Problem-solution sets
Microsoft calls these problem-solution question sets. You get one scenario and one goal, then several different proposed solutions — you judge each one Yes or No on its own.
Two rules make them harder than they look, and both are real:
- You cannot go back. Once you answer and move on, the question is closed, and it never reappears on the review screen.
- More than one solution may work — or none at all. They are not "pick the best one" in disguise; judge each against the goal independently.
A background image-processing service runs in Azure Container Apps. It reads work items from an Azure Service Bus queue and writes results to Blob Storage. It serves no HTTP traffic of any kind.
Overnight and at weekends the queue is empty for hours at a time, but the team is still billed for idle replicas. During the working day the backlog can reach several thousand messages within minutes.
Goal: The container app must run zero replicas while the queue is empty, and add replicas automatically as the Service Bus queue backlog grows.
A container app in a Container Apps environment deploys an image from a Premium Azure Container Registry in the same subscription. Security policy forbids storing any registry credential anywhere, including in Azure Key Vault, and the registry's admin account has been disabled at the resource level.
The deployment is performed by an Azure Pipelines job that runs az containerapp update with a new image tag.
Goal: The container app must pull its image from an Azure Container Registry without any registry password being stored in the app configuration, in a pipeline variable, or in a Key Vault.
An AKS cluster and an Azure Container Registry are in the same subscription. Pods referencing images in that registry are stuck in ImagePullBackOff, and kubectl describe shows an unauthorized response from the registry. The cluster was created without registry integration and the team does not want to maintain an imagePullSecret.
The registry's admin account is disabled and the cluster uses a managed identity.
Goal: Pods in an AKS cluster must successfully pull images from an Azure Container Registry in the same subscription, using cluster identity rather than an imagePullSecret.
A retrieval API queries a pgvector table of 2 million 1536-dimension embeddings on a General Purpose Azure Database for PostgreSQL flexible server with 8 vCores. There is no index on the embedding column. EXPLAIN ANALYZE shows a sequential scan with the distance computed for every row.
The application opens a new connection per request and pools nothing. At 200 concurrent users the server logs 'sorry, too many clients already', and p95 latency exceeds two seconds.
Recall is currently perfect and the product owner will not accept a measurable drop in answer quality.
Goal: Bring p95 latency for the vector search endpoint below 300 ms at 200 concurrent users, without reducing recall.
A container in Azure Cosmos DB for NoSQL holds 12 million document chunks with their embeddings, provisioned at 20,000 RU/s manual throughput. Daytime read traffic uses roughly 6,000 RU/s.
Every night a job re-embeds changed documents and writes them back. The writes exhaust the provisioned throughput within minutes and the SDK reports sustained 429s; the job has been overrunning its window.
The container's indexing policy is the default, which indexes every path including the 1536-element embedding array.
Goal: Complete the nightly re-embedding job inside its four-hour window without the client seeing sustained 429s, and without paying for the peak throughput during the day.
A custom topic fans out order events to three subscribers. One subscriber runs in a datacentre that was unreachable for four hours during a recent incident. Retry policies are at their defaults and no other delivery configuration has been changed.
Each proposed solution is independent. Evaluate whether it, on its own, meets the goal.
Goal: No event published to the custom topic may be silently lost when a subscriber is unavailable for several hours, and the team must be able to identify and reprocess anything that failed.
A Service Bus triggered function calls an external rendering service that routinely takes eight minutes. Operators see the same message processed two or three times concurrently, and duplicate output downstream. The queue is using default settings.
Each proposed solution is independent. Evaluate whether it, on its own, meets the goal.
Goal: A handler that legitimately takes eight minutes must complete without its message being redelivered to another instance, and without weakening the protection that parks genuinely poisonous messages.
The vault has been switched from access policies to the Azure RBAC permission model. The container app has a system-assigned managed identity. Calls to read a secret return a forbidden error, even though the identity can see the vault in the portal.
Each proposed solution is independent. Evaluate whether it, on its own, meets the goal.
Goal: A container app's managed identity must be able to read secret values from a Key Vault that uses the Azure RBAC permission model, with no more privilege than that requires.
During an incident the team found the portal reported roughly a third of the requests the application's internal counters recorded. Ingestion is otherwise healthy and telemetry arrives continuously throughout the day. The application uses the default Application Insights configuration.
Each proposed solution is independent. Evaluate whether it, on its own, meets the goal.
Goal: Restore confidence in Application Insights request counts so that incident decisions can be made from them, without materially increasing ingestion spend.
How to approach them
Fix the goal in your head before you read the first solution. If a solution only partly meets it, or is merely a reasonable first step, the answer is No.