This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Develop containerized solutions on Azure (20–25%)
   --> Implement container application hosting
      --> Deploy containers to Azure App Service, including configuring App Service to supply environment variables and secrets

Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure App Service is a fully managed platform-as-a-service (PaaS) offering that allows developers to host web applications, APIs, and containerized applications without managing the underlying virtual machines or operating system.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand how to deploy a container image to App Service and, importantly, how to configure the application so that the container receives the configuration, environment variables, and secrets it needs at runtime.

This is particularly important for AI applications because containerized AI workloads commonly need configuration values such as:

Azure AI service endpoints
Model deployment names
Database connection information
Storage account names
Service Bus configuration
Application Insights configuration
Feature flags
API keys or other secrets

A well-designed application should not bake these values into the container image. Instead, configuration should be supplied by the hosting environment, with sensitive values preferably retrieved from a secure secret store such as Azure Key Vault.

1. Understand Azure App Service for Containers

Azure App Service can run applications packaged as custom container images. This allows developers to use their own runtime, dependencies, libraries, and operating-system configuration instead of relying exclusively on App Service’s built-in application stacks.

A typical architecture looks like this:

Developer → Container Image → Container Registry → Azure App Service → Running Container

For example:

A developer creates a Dockerfile.
The Dockerfile is used to build an image.
The image is pushed to Azure Container Registry.
App Service is configured to use that image.
App Service pulls the image.
App Service starts the container.
App Service supplies configuration values as environment variables.
The application reads those values at runtime.

App Service pulls the configured container image when the application starts. If an updated image is pushed to the registry, restarting the application causes App Service to pull the updated image.

This separation between the application image and the application configuration is an important concept for the exam.

2. Why Use Containers with App Service?

A custom container is useful when the application’s requirements don’t fit cleanly into one of App Service’s predefined runtime stacks.

For example, an AI application might require:

A particular Python version
Specific native libraries
Custom machine-learning packages
A specialized web server
OS-level dependencies
A combination of packages that isn’t available in a standard App Service stack

Instead of configuring all those dependencies on the App Service platform, you can package them into a container.

Key benefit

The container provides a consistent application environment.

The same image can potentially be used in:

Development
Testing
Staging
Production
Other container-hosting environments

This supports the important principle:

Build the application once and configure it differently for each environment.

The container should contain the application and its dependencies—not environment-specific secrets.

3. The Container Image and App Service Are Separate Concerns

One of the most important concepts to understand is the difference between the container image and the App Service configuration.

Container image

The image contains things such as:

Application code
Runtime
Dependencies
Libraries
System packages
Startup configuration

App Service configuration

App Service supplies environment-specific information such as:

Database endpoints
API endpoints
Feature flags
Environment names
Secret references
Connection information

This allows the same image to run in multiple environments.

For example:

			
Container Image
    |
    +-- Application code
    +-- Python runtime
    +-- Required libraries
    +-- AI SDKs
    |
    v
App Service
    |
    +-- ENVIRONMENT=Production
    +-- AI_ENDPOINT=...
    +-- MODEL_NAME=...
    +-- DATABASE_CONNECTION=...
    +-- API_KEY=<Key Vault reference>

		

The application doesn’t need a different Docker image simply because it is moving from development to production.

4. Deploying a Container to App Service

There are several ways to deploy a containerized application to App Service.

A common approach is:

			
Dockerfile
    ↓
docker build
    ↓
Container Image
    ↓
Azure Container Registry
    ↓
Azure App Service

		

For example, a container image might be named:

myregistry.azurecr.io/my-ai-api:v1

The registry name identifies the container registry.

The repository identifies the application:

my-ai-api

And the tag identifies a particular version:

v1

Therefore:

myregistry.azurecr.io/my-ai-api:v1

identifies a specific container image.

5. Configure the Container Image

When creating or configuring an App Service application, you specify the container image that App Service should run.

For an image hosted in Azure Container Registry, App Service needs access to the registry.

For a private registry, authentication must be configured.

Depending on the scenario, App Service can use authentication mechanisms such as managed identity rather than embedding registry credentials. Current App Service configuration also supports managed-identity-based access to Azure Container Registry, which is generally preferable to managing long-lived registry passwords.

Exam concept

When you see a question asking for the most secure way to allow App Service to pull a private image from Azure Container Registry, consider:

Managed identity and appropriate Azure role assignments

rather than storing a registry password in application configuration.

6. The Container’s Listening Port

A containerized application must listen on the appropriate port so App Service can route traffic to it.

For custom containers, the port configuration is particularly important.

For example, suppose the application listens on:

The application inside the container needs to listen on that port, and App Service needs to know which port to use.

A common App Service configuration is:

WEBSITES_PORT=8080

The WEBSITES_PORT application setting tells App Service which port the custom container is listening on. Microsoft specifically identifies WEBSITES_PORT as required for custom-container port configuration.

Example

Suppose the Dockerfile contains:

EXPOSE 8080

The application should also actually listen on port 8080.

Then App Service can be configured with:

WEBSITES_PORT = 8080

Important distinction

EXPOSE in a Dockerfile documents the port the container expects to use. It does not by itself guarantee that the application is actually listening on that port.

A common troubleshooting scenario is:

The container starts successfully, but the application isn’t reachable.

One of the first things to verify is whether the application is listening on the expected port and whether WEBSITES_PORT is configured correctly.

7. Environment Variables in App Service

App Service application settings are exposed to applications as environment variables.

This is one of the most important concepts for this exam topic.

For example, you could configure:

			
ENVIRONMENT = Production
MODEL_NAME = gpt-4o-mini
AI_ENDPOINT = https://example.openai.azure.com/

Your application can then read these values from its environment.

For Linux applications and custom containers, App Service passes application settings into the container as environment variables. Changes to App Service settings cause the application to restart.

This allows the application code to remain environment-independent.

8. Why Environment Variables Are Better Than Hard-Coding Configuration

Consider this application code:

AI_ENDPOINT = "https://production-ai.example.com"

This is problematic because the endpoint is embedded in the application.

A better approach is:

			
import os
AI_ENDPOINT = os.environ["AI_ENDPOINT"]

Then App Service supplies:

AI_ENDPOINT=https://production-ai.example.com

The same container can then be deployed elsewhere with:

AI_ENDPOINT=https://development-ai.example.com

without rebuilding the image.

This supports:

Environment portability
Easier deployments
Configuration management
Separation of code and configuration
Safer secret handling

9. Configure Application Settings

App Service application settings can be configured through the Azure portal, Azure CLI, PowerShell, ARM/Bicep, or other deployment mechanisms.

In the Azure portal, application settings are managed under the app’s environment/configuration settings.

For example, you might define:

Setting	Example value	Sensitive?
`APP_ENVIRONMENT`	`Production`	No
`AI_ENDPOINT`	`https://my-ai.openai.azure.com/`	Usually no
`MODEL_NAME`	`chat-model`	No
`LOG_LEVEL`	`Information`	No
`DATABASE_CONNECTION`	Connection information	Potentially
`API_KEY`	Secret value	Yes

App Service stores app settings encrypted at rest. However, for secrets that require centralized secret management, Microsoft recommends using Azure Key Vault references rather than directly storing the secret value in the App Service setting.

10. Secrets Should Not Be Baked into Container Images

This is a major security principle.

Avoid putting something like this in a Dockerfile:

ENV API_KEY="abc123secret"

Also avoid:

API_KEY = "abc123secret"

Why?

Because the secret can potentially become part of the image or source code and therefore propagate into:

Container registries
Image layers
Source repositories
Build systems
Developer machines
Backups
Logs

Instead:

			
Container Image
      +
App Service Configuration
      +
Azure Key Vault

		

should provide the necessary runtime configuration.

11. Azure Key Vault Integration

Azure Key Vault provides centralized management for secrets, keys, and certificates.

For App Service, Key Vault can be integrated using Key Vault references.

Instead of putting the actual secret into an App Service setting, the setting contains a reference to the secret.

Conceptually:

			
API_KEY
    ↓
@Microsoft.KeyVault(...)
    ↓
Azure Key Vault
    ↓
Secret value
    ↓
Application

		

The application can consume the resolved value as an ordinary environment variable.

One of the major benefits is that application code doesn’t need to contain Key Vault-specific retrieval logic just to consume a referenced application setting.

12. Key Vault References

A Key Vault reference has a format similar to:

@Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret)

Alternatively, a reference can use the vault and secret names:

@Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret)

A specific secret version can also be specified.

For example:

			
AI_API_KEY =
@Microsoft.KeyVault(VaultName=myvault;SecretName=AI-API-Key)

The application can continue to access the setting using the environment variable:

AI_API_KEY

The application doesn’t have to know that the value originated from Key Vault.

13. Managed Identity and Key Vault

For Key Vault references to work securely, App Service needs an identity that can access the Key Vault.

A recommended architecture is:

			
Azure App Service
       |
       | Managed Identity
       |
       v
Azure Key Vault
       |
       v
Secret

		

The application does not need to store a Key Vault username/password or service principal secret.

App Service Key Vault references use the app’s system-assigned managed identity by default, although a user-assigned managed identity can also be configured. The identity must have permission to read secrets from the vault. With Azure RBAC, the Key Vault Secrets User role is an appropriate role for reading secrets.

14. System-Assigned vs. User-Assigned Managed Identity

You should understand the difference for exam questions.

System-assigned managed identity

The identity is tied to the Azure resource.

For example:

			
App Service
    |
    +-- System-assigned identity

If the App Service is deleted, the identity is also deleted.

User-assigned managed identity

The identity is a separate Azure resource.

			
User-assigned identity
       |
       +---- App Service A
       |
       +---- App Service B

		

It can therefore be reused by multiple resources.

Exam consideration

If a scenario specifically requires an identity to exist before the application is created or requires reuse across several resources, a user-assigned managed identity may be more appropriate.

15. Key Vault Secret Rotation

Key Vault references can simplify secret rotation.

When a Key Vault reference doesn’t specify a particular secret version, App Service can use the latest version of the secret.

App Service caches Key Vault reference values and periodically refreshes them. Microsoft documents a refresh interval of up to 24 hours; configuration changes that restart the app can cause the references to be fetched immediately.

This is an important distinction:

Changing the secret in Key Vault does not necessarily mean that the application immediately receives the new value.

If an application must immediately consume a new value, you need to account for the Key Vault reference refresh behavior.

16. What Happens When a Key Vault Reference Fails?

Suppose App Service has:

			
AI_API_KEY =
@Microsoft.KeyVault(VaultName=myvault;SecretName=AI-Key)

but the managed identity doesn’t have permission to retrieve the secret.

The reference might fail to resolve.

Potential causes include:

Incorrect Key Vault name
Incorrect secret name
Secret deleted
Incorrect reference syntax
Managed identity not enabled
Missing Key Vault permissions
Network restrictions preventing access to Key Vault

App Service provides Key Vault reference resolution information that can help diagnose these problems.

Exam clue

If a question says:

The application receives the literal @Microsoft.KeyVault(...) value instead of the expected secret.

Think:

The Key Vault reference failed to resolve.

Then investigate identity, permissions, reference syntax, secret existence, and networking.

17. App Settings vs. Key Vault

A useful exam distinction is:

Requirement	Recommended approach
Non-sensitive configuration	App Service application setting
Environment-specific value	App Service application setting
Secret value	Azure Key Vault
Secret consumed as an environment variable	Key Vault reference in an App Service setting
Shared centralized configuration	Azure App Configuration
Application code	Do not hard-code secrets

App Service application settings are appropriate for ordinary configuration.

Key Vault should be preferred when the value is a secret requiring centralized secret management, access control, auditing, and rotation.

18. App Configuration vs. Key Vault

AI-200 also covers Azure App Configuration, so understand how it differs from Key Vault.

Azure App Configuration

Designed primarily for centralized application configuration.

Examples:

			
Feature flags
Application settings
Environment configuration
Dynamic configuration

Azure Key Vault

Designed for sensitive information such as:

			
Passwords
API keys
Connection secrets
Certificates
Cryptographic keys

		

A common architecture uses both:

                    +---------------------+
                    | Azure App Config     |
                    |                     |
                    | Feature flags       |
                    | Application config  |
                    +----------+----------+
                               |
                               |
Application <------------------+
     |
     |
     +------------------------+
                              |
                              v
                    +---------------------+
                    | Azure Key Vault     |
                    |                     |
                    | API keys            |
                    | Passwords           |
                    | Secrets             |
                    +---------------------+

Do not confuse centralized configuration with secret management.

19. Container Startup Commands

A container has a default startup command defined by its image.

However, App Service can override the startup behavior for a custom container.

This can be useful when:

The container’s default command isn’t appropriate.
The application requires a specific startup command.
Different hosting environments require different startup behavior.

For example:

python app.py

or:

gunicorn --bind 0.0.0.0:8080 app:app

App Service supports specifying a startup command for custom containers.

Exam clue

If a container image works locally but App Service starts it incorrectly, investigate:

Startup command
Listening port
Environment variables
Container logs
Image configuration

20. Environment Variables and Container Startup

Environment variables are available to the application when the container starts.

For example:

			
APP_ENVIRONMENT=Production
PORT=8080
MODEL_NAME=my-model

Your application might use:

			
import os
environment = os.getenv("APP_ENVIRONMENT")
model = os.getenv("MODEL_NAME")

The values can be changed in App Service without changing the container image.

This is especially valuable when promoting the same image through:

			
Development
     ↓
Testing
     ↓
Staging
     ↓
Production

		

Each environment can supply different configuration.

21. App Settings Cause Application Restarts

A frequently tested detail is that changing App Service application settings causes the application to restart.

This matters because configuration changes aren’t necessarily applied to an already-running process without interruption.

Microsoft documents that adding, removing, or modifying app settings causes an App Service app restart.

Therefore, if a scenario says:

An administrator changes an application setting and the application immediately restarts.

That is expected behavior.

22. Container Image Updates

Suppose App Service is configured to run:

myacr.azurecr.io/my-ai-api:latest

A developer builds a new version and pushes it using the same tag.

The registry now contains a newer image associated with latest.

However, simply pushing the new image doesn’t necessarily mean that an already-running container immediately changes.

Restarting the App Service causes it to pull the image again.

This is one reason immutable version tags are often preferable for controlled deployments.

For example:

			
my-ai-api:v1.0.0
my-ai-api:v1.1.0
my-ai-api:v2.0.0

rather than relying exclusively on:

my-ai-api:latest

23. Using `latest` vs. Versioned Tags

`latest`

Advantages:

Simple
Convenient for development

Disadvantages:

Doesn’t clearly identify what is deployed
Makes rollback more difficult
Can make troubleshooting harder
Can introduce unexpected image changes

Versioned tags

For example:

my-ai-api:1.4.2

Advantages:

Clear version identification
Easier rollback
Better deployment traceability
Easier troubleshooting

For production workloads, versioned image tags are generally a better operational practice.

24. Container Logs and Troubleshooting

When a container doesn’t start correctly, examine the container logs.

Common problems include:

Wrong port

The application listens on:

but App Service expects:

Application crashes

For example:

ModuleNotFoundError

or:

Connection refused

Incorrect environment variable

The application expects:

DATABASE_URL

but App Service defines:

DB_URL

Secret resolution failure

The Key Vault reference isn’t resolving.

Startup command failure

The command specified by App Service doesn’t exist or fails.

25. Container Startup Timeout

Custom containers sometimes take longer to initialize than expected.

App Service provides the WEBSITES_CONTAINER_START_TIME_LIMIT setting to control how long the platform waits for a container to start.

The documented default is 230 seconds, with a maximum of 1,800 seconds.

This can matter for AI applications that have relatively large startup workloads.

However, increasing the startup timeout should not be the first response to every startup problem.

First determine why startup is slow.

For example:

Is the container downloading dependencies at startup?
Is the application loading a large model?
Is it waiting for an external service?
Is the application listening on the wrong port?
Is the startup command incorrect?

26. HTTPS and Custom Containers

A custom container doesn’t necessarily need to implement HTTPS itself when hosted through App Service.

App Service can handle HTTPS termination at the platform’s front ends.

Therefore, an application can commonly listen for HTTP inside the container while clients connect to the application through HTTPS.

Conceptually:

			
Client
  |
 HTTPS
  |
  v
App Service
  |
 HTTP
  |
  v
Container

		

This is different from saying that application traffic is universally unprotected in every internal configuration; networking and security architecture still matter.

27. Continuous Deployment for Containers

App Service can integrate with container registries to support automated deployments.

A common flow is:

			
Developer
   |
   v
Source Repository
   |
   v
Build
   |
   v
Container Image
   |
   v
Azure Container Registry
   |
   v
App Service

		

A registry push can be used to trigger a deployment/restart workflow.

App Service supports continuous deployment scenarios involving container registries, including Azure Container Registry.

For production systems, CI/CD is generally preferable to manually rebuilding and deploying containers.

28. A Recommended AI Application Architecture

A reasonable architecture for an AI application hosted in a container on App Service might look like this:

                         Azure Container Registry
                                  |
                                  | Container Image
                                  v
                         +-------------------+
                         |   Azure App       |
                         |     Service       |
                         +---------+---------+
                                   |
                    +--------------+--------------+
                    |                             |
             Environment Variables          Managed Identity
                    |                             |
                    |                             v
                    |                      Azure Key Vault
                    |                             |
                    |                           Secrets
                    |
                    +--------------------+
                                         |
                                         v
                                  AI Application
                                         |
                  +----------------------+----------------+
                  |                      |                 |
                  v                      v                 v
             Azure AI             Azure Database      Azure Storage

The container image contains the application.

App Service provides environment-specific configuration.

Managed identity provides secure access to Azure resources.

Key Vault stores secrets.

This is a strong pattern to recognize in AI-200 scenario questions.

29. Security Best Practices

For the exam, remember these principles.

Don’t hard-code secrets

Avoid:

API_KEY=abc123

inside source code or Dockerfiles.

Don’t put secrets in image layers

Building a secret into an image doesn’t make it secure simply because the image is stored in a private registry.

Use managed identities

When Azure services support Microsoft Entra authentication and managed identities, prefer them over long-lived credentials.

Use Key Vault for secrets

Store sensitive values centrally.

Use least privilege

Grant the App Service identity only the permissions it requires.

Separate environments

Development, testing, and production should have appropriately separated configuration and secrets.

Use versioned images

Prefer:

myapp:1.2.3

over relying exclusively on:

myapp:latest

30. Important AI-200 Exam Concepts to Remember

The following relationships are particularly important:

Concept	Remember
Custom container	Runs your own container image in App Service
Azure Container Registry	Common private registry for App Service container images
App settings	Become environment variables
`WEBSITES_PORT`	Identifies the port used by a custom container
Startup command	Controls/overrides how the container application starts
Key Vault	Secure centralized secret management
Key Vault reference	Allows an App Service setting to reference a Key Vault secret
Managed identity	Avoids storing credentials for Azure resource access
System-assigned identity	Lifecycle tied to the Azure resource
User-assigned identity	Separate reusable identity resource
App setting changes	Cause an application restart
Image update	Restart causes App Service to pull the updated image
`latest`	Convenient but less predictable
Versioned tags	Better traceability and rollback
Container logs	Important for startup/runtime troubleshooting
`WEBSITES_CONTAINER_START_TIME_LIMIT`	Controls custom-container startup wait time

Practice Exam Questions

Question 1

You have a Python-based AI API packaged as a Linux container. The application listens on port 8080 inside the container.

You deploy the container to Azure App Service, but requests to the application fail because App Service cannot connect to the application.

Which App Service setting should you verify first?

A. WEBSITE_RESOURCE_GROUP

B. WEBSITE_SITE_NAME

C. WEBSITES_PORT

D. WEBSITE_SKU

Answer: C

Explanation

For custom containers, App Service needs to know which port the container is listening on. If the application listens on port 8080, configuring:

WEBSITES_PORT=8080

helps App Service route traffic to the correct container port.

The other settings describe the App Service environment but do not determine the container’s application port.

Question 2

An AI application is deployed as a container to Azure App Service. The application requires an API key that changes periodically.

The development team wants to avoid storing the API key in source code, the Dockerfile, or the container image.

Which solution provides the best approach?

A. Store the API key in the Dockerfile as an ENV value.

B. Store the API key in Azure Key Vault and reference it from an App Service application setting.

C. Store the API key in the container image and use a private Azure Container Registry.

D. Store the API key in the application’s source code and protect the repository with RBAC.

Answer: B

Explanation

Azure Key Vault is designed for centralized secret management. App Service can use a Key Vault reference as an application setting, allowing the application to consume the secret as an environment variable without embedding the secret in the image or source code.

A private container registry protects access to the image but does not make secrets embedded inside the image a good security practice.

Question 3

An Azure App Service application uses a Key Vault reference to retrieve an API key. The application is receiving the literal Key Vault reference string rather than the expected secret value.

Which issue should you investigate?

A. Whether the Dockerfile contains an EXPOSE instruction

B. Whether WEBSITES_PORT matches the application port

C. Whether the App Service managed identity has permission to read the Key Vault secret

D. Whether the image uses the latest tag

Answer: C

Explanation

A Key Vault reference must be resolved by App Service. The application’s managed identity needs permission to retrieve the referenced secret.

A missing or incorrectly configured identity, missing Key Vault permissions, an invalid secret name, or other Key Vault configuration problems can prevent resolution.

The port and image tag are unrelated to Key Vault reference resolution.

Question 4

A development team wants to deploy the same container image to development, test, and production environments. The AI endpoint differs between environments.

What is the best approach?

A. Build a separate Docker image for each environment.

B. Store all three endpoints in the Dockerfile and select one at runtime.

C. Create separate source-code branches containing different endpoint values.

D. Store the endpoint as an App Service application setting in each environment.

Answer: D

Explanation

Environment-specific configuration should be separated from the application image.

Each App Service environment can provide its own application setting:

AI_ENDPOINT=https://development...

or:

AI_ENDPOINT=https://production...

The same container image can therefore be deployed across environments.

Question 5

A developer pushes a new version of an image to Azure Container Registry using the same latest tag that an App Service application is already configured to use.

When should the developer expect App Service to retrieve the updated image?

A. When the running container is restarted

B. Immediately when the image is pushed

C. Only when the App Service plan is resized

D. Only after the image tag is deleted

Answer: A

Explanation

App Service pulls the configured container image when the application starts. If an updated image is pushed using the same tag, restarting the App Service causes the updated image to be pulled.

This is one reason explicit version tags are often preferable for controlled production deployments.

Question 6

An organization wants an App Service application to retrieve secrets from Azure Key Vault without storing a Key Vault password or service principal secret in the application.

Which feature should be used?

A. Docker ENV instructions

B. Managed identity

C. App Service startup command

D. Container port mapping

Answer: B

Explanation

Managed identity allows Azure resources such as App Service to authenticate to supported Azure services without requiring developers to store credentials in application configuration.

For Key Vault references, App Service can use its system-assigned managed identity by default or a configured user-assigned identity.

Question 7

An AI container deployed to App Service takes approximately five minutes to initialize because it performs a large initialization operation before listening for HTTP traffic.

The platform terminates the container before initialization completes.

Which setting can be used to increase the amount of time App Service waits for the container to start?

A. WEBSITES_PORT

B. WEBSITE_SITE_NAME

C. WEBSITES_CONTAINER_START_TIME_LIMIT

D. WEBSITE_WARMUP_PATH

Answer: C

Explanation

WEBSITES_CONTAINER_START_TIME_LIMIT controls how long App Service waits for a custom container to start.

The documented default is 230 seconds and the maximum is 1,800 seconds.

However, increasing the timeout should be done only after determining that the startup delay is legitimate rather than caused by a configuration or application problem.

Question 8

An application administrator changes the value of an App Service application setting.

What should the administrator expect?

A. The setting changes only the next time a new container image is deployed.

B. The setting changes the Dockerfile stored in Azure Container Registry.

C. App Service restarts the application so that the new setting can be supplied to the application environment.

D. The setting automatically modifies the source code in the application repository.

Answer: C

Explanation

App Service application settings are supplied to the application as environment variables. Changes to application settings cause the application to restart, allowing the new configuration to be supplied to the running application.

The setting does not modify the container image, Dockerfile, or source repository.

Question 9

You are designing a production AI application running in a custom container on Azure App Service. The application requires an API key.

Which design provides the strongest separation between application code and the secret?

A. Store the secret in Azure Key Vault and expose it to the application through an App Service Key Vault reference.

B. Store the secret in the Dockerfile using an ENV instruction.

C. Store the secret in a text file inside the container image.

D. Store the secret in the application’s source code and restrict repository access.

Answer: A

Explanation

A Key Vault reference allows the secret to remain in Azure Key Vault while the application consumes it through an App Service configuration setting.

This provides better separation between:

Application code
Container image
Deployment configuration
Secrets

The App Service managed identity can be granted the minimum required permissions to retrieve the secret.

Question 10

An organization has multiple App Service applications that need to use the same identity when accessing Azure Key Vault. The identity must also be able to exist independently of the lifecycle of any individual App Service application.

Which type of managed identity should be used?

A. System-assigned managed identity

B. App Service publishing credentials

C. User-assigned managed identity

D. Container registry administrator credentials

Answer: C

Explanation

A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure resources.

This makes it appropriate when:

Multiple applications need the same identity.
The identity needs an independent lifecycle.
The identity must exist before an application is created.
The organization wants to reuse the identity across resources.

A system-assigned identity is tied to the lifecycle of its associated Azure resource.

Final Exam Takeaways

For AI-200, the most important mental model is:

The container image contains the application; App Service supplies the environment-specific configuration; Key Vault protects sensitive values; managed identity provides secure access to Azure resources.

When you encounter an exam scenario, think through the problem in this order:

Where is the container image?
- Azure Container Registry?
- Another private registry?
- Public registry?
Can App Service pull the image?
- Is authentication configured?
- Would managed identity be appropriate?
What port does the application actually listen on?
- Does it match the App Service configuration?
- Is WEBSITES_PORT configured appropriately?
How does the application receive configuration?
- App Service application settings
- Environment variables
Does the configuration contain a secret?
- Use Azure Key Vault rather than embedding the secret in the image or source code.
How does App Service access Key Vault?
- Managed identity
- Appropriate Key Vault permissions
Is the container starting correctly?
- Startup command
- Container logs
- Port
- Environment variables
- Startup timeout
How is the image version managed?
- Prefer identifiable/versioned image tags for production deployments.
- Understand what happens when an image behind a tag is replaced.

These distinctions—particularly App Service settings vs. container image contents, environment variables vs. secrets, Key Vault references vs. hard-coded credentials, and system-assigned vs. user-assigned managed identities—are exactly the kinds of distinctions that can turn a plausible answer into the correct AI-200 answer.

Go to the AI-200 Exam Prep Hub main page

Overview

1. Understand Azure App Service for Containers

2. Why Use Containers with App Service?

Key benefit

3. The Container Image and App Service Are Separate Concerns

Container image

App Service configuration

4. Deploying a Container to App Service

5. Configure the Container Image

Exam concept

6. The Container’s Listening Port

Example

Important distinction

7. Environment Variables in App Service

8. Why Environment Variables Are Better Than Hard-Coding Configuration

9. Configure Application Settings

10. Secrets Should Not Be Baked into Container Images

11. Azure Key Vault Integration

12. Key Vault References

13. Managed Identity and Key Vault

14. System-Assigned vs. User-Assigned Managed Identity

System-assigned managed identity

User-assigned managed identity

Exam consideration

15. Key Vault Secret Rotation

16. What Happens When a Key Vault Reference Fails?

Exam clue

17. App Settings vs. Key Vault

18. App Configuration vs. Key Vault

Azure App Configuration

Azure Key Vault

19. Container Startup Commands

Exam clue

20. Environment Variables and Container Startup

21. App Settings Cause Application Restarts

22. Container Image Updates

23. Using latest vs. Versioned Tags

latest

Versioned tags

24. Container Logs and Troubleshooting

Wrong port

Application crashes

Incorrect environment variable

Secret resolution failure

Startup command failure

25. Container Startup Timeout

26. HTTPS and Custom Containers

27. Continuous Deployment for Containers

28. A Recommended AI Application Architecture

29. Security Best Practices

Don’t hard-code secrets

Don’t put secrets in image layers

Use managed identities

Use Key Vault for secrets

Use least privilege

Separate environments

Use versioned images

30. Important AI-200 Exam Concepts to Remember

Practice Exam Questions

Question 1

Answer: C

Explanation

Question 2

Answer: B

Explanation

Question 3

Answer: C

Explanation

Question 4

Answer: D

Explanation

Question 5

Answer: A

Explanation

Question 6

Answer: B

Explanation

Question 7

Answer: C

Explanation

23. Using `latest` vs. Versioned Tags

`latest`