series. Options: kind=bag (default) vs kind=array for [key,value] pairs, with_itemindex=Name to emit a 0-based index column, and to typeof(T) to type the output (it defaults to dynamic). Expanding two columns zips them; expanding them one after another gives a Cartesian product. |
| KQL parse: what are kind=simple, kind=regex and kind=relaxed? | simple (the default) is a strict literal-delimiter match — if any extended column fails its declared type, every extracted column on that row is null. regex lets the delimiters be regular expressions (flags such as U for ungreedy, i for case-insensitive, s to match newlines). relaxed still requires the delimiters but allows partial type matching — only the columns that fail to convert become null. Use parse-where instead if you want non-matching rows dropped entirely. |
| What are the rules for the KQL render operator? | render must be the last operator in the query and works only on a single tabular stream. It does not modify data — it adds a Visualization annotation the client interprets. For timechart the first column is the x-axis and should be a datetime (so bucket with bin(timestamp, 1h) first); other numeric columns become y-axes and a string column splits the series. Azure Monitor supports areachart, barchart, columnchart, piechart, scatterchart, table and timechart. |
| Why is `has` faster than `contains` in KQL, and when does it give a different answer? | Kusto builds a term index over string columns for terms of three or more characters, and only the has-family operators use it; contains (and startswith/endswith) fall back to scanning every value. has is term-based, so "KustoExplorerQueryRun" has "Explorer" is false while ... contains "Explorer" is true. Also prefer the case-sensitive operator when both exist (== over =~, in over in~). |
| ago() vs between() for time filters in KQL? | where timestamp > ago(24h) is relative to query execution time — the window slides every time the query runs, which is right for dashboards and alerts. where timestamp between (datetime(2026-07-01) .. datetime(2026-07-02)) pins an absolute, inclusive window, which is right for incident reviews. Put the time filter as early as possible, and inside each union leg rather than after the union. |
| In KQL, what do union's kind, withsource and isfuzzy options do? | kind=outer (the default) keeps every column from every input, filling missing cells with null; kind=inner keeps only the columns common to all inputs. withsource=ColumnName adds a column naming the table each row came from. isfuzzy=true tolerates union legs that cannot be resolved, emitting a warning instead of failing (it errors only if no leg resolves). Filter each leg before the union for better performance, and avoid wildcard table names in Azure Monitor. |
| Does setting a Key Vault secret's exp attribute to the past stop applications from reading it? | No. exp and nbf are informational only — a secret get still succeeds outside the nbf/exp window, which is deliberate so that expired secrets can be retrieved for recovery and not-yet-valid ones for testing. The attribute that actually blocks retrieval is enabled (default true); set enabled=false. Operations between nbf and exp are permitted only when enabled is true. |
| App Service Key Vault references: which identity resolves them, and how do you change it? | The system-assigned identity by default. To use a user-assigned identity, set the app's keyVaultReferenceIdentity property to that identity's resource ID (set it back to "SystemAssigned" to revert). The identity needs Key Vault Secrets User under RBAC, or a Get secrets access policy. If it cannot resolve, the literal @Microsoft.KeyVault(...) string is used as the value. |
| How quickly does an App Service Key Vault reference pick up a rotated secret? | If the reference omits the version, the app uses the latest version and is updated automatically within 24 hours — App Service caches reference values and refetches on that cycle. Any configuration change restarts the app and refetches immediately, or POST to …/config/configreferences/appsettings/refresh to force resolution. |
| Live Metrics vs metrics explorer / Log Analytics — the four differences that matter | Latency: ~1 second vs aggregated over minutes. Retention: none (data is discarded once off the chart) vs 90 days. Delivery: streamed only while the pane is open vs always collected. Cost: free vs billed. All selected metrics and counters are transmitted; only the failure and stack-trace live feed is sampled. |
| Log search alert rule: what do Measure, Aggregation granularity and Split by dimensions each control? | Measure = what is counted: table rows, or a calculation over a numeric column. Aggregation granularity = the window over which records collapse to one value. Split by dimensions = group results by up to six string/number columns and evaluate (and fire) each group independently. Advanced options add "number of violations within an evaluation period", which needs a datetime column in the results. |
| A manually created span lands in the dependencies table with type InProc. How do you make it a request? | Create it with server kind. C#: activitySource.StartActivity("my request span", ActivityKind.Server). Python: tracer.start_as_current_span("my request span", kind=SpanKind.SERVER). By default a custom span/activity shows up under dependencies with dependency type InProc; server kind is the documented way to make a background job that autoinstrumentation does not capture appear as an incoming operation in the requests table (and as a node entry point on Application Map). |
| What does the W3C traceparent header contain, and how does it surface in Application Insights? | traceparent has four hyphen-separated fields: version (2 hex), trace-id (32 hex), parent-id / span-id (16 hex) and trace-flags (2 hex) — e.g. 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01. The trace-id is what appears as operation_Id, and the parent span-id as operation_ParentId. If a producer does not propagate traceparent (plus tracestate) and the consumer does not extract it, the consumer starts an unrelated trace and end-to-end transaction view splits in two. |
| Profiler for .NET vs Snapshot Debugger — which do you reach for? | Profiler: latency. Traces requests to the millisecond and shows the hot code path; triggers are sampling (~once an hour, briefly), CPU >80% and memory >80%; traces kept 15 days. Snapshot Debugger: exceptions. Captures a suspended clone of the process with source and variables when a problem ID is thrown at least twice (ThresholdForSnapshotting default 1), rate-limited to ~1 per 10 minutes and 50 per day. Neither costs extra to store. |
| SpanKind: which kind for a queue producer and its consumer, and why not CLIENT/SERVER? | PRODUCER for creating a job that may be processed asynchronously later; CONSUMER for processing a job created by a producer, possibly long after the producer span ended. CLIENT and SERVER are for synchronous outgoing and incoming remote calls; INTERNAL is for work that does not cross a process boundary. |
| How do you target a specific user-assigned managed identity from code? | C#: new ManagedIdentityCredential(ManagedIdentityId.FromUserAssignedClientId("…")) (also FromUserAssignedResourceId / FromUserAssignedObjectId), or new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = "…" }). Python: ManagedIdentityCredential(client_id="…"), or identity_config={"resource_id": …} / {"object_id": …}, or DefaultAzureCredential(managed_identity_client_id="…"). Either language can instead set AZURE_CLIENT_ID. Required whenever more than one user-assigned identity is attached — the identity endpoint cannot choose for you. |
| WorkloadIdentityCredential — what is it for? | Microsoft Entra Workload ID on Kubernetes. The pod's projected service account token is exchanged, via a federated identity credential on a user-assigned managed identity or app registration, for an Entra access token. No secret in the cluster, and it is pod-scoped — unlike ManagedIdentityCredential over IMDS, which resolves the node's identity. |
Use it as a check, not a first pass
If a line here is the first time you're meeting a fact, this sheet is doing the wrong job for you — go back to the domain notes and the quizzes. It works best as a rapid confirmation that recall is already automatic.