Welcome to the AI-200: Developing AI Cloud Solutions on Azure Exam Prep Hub!
Welcome to the one-stop hub with information for preparing for the AI-200: Developing AI Cloud Solutions on Azure certification exam. The content for this exam helps prepare you to be “responsible for contributing to all phases of implementing AI solutions on Azure, with an emphasis on back-end services and components. Youโre also responsible for supporting all phases of the development lifecycle, including requirements gathering, design, development, deployment, security, and monitoring”. Upon successful completion of the exam, you earn the Microsoft Certified: Azure AI Cloud Developer Associate certification.
This hub provides information directly here (topic-by-topic as outlined in the official study guide), links to a number of external resources, tips for preparing for the exam, practice tests, and section questions to help you prepare. Bookmark this page and use it as a guide to ensure that you are fully covering all relevant topics for the AI-200 exam and making use of as many of the resources available as possible.
Audience Profile (from Microsoft’s site)
As a candidate for this Microsoft Certification, youโre responsible for contributing to all phases of implementing AI solutions on Azure, with an emphasis on back-end services and components. Youโre also responsible for supporting all phases of the development lifecycle, including requirements gathering, design, development, deployment, security, and monitoring.
You should be proficient in:
- Azure SDKs and third-party SDKs used in Azure.
- Azure data management services.
- Azure monitoring and troubleshooting.
- Azure messaging and eventing.
- Vector databases.
- Python programming.
- Implementing containerized applications on Azure.
This post is a part of the AI-200: Developing AI Cloud Solutions on Azure Exam Prep Hub. This topic falls under these sections: Connect to and consume Azure services (20โ25%) --> Develop event- and message-based AI solutions --> Implement event-driven workflows by using Azure Event Grid, including filters, custom events, and retries
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Overview
Modern AI applications frequently need to react to events rather than continuously poll systems for changes. For example:
A document is uploaded and needs to be processed.
A new customer record is created and should trigger enrichment.
An AI model finishes processing a request.
A database record changes and downstream systems need to respond.
A custom application event needs to trigger a serverless workflow.
Azure Event Grid is an event-routing service designed to connect event producers with event handlers. It can receive events from Azure services, custom applications, and partner sources and route matching events to subscribers.
For the AI-200 exam, you should understand how to:
Design event-driven workflows with Event Grid.
Create and use custom events and custom topics.
Configure event subscriptions.
Filter events.
Understand Event Grid delivery and retry behavior.
Configure retry policies and dead-lettering.
Design consumers to tolerate duplicate or out-of-order events.
Event Grid is particularly useful when an application needs to react to something that has happened rather than explicitly requesting something to happen.
1. What Is Azure Event Grid?
Azure Event Grid is a managed event-routing service.
At a high level, the architecture looks like this:
A file upload can generate an event. Event Grid receives that event and routes it to an Azure Function, which processes the file.
Another example might be:
Application โ Custom Event Grid Topic โ Event Grid Subscription โ AI Processing Service
The application publishes an event such as:
DocumentUploaded
Event Grid determines which subscriptions are interested in the event and delivers it to the appropriate handlers.
Event Grid supports system events from Azure services, custom application events, and partner events. It also provides filtering so subscribers receive only the events they need.
2. Event-Driven Architecture
An event-driven architecture separates the component that produces an event from the components that consume the event.
Consider an AI document-processing application.
A user uploads a document:
User
|
v
Blob Storage
|
| BlobCreated event
v
Event Grid
|
+----> Document Processing Function
|
+----> Audit Function
|
+----> Notification Service
The Blob Storage service doesn’t need to know how each consumer processes the event.
This provides several advantages:
Loose coupling
Independent scaling
Easier integration
Asynchronous processing
Multiple consumers
Reduced polling
Easier addition of new workflows
This is especially valuable for AI workloads because AI processing can be computationally expensive or time-consuming.
Instead of having an application constantly check whether something changed, an event can initiate processing only when necessary.
3. Important Event Grid Concepts
Several Event Grid terms are important for the AI-200 exam.
Event
An event describes something that happened.
Examples include:
ImageUploaded
DocumentCreated
OrderCompleted
ModelTrainingCompleted
CustomerCreated
An event generally contains information about the occurrence rather than instructions for what the receiver must do.
For example:
{
"eventType":"DocumentUploaded",
"subject":"/documents/invoice-123.pdf",
"data":{
"documentType":"invoice",
"customerId":"C1001"
}
}
Event Source
The event source is the system that generates the event.
Examples include:
Azure Storage
Azure resources
Custom applications
Partner services
Topic
A topic provides an endpoint through which events can be published.
For custom applications, you can create a custom topic and publish application-specific events to it.
For example:
OrderEvents
could receive:
OrderCreated
OrderUpdated
OrderCancelled
OrderCompleted
A custom topic allows an application to publish its own events without having to use an Azure service’s built-in event source.
Event Subscription
An event subscription tells Event Grid:
“Send matching events to this destination.”
A subscription connects an event source or topic to an event handler.
A subscription can define:
Destination
Event type filters
Subject filters
Advanced filters
Retry behavior
Dead-letter configuration
For example:
Custom Topic
|
+---- Subscription A โ Azure Function
|
+---- Subscription B โ Webhook
|
+---- Subscription C โ Service Bus
Each subscription can independently determine which events it wants.
4. Event Handlers
The event handler is the destination that processes the event.
Depending on the Event Grid scenario, event handlers can include services such as:
Azure Functions
Azure Logic Apps
Webhooks
Azure Service Bus
Azure Event Hubs
Other supported Azure destinations
For AI applications, Azure Functions are particularly useful for lightweight event processing.
For example:
BlobCreated
|
v
Event Grid
|
v
Azure Function
|
+---- Extract text
+---- Generate embedding
+---- Store metadata
+---- Update search index
5. Event Grid vs. Message Queues
A common exam distinction is between events and messages/commands.
Event Grid is primarily an event-routing service.
It is appropriate when you want to communicate:
“Something happened.”
For example:
DocumentUploaded
A messaging service such as Azure Service Bus is more appropriate when you need durable message processing, commands, queues, transactions, sessions, or more sophisticated competing-consumer patterns.
For example:
ProcessThisDocument
is more command-like.
A useful rule is:
Requirement
Common choice
React to an event
Event Grid
Route events to multiple consumers
Event Grid
Serverless event triggering
Event Grid
Durable command/message processing
Service Bus
Queue-based workload processing
Service Bus
Pub/sub event routing
Event Grid
The services can also be combined.
For example:
Blob Storage
|
v
Event Grid
|
v
Service Bus Queue
|
v
AI Worker
Event Grid detects the event, while Service Bus provides durable message-processing capabilities.
6. Custom Events
A custom event is an event generated by your own application rather than an Azure service.
For example, an AI application might generate:
DocumentClassificationCompleted
with data such as:
{
"eventType":"DocumentClassificationCompleted",
"subject":"/documents/12345",
"data":{
"documentId":"12345",
"classification":"Invoice",
"confidence":0.97
}
}
The application publishes the event to a custom Event Grid topic.
Other applications can subscribe to that topic.
For example:
AI Processing Application
|
| DocumentClassificationCompleted
v
Event Grid Topic
|
+------> Billing System
|
+------> Audit System
|
+------> Notification System
This provides a loosely coupled architecture.
The AI processing application doesn’t need to know which systems are consuming the event.
7. Custom Topics
A custom topic provides a user-defined Event Grid endpoint for publishing application events.
For example:
CustomerEvents
The application publishes events to the topic, and subscribers consume matching events.
A custom topic is appropriate when:
Your application generates its own events.
You need an application-specific event endpoint.
You want multiple applications to subscribe to your events.
You want Event Grid to perform routing and filtering.
The topic can support Event Grid or CloudEvents schemas depending on the configuration. Event Grid supports multiple event schemas, including Event Grid schema and CloudEvents schema.
8. Event Types
Event types identify what happened.
For example:
DocumentCreated
DocumentDeleted
DocumentProcessed
DocumentFailed
A single topic can publish multiple event types.
A subscriber may only be interested in one or two.
For example:
Topic
|
+-- DocumentCreated
+-- DocumentUpdated
+-- DocumentDeleted
+-- DocumentProcessed
A subscription could specify:
Included event types:
DocumentProcessed
DocumentFailed
The subscriber would not receive the other event types.
Event type filtering is one of the simplest and most important forms of Event Grid filtering.
9. Event Filtering
Event filtering is one of the most important AI-200 concepts.
Suppose a topic receives thousands of events:
DocumentCreated
DocumentUpdated
DocumentDeleted
ImageUploaded
VideoUploaded
A particular Function might only care about:
DocumentCreated
Instead of sending every event to the Function and filtering them in application code, Event Grid can filter the events before delivery.
This reduces:
Unnecessary network traffic
Function executions
Processing
Cost
Application complexity
Event Grid supports several filtering approaches.
10. Event Type Filtering
Event type filtering allows a subscription to receive only specific event types.
For example:
Included event types:
DocumentCreated
DocumentUpdated
Events such as:
DocumentDeleted
would not be delivered to that subscription.
This is appropriate when the routing decision is based primarily on the type of event.
11. Subject Filtering
Events have a subject that identifies the resource or object associated with the event.
For example:
/documents/invoices/2026/invoice-123.pdf
A subscription can filter based on whether the subject:
Begins with a specified value
Ends with a specified value
For example:
Subject begins with:
/documents/invoices/
would select events associated with invoice documents.
Another example:
Subject ends with:
.pdf
could be used to select PDF-related events.
Subject filtering is useful when the event type is the same but the resource or path differs.
12. Advanced Filtering
Advanced filtering provides more precise filtering based on event properties.
For example:
{
"data":{
"department":"finance",
"priority":5,
"environment":"production"
}
}
A subscription could filter on:
data.department = "finance"
or:
data.priority > 3
or:
data.environment = "production"
Advanced filters support different data types and operators, including string, numeric, Boolean, and array-based filtering.
13. Common Advanced Filter Operators
Important operators include:
String operators
Examples include:
StringIn
StringNotIn
StringContains
StringNotContains
StringBeginsWith
StringNotBeginsWith
StringEndsWith
StringNotEndsWith
Numeric operators
Examples include:
NumberIn
NumberNotIn
NumberLessThan
NumberLessThanOrEquals
NumberGreaterThan
NumberGreaterThanOrEquals
Boolean
BoolEquals
There are also operators for null/undefined values and range-based comparisons.
For the exam, focus on understanding why you would use advanced filtering rather than memorizing every operator.
14. Example: Advanced Filtering
Imagine the application publishes:
{
"eventType":"DocumentUploaded",
"data":{
"documentType":"invoice",
"priority":8,
"environment":"production"
}
}
A subscription might filter for:
data.documentType = invoice
This means the subscriber only receives invoice events.
Another subscription might use:
data.priority >= 7
to receive only high-priority documents.
This is much more efficient than delivering every event and performing the filtering inside the application.
15. Combining Filters
You can use multiple filters to create more selective subscriptions.
For example:
Event Type = DocumentUploaded
AND
data.documentType = invoice
AND
data.environment = production
This creates a narrowly targeted event stream.
A good event design therefore includes meaningful event metadata.
For example:
{
"eventType":"DocumentUploaded",
"subject":"/documents/12345",
"data":{
"documentType":"invoice",
"environment":"production",
"priority":8
}
}
Good event metadata makes downstream routing much easier.
16. Designing Event Subjects
When designing custom events, don’t treat the subject as an arbitrary string.
A meaningful subject can make filtering easier.
For example:
/documents/invoices/2026/12345
is much more useful for routing than:
12345
A hierarchical subject can allow subscriptions to target broad or narrow groups of events.
For example:
/documents/invoices/
could represent all invoice documents.
A more specific path could identify:
/documents/invoices/2026/12345
This is particularly useful in large event-driven systems.
17. Event Delivery
Event Grid uses a push delivery model for many common Event Grid workflows.
When an event matches a subscription, Event Grid attempts to deliver it to the destination.
A successful HTTP response indicates successful delivery.
Event Grid considers HTTP status codes in the 200โ204 range successful for delivery. Other responses are treated as failures and may result in retries or dead-lettering depending on the error and configuration.
18. At-Least-Once Delivery
One of the most important concepts for the exam is that Event Grid uses an at-least-once delivery model.
This means an event can potentially be delivered more than once.
For example:
Event published
|
v
Event Grid
|
+----> Consumer
|
+---- Processing succeeds
|
+---- Response delayed
If Event Grid cannot determine that delivery succeeded, it may retry.
The consumer could therefore receive the same event again.
Design implication
Event handlers should be idempotent whenever possible.
For example, instead of blindly performing:
Insert record
the consumer could use the event ID to determine whether it has already processed the event.
19. Event Ordering
Event Grid does not guarantee event ordering.
For example, an application might publish:
Event A
Event B
Event C
but the consumer could receive:
Event B
Event A
Event C
Therefore, applications that require strict ordering should not assume that Event Grid delivery preserves publication order.
If ordering is a hard requirement, another messaging design may be more appropriate.
20. Retry Behavior
If Event Grid cannot successfully deliver an event, it can retry delivery.
Event Grid uses an exponential-backoff-based retry schedule.
The current documented retry schedule includes progressively longer delays, beginning with short delays and eventually extending to hours. Event Grid may also delay or skip certain retries when an endpoint remains unhealthy.
The important exam concept is:
Event Grid does not immediately give up when an endpoint fails.
Instead, it attempts delivery again according to its retry behavior and configured retry policy.
21. Configurable Retry Policy
Event Grid allows you to configure two important retry limits:
Maximum delivery attempts
Event time-to-live (TTL)
The documented limits are:
Setting
Default
Valid range
Maximum delivery attempts
30
1โ30
Event TTL
1,440 minutes
1โ1,440 minutes
If both are configured, whichever limit is reached first determines when Event Grid stops attempting delivery.
Example
Suppose you configure:
Maximum attempts = 5
TTL = 30 minutes
If the event reaches five attempts before 30 minutes:
Stop retrying
If 30 minutes expires before five attempts occur:
Stop retrying
The retry schedule itself is not directly configurable. You configure the limits, not the individual retry intervals.
22. Dead-Lettering
When an event can no longer be delivered within the configured retry policy, you may want to preserve it instead of losing it.
This is where dead-lettering comes into play.
Event Grid can send undeliverable events to an Azure Storage Blob container.
Conceptually:
Event Grid
|
| delivery failures
v
Retry
|
| retry limit reached
v
Dead-letter storage
Dead-lettering is not enabled automatically for every subscription. You configure a storage account/container as the dead-letter destination.
23. Why Dead-Lettering Matters
Dead-lettering is particularly important when events represent business-critical operations.
Suppose an AI application generates:
DocumentProcessingCompleted
and the downstream billing system is temporarily unavailable.
Without a dead-letter destination, an event that ultimately cannot be delivered may be dropped.
With dead-lettering:
DocumentProcessingCompleted
|
v
Event Grid
|
v
Billing System
|
delivery fails
|
v
retries
|
v
Dead-letter Blob
An operations team or automated process can later inspect and reconcile those events.
24. Important HTTP Failure Behaviors
Not all HTTP errors are treated identically.
For example, certain configuration-related errors such as:
400 Bad Request
403 Forbidden
413 Request Entity Too Large
can cause Event Grid to stop retrying rather than repeatedly attempting an endpoint that is unlikely to succeed.
Other failures can result in retries.
For example:
503 Service Unavailable
is a typical transient failure for which retry behavior is appropriate.
Exam takeaway
Do not assume:
“Every failed HTTP request is retried forever.”
Event Grid distinguishes between failures and applies its delivery and retry rules accordingly.
25. Dead-Lettering vs. Retry
These concepts should not be confused.
Retry
Retry means:
“Try delivering the event again.”
Dead-letter
Dead-letter means:
“The event could not be successfully delivered within the applicable delivery policy, so preserve it for later investigation or processing.”
The general workflow is:
Publish
|
v
Deliver
|
+---- Success โ Done
|
+---- Failure
|
v
Retry
|
+---- Success โ Done
|
+---- Limits reached
|
v
Dead-letter
26. Delayed Delivery
Event Grid also protects unhealthy endpoints through delayed delivery.
If an endpoint repeatedly fails, Event Grid can delay subsequent deliveries to avoid overwhelming an already unhealthy system.
This is important in high-volume AI workloads.
Imagine an AI endpoint can process only 100 requests per second but suddenly receives thousands of events.
Repeatedly retrying failures immediately could make the problem worse.
Event Grid’s retry and delayed-delivery behavior helps prevent this type of cascading overload.
27. Event Grid and Azure Functions
A common AI-200 scenario is:
Event Source
|
v
Event Grid
|
v
Azure Function
For example:
Blob uploaded
|
v
Event Grid
|
v
Function
|
+---- Extract text
+---- Generate embedding
+---- Store vector
This architecture provides several advantages:
Serverless execution
Automatic scaling
Event-driven processing
Loose coupling
Reduced polling
Integration with other Azure services
However, the Function should still be designed for retries and duplicate events.
28. Event Grid and AI Workloads
Event-driven architectures are particularly useful for AI applications.
Consider a document ingestion pipeline:
Blob Storage
|
| BlobCreated
v
Event Grid
|
v
Azure Function
|
+---- Extract content
|
+---- Generate embedding
|
+---- Store in PostgreSQL
|
+---- Publish DocumentIndexed
|
v
Event Grid
|
+---- Notify application
+---- Update analytics
This creates a pipeline in which each stage can react to the completion of another stage.
29. Example: AI Image Processing
Suppose an application receives images.
When an image is uploaded:
Image Upload
|
v
Blob Storage
|
v
Event Grid
|
v
Azure Function
|
+---- Computer vision analysis
|
+---- Store results
|
+---- Publish ImageAnalyzed
Another subscriber might listen for:
ImageAnalyzed
and update a search index.
A third subscriber might send a notification.
The original uploader does not need to know about these downstream processes.
30. Designing Reliable Event Handlers
Because Event Grid can deliver events more than once, consumers should be designed appropriately.
Make operations idempotent
An operation is idempotent when executing it multiple times produces the same intended result as executing it once.
For example:
Set document status = "Processed"
is naturally more idempotent than:
Increment processed-count
If an event is delivered twice, an increment operation could incorrectly increase the count twice.
Track Event IDs
Consumers can maintain a record of processed event IDs.
For example:
Event ID: 8f72...
Status: Processed
When the same event arrives again:
Event already processed
The consumer can safely ignore it.
31. Avoiding Long-Running Event Handlers
Event handlers should generally acknowledge events promptly when possible.
A common architecture for longer AI operations is:
Event Grid
|
v
Function
|
v
Service Bus
|
v
Long-running AI Worker
The Function receives the event and places a durable work item into Service Bus.
The worker can then perform the longer operation.
This separates event notification from workload processing.
32. Event Grid Filtering vs. Application Filtering
Consider two designs.
Design A
Event Grid
|
v
Function
|
+---- Check event type
+---- Check priority
+---- Check environment
Design B
Event Grid
|
| Filter
v
Function
When the filtering criteria can be expressed through Event Grid subscription filters, Design B is generally preferable.
Benefits include:
Less unnecessary invocation
Lower processing overhead
Less network traffic
Lower cost
Simpler application code
This is an important architectural principle.
33. Multiple Subscribers
One of Event Grid’s strengths is that multiple subscriptions can consume the same event stream independently.
For example:
CustomerCreated
|
v
Event Grid
|
+---- Subscription 1 โ CRM Function
|
+---- Subscription 2 โ Analytics Function
|
+---- Subscription 3 โ Notification Function
Each subscription can have its own:
Destination
Filter
Retry configuration
Dead-letter configuration
This allows one event to initiate multiple independent workflows.
34. Event Grid Delivery Batching
Event Grid normally delivers events individually.
For high-throughput scenarios, batching can be enabled.
Batching can improve HTTP efficiency by delivering multiple events in one request.
Current Event Grid push delivery supports configurable batch settings, including maximum events per batch and preferred batch size. Batching uses all-or-none semantics for a delivery request, so consumers must be able to process the entire delivered batch appropriately.
Exam consideration
If a question says:
“The application receives a very high volume of events and HTTP overhead is becoming significant.”
Consider event batching as a possible optimization.
35. Common Exam Scenario
Scenario
An AI application receives thousands of document events.
A Function should process only:
DocumentUploaded
events for:
/finance/
documents.
The best solution is to configure the Event Grid subscription with:
Event type filtering
Subject filtering
rather than sending every event to the Function.
The conceptual design is:
Event Grid
|
| Event Type = DocumentUploaded
| Subject begins with /finance/
v
Azure Function
This is more efficient than filtering inside the Function.
36. Common Exam Scenario: Custom Events
Scenario
A custom AI application needs to notify multiple independent applications whenever a document classification operation completes.
The application generates:
DocumentClassificationCompleted
Which Azure service should provide the event-routing mechanism?
Azure Event Grid is a natural choice.
A custom topic can receive the application’s events, and multiple subscriptions can route them to different handlers.
37. Common Exam Scenario: Temporary Endpoint Failure
Scenario
An Event Grid subscriber temporarily returns HTTP 503.
What should you expect?
Event Grid treats the delivery as unsuccessful and can retry according to its retry behavior.
This is different from simply assuming that the event is permanently lost.
38. Common Exam Scenario: Duplicate Events
Scenario
A Function processes an event successfully, but the response isn’t successfully acknowledged by Event Grid.
Event Grid may deliver the event again.
What should the Function do?
The Function should be designed to handle duplicate events safely.
Possible techniques include:
Event ID tracking
Idempotent writes
Upsert operations
Deduplication records
Transactional processing where appropriate
The key concept is:
Do not assume exactly-once delivery.
39. Common Exam Scenario: Event Loss
Scenario
A critical event must not simply disappear if the subscriber remains unavailable.
What should you configure?
Dead-lettering should be considered.
Configure an Azure Storage Blob container as the dead-letter destination so undeliverable events can be preserved for later reconciliation.
40. Common Exam Scenario: Retry Configuration
Scenario
An application should stop trying to deliver an event after either:
10 delivery attempts, or
60 minutes.
The Event Grid subscription can be configured with:
Maximum delivery attempts = 10
TTL = 60 minutes
Whichever limit is reached first stops the delivery attempts.
41. Key Distinctions to Remember
For the AI-200 exam, remember these distinctions:
Concept
Purpose
Event
Describes something that happened
Event source
Produces the event
Topic
Endpoint/channel for events
Custom topic
Topic for application-generated events
Event subscription
Defines routing to a destination
Event handler
Processes the event
Event type filter
Selects event types
Subject filter
Selects events by subject prefix/suffix
Advanced filter
Filters event properties
Retry
Attempts delivery again
TTL
Maximum time Event Grid attempts delivery
Maximum attempts
Maximum delivery attempts
Dead-letter
Stores undeliverable events
Idempotency
Safely handles duplicate delivery
42. AI-200 Exam Tips
Tip 1: Event Grid is about events
If the question says:
“Something happened, and another service should react.”
Think:
Event Grid
Tip 2: Service Bus is different
If the scenario emphasizes:
Commands
Queues
Durable messaging
Competing consumers
Sessions
Transactional messaging
think:
Azure Service Bus
Tip 3: Filter before invoking
If Event Grid can filter an event, don’t automatically filter it in application code.
Event subscription filtering can reduce unnecessary processing.
Tip 4: Expect duplicates
Event Grid delivery should be treated as at least once.
Design consumers accordingly.
Tip 5: Don’t assume ordering
Event Grid does not guarantee event ordering.
Tip 6: Know retry limits
Remember:
Maximum delivery attempts
+
Event TTL
Whichever limit is reached first stops delivery attempts.
Tip 7: Know dead-lettering
Dead-lettering provides a place to preserve events that could not be delivered.
For Event Grid, the dead-letter destination uses Azure Blob Storage.
Tip 8: Understand the three major filter types
Remember:
Event type
Subject
Advanced properties
43. Summary
Azure Event Grid provides a managed mechanism for building event-driven applications by routing events from producers to subscribers.
For AI-200, the most important concepts are:
Event sources produce events.
Topics provide event publishing endpoints.
Custom topics support application-generated events.
Event subscriptions define routing.
Event handlers process events.
Event type filters select specific types of events.
Subject filters select events based on their subjects.
Advanced filters can evaluate event properties.
Event Grid provides retry behavior for failed deliveries.
Retry limits can be configured using maximum attempts and TTL.
Dead-lettering can preserve events that cannot be delivered.
Event delivery should be treated as at least once.
Consumers should be designed to tolerate duplicates.
Event ordering should not be assumed.
Event Grid and Service Bus solve different messaging problems.
Event Grid is particularly useful for loosely coupled, event-driven AI workflows.
The most important mental model is:
Something happens โ Event is generated โ Event Grid routes it โ Matching subscription receives it โ Handler processes it โ Retry/dead-letter mechanisms provide resilience.
Practice Exam Questions
Question 1
An AI application publishes a DocumentProcessed event whenever document processing finishes. Several independent applications need to react to this event, and the producing application should not need to know which applications consume it.
Which Azure service is the best fit for routing these events?
A. Azure Event Grid
B. Azure Key Vault
C. Azure App Configuration
D. Azure Container Registry
Answer: A
Explanation
Azure Event Grid is designed for event routing and pub/sub scenarios. A custom topic can receive application-generated events, while multiple event subscriptions can independently route those events to different handlers.
An Event Grid subscription should receive only events whose subject begins with:
/documents/invoices/
Which filtering mechanism should be used?
A. Advanced numeric filtering
B. Subject filtering
C. Event TTL
D. Maximum delivery attempts
Answer: B
Explanation
Subject filtering is specifically designed to select events based on the beginning or ending of an event’s subject.
TTL and maximum delivery attempts control delivery behavior rather than which events are selected.
Question 3
An application publishes the following event:
{
"eventType":"DocumentUploaded",
"data":{
"department":"finance",
"priority":8
}
}
A subscriber should receive only events where data.priority is greater than or equal to 7.
Which Event Grid capability should be used?
A. Subject filtering
B. Event TTL
C. Advanced filtering
D. Dead-lettering
Answer: C
Explanation
Advanced filtering allows subscriptions to evaluate properties within the event data using operators such as NumberGreaterThanOrEquals.
Subject filtering is appropriate for the event subject, while TTL and dead-lettering concern delivery reliability.
Question 4
An Event Grid subscriber temporarily returns HTTP 503 responses because the application is unavailable. What should you expect Event Grid to do?
A. Immediately delete all affected events
B. Permanently disable the subscription
C. Retry delivery according to its retry behavior and configured limits
D. Convert the events into Service Bus messages automatically
Answer: C
Explanation
HTTP 503 represents a service-unavailable condition. Event Grid can retry failed delivery using its retry behavior. Delivery continues until successful delivery or the applicable retry policy limits are reached.
Event Grid does not automatically convert the events into Service Bus messages or permanently disable the subscription.
Question 5
A critical Event Grid event cannot be delivered after the configured retry policy is exhausted. The organization needs to preserve the event for later investigation.
What should you configure?
A. A dead-letter destination in Azure Blob Storage
B. An Azure Container Registry
C. An Azure App Configuration store
D. An Azure Key Vault secret
Answer: A
Explanation
Event Grid supports dead-lettering to an Azure Storage Blob container. Undeliverable events can be stored there for later inspection and reconciliation.
The other services do not provide Event Grid dead-letter storage.
Question 6
An Event Grid subscription is configured with:
Maximum delivery attempts = 5
TTL = 60 minutes
The event reaches five delivery attempts after only 12 minutes. What happens next?
A. Event Grid continues retrying until 60 minutes have elapsed
B. Event Grid stops delivery attempts because the maximum attempt limit was reached
C. Event Grid automatically changes the maximum attempts to 30
D. Event Grid immediately sends the event to every other subscription
Answer: B
Explanation
When both maximum delivery attempts and TTL are configured, the first limit reached determines when Event Grid stops delivery attempts.
Because five attempts have occurred before the 60-minute TTL expires, the maximum-attempt limit is reached first.
If dead-lettering is configured, the event can then be dead-lettered.
Question 7
An AI application processes DocumentProcessed events. Occasionally, the same event is delivered twice. The application currently increments a counter every time it receives the event, causing inaccurate results.
What is the best design improvement?
A. Increase the event TTL
B. Disable event filtering
C. Make the event-processing operation idempotent
D. Increase the number of Event Grid subscriptions
Answer: C
Explanation
Event Grid uses at-least-once delivery semantics, so consumers must be prepared for duplicate events.
An idempotent operation can safely process the same event multiple times without producing an incorrect result. Event IDs can also be tracked to implement deduplication.
Changing TTL, filtering, or subscription count does not solve the fundamental duplicate-processing problem.
Question 8
An application generates its own events and needs an Event Grid endpoint to which it can publish those events.
Which resource should the application use?
A. Azure Service Bus session
B. Azure Event Hubs consumer group
C. Azure Storage queue
D. An Azure Event Grid custom topic
Answer: D
Explanation
A custom Event Grid topic provides a user-defined endpoint for applications to publish their own events.
Service Bus, Event Hubs, and Storage queues have different messaging purposes and do not represent the Event Grid custom-topic publishing model.
Question 9
An Event Grid subscription should receive only events of these types:
DocumentCreated
DocumentUpdated
It should not receive:
DocumentDeleted
Which configuration should be used?
A. Included event type filtering
B. Dead-lettering
C. Event TTL
D. Maximum delivery attempts
Answer: A
Explanation
Event type filtering allows a subscription to specify which event types it should receive.
The other options control delivery reliability rather than event selection.
Question 10
An AI application receives a very high volume of Event Grid events. HTTP request overhead is becoming significant, and the event-processing service can efficiently process multiple events in a single request.
Which Event Grid capability should be considered?
A. Dead-lettering
B. Event delivery batching
C. Subject filtering
D. Event TTL reduction
Answer: B
Explanation
Event Grid supports batching for push delivery. Instead of sending every event in an individual delivery request, multiple events can be delivered together.
Batching can improve HTTP efficiency in high-throughput scenarios. The consumer must be designed to process the batch appropriately because Event Grid uses all-or-none semantics for a batch delivery request.
Final Exam Takeaways
Before taking the AI-200 exam, make sure you can confidently answer these questions:
When should I use Event Grid? For event-driven routing and reacting to things that happened.
When should I consider Service Bus instead? When the scenario calls for durable messaging, queues, commands, sessions, or sophisticated message-processing patterns.
How do I create application-generated events? Publish them to an Event Grid custom topic.
How do I control which events a subscriber receives? Use event type, subject, and advanced filters.
What happens when delivery fails? Event Grid can retry according to its retry behavior.
What controls how long Event Grid retries? Event TTL and maximum delivery attempts.
What happens when delivery ultimately fails? With dead-lettering configured, the event can be stored in Azure Blob Storage.
Can an event be delivered more than once? Yes. Design consumers to tolerate duplicates.
Does Event Grid guarantee event ordering? No.
How can high-volume delivery be optimized? Consider event batching where the consumer supports it.
If you understand those ten pointsโand especially the distinctions between event filtering, retry, TTL, dead-lettering, and idempotent processingโyou’ll have a strong foundation for the Event Grid portion of AI-200.
This post is a part of the AI-200: Developing AI Cloud Solutions on Azure ย Exam Prep Hub. This topic falls under these sections: Develop containerized solutions on Azure (20โ25%) ย ย --> Implement container application hosting ย ย ย ย ย --> Build and Run Images by Using Azure Container Registry Tasks
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Overview
Azure Container Registry Tasks (ACR Tasks) provides cloud-based capabilities for building, testing, and managing container images in Azure Container Registry (ACR).
ACR Tasks is particularly useful when developers want to move container image builds into the cloud rather than relying on a locally installed Docker engine. It can support simple on-demand builds, automated builds triggered by source-code or base-image changes, and more sophisticated multi-step workflows involving multiple containers.
For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand not only how to execute an ACR Task, but also when to use each type of task, how build contexts work, how images are tagged, how multi-step tasks are defined, how tasks are triggered, and how tasks can securely access other resources.
Microsoft’s AI-200 training specifically identifies building and managing container images in the cloud with ACR Tasks and using the Azure CLI to run ACR quick tasks as learning objectives.
1. What Are Azure Container Registry Tasks?
ACR Tasks is a collection of capabilities within Azure Container Registry that allows you to perform container image operations in Azure.
At a high level:
Source Code / Dockerfile
|
v
ACR Task
|
+-----+-----+
| |
v v
Build Test
| |
+-----+-----+
|
v
Container Image
|
v
ACR
ACR Tasks can:
Build container images in Azure
Push images to ACR
Run containers as part of a task
Test container images
Build multiple images
Execute steps sequentially or in parallel
Automatically trigger builds from source-code changes
Automatically rebuild images when base images change
Run tasks on a schedule
Integrate into CI/CD workflows
ACR Tasks supports Linux, Windows, and ARM image platforms, depending on the configuration and supported scenarios.
2. Why Use ACR Tasks?
A traditional container development workflow might look like this:
Developer Computer
|
+-- Docker build
|
+-- Docker test
|
+-- Docker push
|
v
Azure Container Registry
This requires the developer’s machine to have the appropriate container tooling.
With an ACR Task:
Developer
|
| Azure CLI
v
Azure Container Registry
|
+-- Build
+-- Test
+-- Push
The build is performed in Azure.
This has several advantages:
No local Docker Engine is required for an ACR quick task.
Builds can be standardized.
Builds can be automated.
Container images can be built close to the registry.
Build workflows can be triggered by source-code changes.
Base-image updates can automatically initiate rebuilds.
More complex build/test workflows can be defined using YAML.
Microsoft describes quick tasks as an integrated development experience that offloads container image builds to Azure and can perform the equivalent of docker build and docker push in the cloud.
3. Three Important ACR Task Scenarios
For AI-200, understand these three categories:
Task type
Primary purpose
Quick task
On-demand build and push
Automatically triggered task
Automatically execute when an event occurs
Multi-step task
Build, test, run, and push multiple images/workflows
These aren’t mutually exclusive concepts.
For example, a multi-step task can also be automatically triggered by a Git commit.
4. Quick Tasks
A quick task is an on-demand container image build performed in Azure.
It is particularly useful during development.
The Azure CLI command is:
az acr build
For example:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
The final . represents the build context.
Conceptually, this performs:
Dockerfile + build context
|
v
ACR Task
|
v
Build image
|
v
Push image
|
v
ACR
The important point is that the build takes place in Azure rather than requiring a local Docker engine.
ACR Tasks’ quick-build capability is essentially a cloud-based equivalent of performing a Docker build and push operation.
5. Understanding the Build Context
One of the most important concepts when using az acr build is the build context.
Consider:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
The . specifies the current directory as the build context.
The build context contains files that are available to the Docker build process.
For example:
orders-api/
โ
โโโ Dockerfile
โโโ requirements.txt
โโโ app.py
โโโ src/
Running:
az acr build ... .
makes that directory the build context.
The context can also come from other supported locations, including source repositories.
6. Dockerfile and ACR Tasks
ACR Tasks uses familiar Docker build syntax.
For example:
FROM python:3.12
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "app.py"]
You can then build the image with:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
The Dockerfile defines how the container image is constructed.
ACR Tasks handles the build environment and performs the build in Azure.
7. Specifying a Dockerfile
If the Dockerfile has a different name or location, specify it using --file.
For example:
az acr build \
--registry myregistry \
--image orders-api:v1 \
--file Dockerfile.production \
.
You can also specify a Dockerfile located elsewhere relative to the build context.
The important exam concept is:
The build context and Dockerfile are related but are not necessarily the same thing.
The Dockerfile describes the build instructions.
The build context identifies the files available to the build.
8. ACR Tasks Versus Local Docker Builds
Consider this traditional command:
docker build -t orders-api:v1 .
With ACR Tasks, you can use:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
The conceptual difference is:
Local Docker
ACR Tasks
Build occurs locally
Build occurs in Azure
Requires Docker Engine
No local Docker Engine required for quick tasks
Image initially exists locally
Image can be pushed directly to ACR
Developer manages build environment
Azure provides the task execution environment
This distinction is a likely source of scenario-based exam questions.
9. Building Without a Local Docker Engine
Suppose a developer has:
Azure CLI
Access to an Azure Container Registry
A Dockerfile
Application source code
but doesn’t have Docker installed.
The developer can still build the image using:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
This is one of the strongest scenarios for recognizing ACR Tasks on the exam.
10. Running an Image with ACR Tasks
ACR Tasks can also run containers as part of a task.
The cmd step is used for this purpose in multi-step tasks.
For example:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
-cmd: $Registry/orders-api:$ID
The cmd step runs a container using the specified image.
This makes it possible to use ACR Tasks for testing.
For example:
Build image
|
v
Run image
|
v
Execute tests
|
v
Push image
The cmd step supports parameters similar to familiar container-run operations, including environment variables and detached execution.
11. Multi-Step Tasks
A multi-step task allows you to create a more sophisticated container workflow.
Instead of simply:
Build โ Push
you can implement:
Build
|
v
Run
|
v
Test
|
v
Push
You can also build multiple images:
+--> Build API ----+
| |
Source ------+ +--> Test --> Push
| |
+--> Build Worker -+
Multi-step tasks are defined in a YAML file.
Microsoft identifies three primary ACR Tasks step types:
build
push
cmd
12. The build Step
The build step builds a container image.
Example:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
Conceptually, this is similar to:
docker build
but the build is performed within the ACR Tasks environment.
The image name should identify the image that the task builds.
13. The push Step
The push step pushes an image to a container registry.
Example:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
-push:
- $Registry/orders-api:$ID
The build step creates the image.
The push step publishes it to the registry.
An important exam distinction is that in a multi-step az acr run task, you should not assume that a built image is automatically pushed simply because it was built. The task definition can explicitly use a push step to publish it.
14. The cmd Step
The cmd step executes a container.
For example:
version: v1.1.0
steps:
-cmd: bash:3.0 echo "Hello from ACR Tasks"
It can also execute an image produced by an earlier build:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
-cmd: $Registry/orders-api:$ID
This is especially useful for testing.
The cmd step can use environment variables and other execution options.
15. Build, Test, and Push
A common ACR Tasks pattern is:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
-cmd: $Registry/orders-api:$ID
-push:
- $Registry/orders-api:$ID
Conceptually:
BUILD
|
v
Container Image
|
v
TEST
|
Tests successful
|
v
PUSH
|
v
ACR
This pattern can prevent an image from being pushed until validation has occurred.
16. Step Dependencies
ACR Tasks allows steps to have dependencies.
The when property can specify which previous steps must complete before a step executes.
For example:
version: v1.1.0
steps:
-id: build
build: -t $Registry/orders-api:$ID .
-id: test
cmd: $Registry/orders-api:$ID
when:["build"]
-id: push
push:
- $Registry/orders-api:$ID
when:["test"]
The sequence is:
build
|
v
test
|
v
push
This allows the task to express workflow dependencies explicitly.
17. Parallel Execution
ACR Tasks can also execute independent steps concurrently.
For example:
version: v1.1.0
steps:
-id: build-api
build: -t $Registry/api:$ID .
when:["-"]
-id: build-worker
build: -t $Registry/worker:$ID ./worker
when:["-"]
The special:
when:["-"]
indicates that the step has no dependency on another step and can begin immediately.
This can reduce total task execution time when operations are independent.
Microsoft’s ACR Tasks YAML reference specifically documents when: ["-"] for steps that have no dependency and can execute concurrently.
18. Build Dependencies Versus Sequential Steps
If when isn’t specified, a step is dependent on the previous step in the task definition.
For example:
steps:
-id: build
build: -t $Registry/api:$ID .
-id: test
cmd: $Registry/api:$ID
-id: push
push:
- $Registry/api:$ID
This naturally produces:
build โ test โ push
If explicit dependencies are needed, use when.
19. Running an ACR Task
The Azure CLI command commonly used to execute a task definition is:
az acr run
For example:
az acr run \
--registry myregistry \
--file acr-task.yaml \
.
You can also use a Git repository as the context.
For example:
az acr run \
--registry myregistry \
--file acr-task.yaml \
https://github.com/example/project.git
The task receives the specified source context and executes the defined workflow.
20. az acr build Versus az acr run
This is an important distinction for AI-200.
az acr build
Designed primarily for a quick cloud-based image build.
Example:
az acr build \
--registry myregistry \
--image orders-api:v1 \
.
Think:
Build an image quickly in Azure.
az acr run
Executes an ACR Tasks workflow.
Example:
az acr run \
--registry myregistry \
--file acr-task.yaml \
.
Think:
Run a defined task workflow.
A multi-step task uses az acr run.
21. ACR Tasks Run Variables
ACR Tasks provides built-in run variables.
These variables can be used to create standardized image names and tags.
One particularly useful variable is:
Run.ID
which can be represented in task YAML using the $ID alias.
For example:
steps:
-build: -t $Registry/orders-api:$ID .
This gives each task run a unique identifier that can be incorporated into the image tag.
ACR Tasks also provides variables associated with:
Registry
Registry name
Run ID
Date
Operating system
Architecture
Git commit
Git branch
Task name
22. Why Use Unique Build Tags?
Suppose every build uses:
orders-api:latest
You lose an easy way to distinguish individual builds.
Instead, you could use:
orders-api:build-123
orders-api:build-124
orders-api:build-125
ACR Tasks’ run ID can help automate this.
For example:
steps:
-build: -t $Registry/orders-api:$ID .
-push:
- $Registry/orders-api:$ID
This produces unique image references for individual runs.
This is especially useful for CI/CD scenarios.
23. Automatically Triggered Tasks
ACR Tasks can automatically execute based on events.
Important trigger scenarios include:
Source-code updates
A task can run when code is committed to a supported Git repository.
For example:
Developer commits code
|
v
Git repository
|
v
ACR Task trigger
|
v
Build image
|
v
Push image
Base-image updates
A task can be triggered when a base image changes.
For example:
FROM python:3.12
If the base image is updated, an ACR Task can rebuild the application image.
This is useful for automatically incorporating updated OS or framework components.
Scheduled execution
ACR Tasks can also support scheduled execution.
For example:
Every night
|
v
ACR Task
|
v
Build/test image
Microsoft documents source-code, base-image, and timer-based triggers as ACR Tasks automation scenarios.
24. Base Image Update Triggers
Base image triggers are especially relevant to security and maintenance.
Suppose:
FROM ubuntu:24.04
A security update causes a newer version of the base image to become available.
Without automation:
Base image updated
|
X
Application image remains unchanged
With an ACR Task:
Base image updated
|
v
ACR Task trigger
|
v
Rebuild application image
|
v
Push updated image
This allows organizations to automatically rebuild images when their dependencies change.
Microsoft describes this scenario as a way to automate OS and framework patching for container images.
25. Source-Code Triggers
ACR Tasks can integrate with source repositories.
For example:
Git commit
|
v
ACR Task
|
+-- Build
+-- Test
+-- Push
This provides a simple cloud-based container CI workflow.
A task can be configured to respond to commits and, depending on the configuration, pull-request activity in supported Git repositories.
26. Multi-Container Workflows
ACR Tasks becomes particularly valuable when an application contains multiple containers.
Suppose you have:
Web API
Worker
Test suite
You could define:
Build API
|
Build Worker
|
Run tests
|
Push API
|
Push Worker
Or independent builds could execute concurrently:
+--> Build API -----+
| |
START ------+ +--> Test --> Push
| |
+--> Build Worker --+
Multi-step tasks are designed specifically for these types of workflows.
27. ACR Tasks and CI/CD
ACR Tasks can be incorporated into a broader CI/CD architecture.
For example:
Developer
|
v
Git Repository
|
v
ACR Task
|
+--> Build
|
+--> Test
|
+--> Push
|
v
Azure Container Registry
|
v
Container Apps / AKS / App Service
ACR Tasks is therefore not merely a command for building images. It can serve as a container lifecycle building block within an automated development process.
28. Accessing Other Registries
An ACR Task may need to access images or artifacts outside the registry where the task runs.
For example:
ACR Task
|
| Pull base image
v
External Registry
or:
ACR Task
|
| Push image
v
Another Registry
ACR Tasks supports authentication mechanisms for accessing protected resources.
Managed identities are particularly useful when an ACR Task needs to access other Azure resources without embedding credentials in the task definition.
Microsoft documents both system-assigned and user-assigned managed identities for ACR Tasks.
29. Managed Identities for ACR Tasks
An ACR Task can have a managed identity.
Two types are available:
System-assigned managed identity
The identity is associated with the specific ACR Task resource.
Its lifecycle is tied to that resource.
User-assigned managed identity
The identity is an independent Azure resource that can be assigned to multiple resources.
This can be useful when the same identity needs to be reused.
The key exam concept is:
Managed identities allow ACR Tasks to access protected Azure resources without embedding credentials in the task definition.
30. ACR Tasks and Azure Key Vault
ACR Tasks can also integrate with Azure Key Vault for scenarios where a task needs access to secrets.
A secure architecture might look like:
Azure Key Vault
|
| Secret
v
ACR Task ------ Managed Identity
|
v
Build/Test
This is preferable to hard-coding credentials into Dockerfiles, scripts, or task definitions.
31. Security Considerations
When designing ACR Task workflows:
Avoid putting secrets directly on command lines
Command-line arguments can potentially be captured by diagnostic or logging systems.
Avoid embedding credentials in Dockerfiles
A Dockerfile should not contain permanent passwords, tokens, or keys.
Prefer managed identities
When the target resource supports identity-based authentication, managed identities reduce credential-management overhead.
Use least privilege
Give the task only the permissions it needs.
Be careful with external registry credentials
If a task must access another private registry, configure authentication appropriately rather than placing credentials in source code.
Microsoft specifically warns that information supplied through command lines or URIs can appear in ACR diagnostic tracing, including sensitive values.
32. Task YAML Structure
A basic multi-step task looks like:
version: v1.1.0
steps:
-build: -t $Registry/orders-api:$ID .
-push:
- $Registry/orders-api:$ID
A more sophisticated task could look like:
version: v1.1.0
steps:
-id: build-api
build: -t $Registry/orders-api:$ID .
-id: test-api
cmd: $Registry/orders-api:$ID
when:["build-api"]
-id: push-api
push:
- $Registry/orders-api:$ID
when:["test-api"]
The key elements are:
Element
Purpose
version
YAML task format version
steps
Defines task operations
build
Builds an image
push
Pushes an image
cmd
Runs a container
id
Gives a step an identifier
when
Defines dependencies
$Registry
Registry run-variable alias
$ID
Run ID alias
ACR Tasks currently supports YAML as the task-definition format.
33. A Complete Build-Test-Push Example
Consider an API application with:
Dockerfile
src/
tests/
A multi-step task could conceptually perform:
version: v1.1.0
steps:
-id: build
build: -t $Registry/orders-api:$ID .
-id: test
cmd: $Registry/orders-api:$ID
when:["build"]
-id: push
push:
- $Registry/orders-api:$ID
when:["test"]
The workflow becomes:
+----------------+
| Source |
+-------+--------+
|
v
BUILD
|
v
Container Image
|
v
TEST
|
Tests pass
|
v
PUSH
|
v
ACR
This is an excellent pattern to recognize in scenario-based questions.
34. az acr build Versus Multi-Step Tasks
A useful exam comparison is:
Requirement
Appropriate approach
Build one image now
az acr build
Build image without local Docker
az acr build
Build and push a simple image
Quick task
Build and test an image
Multi-step task
Build several images
Multi-step task
Run a container during a workflow
cmd step
Push an image from a multi-step task
push step
Trigger from Git commit
Automatically triggered ACR Task
Rebuild when base image changes
Base-image trigger
Run periodically
Scheduled task
35. Common Exam Traps
Trap 1: Choosing Azure Container Instances
ACR Tasks is about building and managing container image workflows.
Azure Container Instances is primarily about running containers.
If the question says:
“Build a container image in Azure without installing Docker locally.”
Think:
ACR Tasks
not Azure Container Instances.
Trap 2: Confusing ACR with ACR Tasks
ACR is the registry.
ACR Tasks provides cloud-based build and automation capabilities.
Think:
ACR
โ
Store images
ACR Tasks
โ
Build/test/automate images
Trap 3: Assuming az acr run and az acr build are identical
They are not.
az acr build is designed for the quick cloud build scenario.
az acr run executes a task definition or command in the ACR Tasks environment.
Trap 4: Assuming every build automatically pushes an image
For a quick az acr build, the resulting image is pushed to the registry by default.
For an az acr run multi-step task, you should explicitly define a push step when you want to push the built image.
This distinction is explicitly documented in the ACR Tasks YAML reference.
Trap 5: Using cmd when you need to build an image
cmd runs a container.
build builds a container image.
Remember:
build โ create image
cmd โ run container
push โ publish image
Trap 6: Ignoring the build context
The build context determines what files are available to the Docker build.
A Dockerfile alone isn’t necessarily sufficient if it references files from the context.
Trap 7: Putting secrets in the Dockerfile
Never assume that a secret belongs in:
ENV PASSWORD=...
or:
RUN some-command --password ...
Use appropriate Azure identity and secret-management mechanisms instead.
36. AI-200 Exam-Focused Review
Make sure you understand the following:
ACR Tasks
Cloud-based container build and automation capabilities.
Quick task
On-demand image build, commonly using:
az acr build
az acr run
Executes an ACR task workflow or command.
Build context
The files supplied to the container build.
build
Builds a container image.
push
Pushes an image to a registry.
cmd
Runs a container as part of a task.
when
Defines dependencies between task steps.
$Registry
Identifies the registry associated with the task run.
$ID
Identifies the current task run and can be used to generate unique tags.
Multi-step task
Supports complex workflows involving building, testing, running, and pushing containers.
Source trigger
Automatically runs a task when supported source-code changes occur.
Base-image trigger
Automatically rebuilds images when a base image changes.
Scheduled trigger
Runs tasks according to a schedule.
Managed identity
Allows a task to access protected Azure resources without embedding credentials.
37. The Mental Model to Remember
For AI-200, think of ACR Tasks as a cloud-based container build and automation engine attached to Azure Container Registry.
SOURCE
|
+---------+---------+
| |
Dockerfile Git Repo
| |
+---------+---------+
|
v
ACR TASK
|
+------------+------------+
| | |
BUILD CMD PUSH
| | |
| TEST |
| | |
+------------+------------+
|
v
ACR IMAGE
|
v
Container Service
+----------+----------+
| | |
AKS Container Apps App Service
The most important distinction is:
ACR stores the image; ACR Tasks builds, tests, and automates the image lifecycle.
Practice Exam Questions
Question 1
A developer has a Dockerfile and application source code but does not have Docker installed locally. The developer needs to build the image in Azure and store it in an Azure Container Registry.
Which command should the developer use?
A. az container create
B. az acr repository create
C. az acr build
D. az aks create
Answer: C
Explanation:az acr build performs a cloud-based container image build using Azure Container Registry Tasks. The build occurs in Azure, so a local Docker Engine isn’t required for this scenario. The command can build and push the resulting image to ACR.
Question 2
A development team wants to create an automated workflow with the following steps:
Build an API container image.
Run the image.
Execute functional tests.
Push the image only if the tests succeed.
Which ACR Tasks capability should be used?
A. A multi-step task
B. ACR geo-replication
C. An ACR repository
D. An Azure Container Apps revision
Answer: A
Explanation: Multi-step ACR Tasks are designed for workflows that combine multiple container operations. The build, cmd, and push step types can be combined, and dependencies can be defined using the when property. This allows testing to occur before the image is pushed.
Question 3
An ACR Task contains the following YAML:
steps:
-id: build
build: -t $Registry/api:$ID .
-id: test
cmd: $Registry/api:$ID
when:["build"]
-id: push
push:
- $Registry/api:$ID
when:["test"]
What is the purpose of when: ["test"] on the final step?
A. It causes the push to run before testing
B. It causes the push to run concurrently with testing
C. It causes the push step to be skipped
D. It makes the push step dependent on successful completion of the test step
Answer: D
Explanation: The when property establishes dependencies between task steps. Here, the push step depends on the step identified as test, so it won’t execute until the test step completes successfully.
Question 4
An organization wants an ACR Task to automatically rebuild application images whenever a new version of a base image becomes available.
Which trigger should be configured?
A. A repository namespace trigger
B. A base-image update trigger
C. A container restart trigger
D. An Azure Monitor alert trigger
Answer: B
Explanation: ACR Tasks supports base-image update triggers. When the configured base image changes, the task can automatically rebuild the application image. This is particularly useful for incorporating updated operating-system and framework components.
Question 5
An ACR Task needs to execute two independent image builds at the same time. Which YAML configuration allows the steps to start without depending on another task step?
A. when: ["-"]
B. when: ["parallel"]
C. when: ["async"]
D. when: ["none"]
Answer: A
Explanation: In ACR Tasks, when: ["-"] indicates that the step has no dependency on another step and can begin immediately. This can allow independent steps to execute concurrently.
Question 6
A developer wants to create a unique container image tag for every ACR Task execution. Which ACR Tasks variable is specifically designed to identify the current task run?
A. $Branch
B. $Registry
C. $ID
D. $Architecture
Answer: C
Explanation:$ID is an ACR Tasks alias for the current run ID. It can be used to create unique image tags, such as:
-t $Registry/api:$ID
This is useful for distinguishing images produced by different task executions.
Question 7
A multi-step ACR Task has the following steps:
steps:
-build: -t $Registry/api:$ID .
-push:
- $Registry/api:$ID
What is the primary purpose of the push step?
A. Run the container
B. Upload the built image to a container registry
C. Compile the Dockerfile
D. Create an Azure Container Apps revision
Answer: B
Explanation: The push step publishes a built or retagged container image to a container registry. The build step creates the image; push publishes it.
Question 8
An organization wants an ACR Task to execute whenever developers commit code to a supported Git repository. Which capability should be configured?
A. A source-code trigger
B. An ACR retention policy
C. An ACR private endpoint
D. A container health probe
Answer: A
Explanation: ACR Tasks supports source-code triggers that can automatically execute builds or multi-step tasks when changes occur in supported Git repositories. This provides a simple mechanism for integrating container builds into a CI workflow.
Question 9
An ACR Task must access a protected Azure resource. The organization doesn’t want credentials embedded in the task definition.
Which approach provides the most appropriate Azure-native solution?
A. Store the credential in the Dockerfile
B. Put the password in the task’s command line
C. Use a managed identity for the ACR Task
D. Make the Azure resource publicly accessible
Answer: C
Explanation: ACR Tasks can use system-assigned or user-assigned managed identities to access protected resources without embedding credentials in task definitions. The identity must be granted the required permissions on the target resource.
Question 10
A developer executes:
az acr build \
--registry myregistry \
--image orders-api:v2 \
.
What does the final . represent?
A. The ACR registry name
B. The image tag
C. The Docker image digest
D. The build context
Answer: D
Explanation: The final . specifies the current directory as the build context. Files in the build context are made available to the Docker build process. The Dockerfile and files referenced during the build generally need to be available through the selected context.
Key Takeaways
For the AI-200 exam, remember these relationships:
Concept
Remember
ACR
Stores and manages container images
ACR Tasks
Builds, runs, tests, and automates container workflows
az acr build
Performs an on-demand cloud image build
az acr run
Runs an ACR Tasks workflow/command
Build context
Files supplied to the image build
build
Creates a container image
cmd
Runs a container
push
Publishes an image to a registry
when
Controls task-step dependencies
when: ["-"]
Allows an independent step to start immediately
$ID
Current task run identifier
$Registry
Registry associated with the task
Multi-step task
Build/test/run/push workflows
Source trigger
Run when source code changes
Base-image trigger
Rebuild when a base image changes
Scheduled trigger
Run according to a schedule
Managed identity
Secure access without embedding credentials
The single most useful mental model for this objective is:
Do I need to build an image in Azure? โ az acr build / ACR Tasks
Do I need multiple build/test/run operations? โ Multi-step ACR Task
Do I need to execute a container? โ cmd
Do I need to publish an image? โ push
Do steps have dependencies? โ when
Do independent steps need to run concurrently? โ when: ["-"]
Should builds happen automatically after source changes? โ Source trigger
Should images rebuild when a base image changes? โ Base-image trigger
Does the task need secure access to another Azure resource? โ Managed identity
Do I need unique image versions for task runs? โ Use $ID in the image tag
These distinctions are especially important because AI-200 scenario questions are likely to test which ACR Tasks capability best fits a particular development or deployment requirement, rather than simply asking you to recall an individual command.
This post is a part of the AI-200: Developing AI Cloud Solutions on Azure Exam Prep Hub. This topic falls under these sections: Develop containerized solutions on Azure (20โ25%) --> Implement container application hosting --> Build, store, version, and manage container images by using Azure Container Registry
Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.
Overview
Azure Container Registry (ACR) is a managed, private registry service in Azure for storing and managing container images and other OCI-compatible artifacts. It provides a central location from which containerized applications can obtain the images they need to run on services such as Azure App Service, Azure Container Apps, Azure Kubernetes Service (AKS), and Azure Container Instances.
For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand more than simply how to push an image into ACR. You should be comfortable with the hierarchy of registries, repositories, images, tags, manifests, and layers; image versioning strategies; building images using ACR Tasks; managing and deleting images; and selecting appropriate authentication and registry capabilities.
The current Microsoft Learn study guide specifically identifies this objective as part of Implement container application hosting. It also separately identifies ACR Tasks as an exam objective, so understanding how ACR stores images and how ACR Tasks builds them is particularly important.
1. What Is Azure Container Registry?
Azure Container Registry is a private container registry service hosted in Azure.
A container registry solves a fundamental problem in containerized application development:
Where do applications securely obtain the container images they need to run?
Instead of relying exclusively on a public registry, an organization can maintain its own private registry in Azure.
A typical workflow looks like this:
Developer
|
| Build container image
v
Docker / ACR Tasks
|
| Push
v
Azure Container Registry
|
+------------------+
| |
v v
Azure App Service AKS
| |
v v
Container Apps Container workloads
ACR provides capabilities for:
Storing container images
Storing OCI artifacts
Organizing images into repositories
Tagging and versioning images
Pushing and pulling images
Building images using ACR Tasks
Managing image metadata
Controlling access
Replicating images across regions
Integrating with Azure container services
Microsoft describes ACR as a private, managed registry that supports building, storing, and managing images for container deployments.
2. Understand the ACR Hierarchy
One of the most important concepts for AI-200 is understanding how ACR organizes container content.
The hierarchy can be thought of as:
Azure Container Registry
|
+-- Repository
| |
| +-- Image : Tag
| +-- Image : Tag
| +-- Image : Tag
|
+-- Repository
|
+-- Image : Tag
+-- Image : Tag
The important concepts are:
Registry
Repository
Artifact/Image
Tag
Manifest
Layer
Digest
Understanding the distinctions between these concepts is a common source of exam questions.
2.1 Registry
The registry is the overall ACR resource.
For example:
contosoregistry.azurecr.io
The registry provides the endpoint through which clients push and pull container images.
A registry can contain many repositories.
2.2 Repository
A repository is a collection of related container images or artifacts.
Namespaces help organize repositories logically, although they aren’t independent Azure resources or hierarchical security boundaries simply because they contain / characters.
Microsoft notes that repository names can include namespaces and are managed independently by the registry.
3. Container Image Tags
A tag provides a human-readable identifier for a particular version or variant of an image.
For example:
customer-api:v1
customer-api:v2
customer-api:2026-08-07
customer-api:production
The complete image reference might be:
contosoregistry.azurecr.io/customer-api:v2
The structure is:
<registry>/<repository>:<tag>
For example:
contosoregistry.azurecr.io/customer-api:v2
where:
Component
Value
Registry
contosoregistry.azurecr.io
Repository
customer-api
Tag
v2
Microsoft recommends using appropriate tagging strategies for deployment scenarios and notes that latest is used by default when no tag is specified in Docker commands.
4. Tagging and Versioning Strategies
Image versioning is extremely important for reliable deployments.
Consider:
customer-api:latest
This tag is convenient, but it does not necessarily identify an immutable version.
Suppose today’s latest points to:
Image A
and tomorrow the same tag is updated:
latest โ Image B
A deployment configured to use latest may therefore receive a different image without its configuration changing.
For production deployments, a better approach is generally to use unique version identifiers.
A digest identifies the content associated with a manifest.
Compare:
customer-api:v2
with:
customer-api@sha256:abc123...
A tag can be moved to point to another image.
A digest identifies a specific content-addressed version.
Microsoft specifically notes that pulling by digest guarantees the image version being retrieved even if an identically tagged image is subsequently pushed.
If two images share the same base layers, those layers don’t necessarily have to be independently stored and transferred each time.
This can reduce storage and transfer requirements.
7. Manifests
A container image is associated with a manifest.
The manifest contains information needed to identify the image and its layers.
Conceptually:
Image Manifest
|
+-- Configuration
|
+-- Layer 1
+-- Layer 2
+-- Layer 3
The manifest is also associated with the image’s digest.
This distinction matters when managing images in ACR.
For example, removing a tag doesn’t necessarily mean that all image data is immediately removed.
An untagged manifest and its associated layers may continue to consume storage until they are deleted and no longer referenced.
Microsoft specifically warns that repeatedly pushing modified artifacts with identical tags can create untagged artifacts that continue consuming registry storage.
The second approach provides stronger guarantees regarding exactly which image content is retrieved.
10. Azure Container Registry Tasks
One of the most important ACR features for AI-200 is ACR Tasks.
ACR Tasks allows container images to be built in Azure rather than requiring the developer to perform the build locally.
Microsoft describes ACR Tasks as a suite of capabilities for building, testing, and managing container images.
For example:
az acr build \
--registry contosoregistry \
--image customer-api:v1 \
--file Dockerfile .
The command:
Sends the build context to Azure.
Uses the Dockerfile.
Builds the image in Azure.
Tags the resulting image.
Pushes the resulting image into the registry.
This is particularly useful when a developer doesn’t have Docker installed locally.
Microsoft’s current quickstart explicitly demonstrates building, pushing, and running an image using ACR Tasks without requiring a local Docker installation.
11. ACR Tasks Quick Tasks
A quick task is useful for an on-demand image build.
For example:
az acr build \
--registry contosoregistry \
--image customer-api:v1 \
.
This is useful during the development inner loop.
Instead of:
Developer machine
|
+-- docker build
+-- docker tag
+-- docker push
you can use:
Developer
|
| az acr build
v
Azure
|
+-- Build
+-- Tag
+-- Push
v
ACR
12. Automated ACR Tasks
ACR Tasks can also be configured to automatically execute when certain events occur.
For example:
Git commit
|
v
ACR Task
|
+-- Build image
+-- Test image
+-- Push image
ACR Tasks can also respond to base image updates.
For example, suppose an application uses:
FROM python:3.12
A base-image update can trigger an ACR Task to rebuild the application image.
This is useful for keeping application images current when their base images change.
Microsoft documents ACR Tasks triggers for Git commits and base-image updates.
13. Multi-Step ACR Tasks
ACR Tasks can execute more sophisticated workflows.
For example:
Build application image
|
v
Run application
|
v
Run test container
|
v
Push image
Multi-step tasks are defined using YAML.
A simplified example is:
version: v1.1.0
steps:
-build: -t $Registry/customer-api:$ID .
-push:
- $Registry/customer-api:$ID
-cmd: $Registry/customer-api:$ID
ACR Tasks supports three major step types:
Step
Purpose
build
Build a container image
push
Push an image to a registry
cmd
Run a container as a command
Exam Tip
If a question describes a workflow that needs to build, test, and push multiple containers, think:
ACR Tasks multi-step task
14. ACR Tasks and External Registries
ACR Tasks can also interact with other registries.
For example, a task may need to:
ACR
|
+-- Pull base image from another registry
|
+-- Build application
|
+-- Push application image to ACR
Credentials can be configured for tasks when access to another registry is required.
For more secure scenarios, ACR Tasks can use managed identities to access protected Azure resources without embedding credentials directly in task definitions.
15. Authentication to Azure Container Registry
ACR is generally private, so clients need appropriate authentication and authorization to access it.
Common authentication approaches include:
Microsoft Entra identities
Managed identities
Service principals
Administrator credentials
Repository-scoped access mechanisms
Anonymous pull, where explicitly configured and supported
Microsoft’s documentation emphasizes that ACR operations such as push and pull require authentication unless anonymous pull is enabled.
16. Managed Identity and ACR
Managed identities are particularly important in Azure-native applications.
Suppose an AKS cluster needs to pull an image:
AKS
|
| Managed Identity
v
Azure Container Registry
|
v
customer-api:v1
Rather than storing a registry password in application configuration, the Azure resource can use a managed identity and appropriate permissions.
For a non-ABAC-enabled registry, a common pull-only role is:
AcrPull
For push and pull:
AcrPush
For ABAC-enabled registries, Microsoft documents repository-scoped roles such as:
Container Registry Repository Reader
Container Registry Repository Writer
The exact role depends on the registry’s authorization model.
Exam Tip
When the question says:
“An Azure service needs to pull images from ACR without storing credentials.”
Think:
Managed identity + appropriate ACR permissions
17. ACR Pricing Tiers
Azure Container Registry currently provides three pricing tiers:
Basic
Standard
Premium
The tiers provide increasing capacity and capabilities.
Capability
Basic
Standard
Premium
Intended use
Lower-volume scenarios
Production scenarios
High-volume/advanced scenarios
Included storage
10 GiB
100 GiB
500 GiB
Geo-replication
No
No
Yes
Private endpoints
No
No
Yes
Content trust
No
No
Yes
Customer-managed keys
No
No
Yes
Dedicated Tasks agent pools
No
No
Yes
Higher throughput/concurrency
Lower
Medium
Higher
All three tiers provide core registry capabilities, while Premium adds advanced capabilities and higher limits.
Important Exam Distinction
If the requirement is:
“Replicate a registry across multiple Azure regions.”
Think:
Premium ACR
Geo-replication is a Premium feature.
18. Geo-Replication
Geo-replication allows an ACR to replicate its content across multiple Azure regions.
For example:
Azure Container Registry
|
+------------+------------+
| |
v v
East US West Europe
Geo-replica Geo-replica
| |
v v
AKS US AKS Europe
When an image is pushed to the geo-replicated registry, its content is synchronized to the configured replicas.
The advantage is that applications can access images from regions closer to where they run.
Microsoft describes geo-replication as providing a single registry management experience while synchronizing content across selected regions.
Don’t confuse:
Availability zones and geo-replication.
Availability zones provide resilience across zones within a region.
Geo-replication distributes registry content across different Azure regions.
Current Microsoft documentation states that zone redundancy is enabled by default for ACR registries in supported regions across Basic, Standard, and Premium tiers.
19. Managing Images and Repositories
You can manage repositories and images through:
Azure portal
Azure CLI
REST APIs
SDKs
Docker/OCI tooling
For example, you can list repositories:
az acr repository list \
--name contosoregistry \
--output table
List tags:
az acr repository show-tags \
--name contosoregistry \
--repository customer-api \
--output table
You can also inspect manifests and image metadata.
The Azure portal exposes repositories and their image tags through the registry’s Repositories interface.
20. Deleting Images
Suppose a repository contains:
customer-api:v1
customer-api:v2
customer-api:v3
You can remove an image tag using Azure CLI.
For example:
az acr repository untag \
--name contosoregistry \
--image customer-api:v1
However, remember an important distinction:
Untagging an image does not necessarily immediately remove the underlying image data.
The manifest may become untagged while its layers continue consuming storage.
Microsoft specifically warns about the accumulation of untagged artifacts when images are repeatedly pushed using the same tags.
21. Retention of Untagged Manifests
ACR supports a retention policy for untagged manifests.
The purpose is to automatically remove untagged manifests after a configured period.
For example:
Image:v1
Image:v2
Image:v3
If v2 is removed:
Image:v2 โ untagged manifest
A retention policy can eventually remove the untagged manifest.
The current Microsoft documentation identifies the untagged-manifest retention policy as a Premium feature and currently documents it as a preview feature. The policy can be configured for a retention period from 0 through 365 days.
Important Warning
If an application relies on pulling an image by its digest, automatically deleting untagged manifests can make that image unavailable.
This is an important operational consideration and a potential exam scenario.
22. Image Tagging Best Practices
A strong production tagging strategy should make image identification predictable.
A useful approach is to use multiple tags for different purposes.
For example:
customer-api:v2.4.1
customer-api:build-1847
customer-api:a81f42c
You might also maintain:
customer-api:production
as a deployment-oriented alias.
However, don’t rely on a mutable tag such as production or latest when you require immutable deployment behavior.
A good pattern is:
Human-readable release
+
Unique build identifier
+
Optional environment alias
For example:
customer-api:v2.4.1
customer-api:build-1847
customer-api:production
The production deployment can ultimately be pinned to a specific immutable image reference/digest.
23. Common ACR Mistakes
Mistake 1: Using latest for production deployments
latest can change.
Better: use unique version tags and/or digests.
Mistake 2: Assuming deleting a tag deletes the image immediately
An untagged manifest may continue consuming storage.
Better: understand manifests, layers, untagging, deletion, and retention.
Mistake 3: Giving every workload push permissions
An application that only needs to run an image generally doesn’t need permission to push images.
Better: follow least privilege.
For example:
Application โ AcrPull
Build pipeline โ AcrPush
Mistake 4: Storing registry passwords in application code
This creates unnecessary credential-management risks.
Better: use managed identities or another appropriate identity mechanism.
Mistake 5: Choosing Premium solely because it sounds better
Premium should be selected because its capabilities are required.
Examples include:
Geo-replication
Private endpoints
Content trust
Higher throughput
Advanced networking
Dedicated Tasks agent pools
Mistake 6: Confusing ACR with ACR Tasks
They are related but different concepts.
ACR:
Stores and manages container images.
ACR Tasks:
Builds, tests, and automates container image workflows.
A single ACR resource can therefore be used to store images while ACR Tasks provides the automation to build those images.
24. Important AI-200 Concepts to Know
For this exam objective, make sure you can explain the following without referring to documentation:
Concept
What you should know
Azure Container Registry
Managed private container registry
Registry
Top-level ACR resource
Repository
Collection of related images/artifacts
Tag
Human-readable image/version reference
Digest
Content-addressed image reference
Manifest
Describes image/artifact and its layers
Layer
Component of a container image
az acr login
Authenticates a client to ACR
docker push
Uploads an image to ACR
docker pull
Downloads an image from ACR
az acr build
Builds an image using ACR Tasks
ACR Tasks
Cloud-based image build/test automation
Multi-step task
Build/test/push workflows using YAML
AcrPull
Pull permission for applicable non-ABAC registry scenarios
AcrPush
Push/pull permission for applicable non-ABAC registry scenarios
Managed identity
Credential-free Azure resource authentication
Basic
Entry-level ACR tier
Standard
Higher capacity production-oriented tier
Premium
Advanced capabilities such as geo-replication/private endpoints
Geo-replication
Replicate registry content across regions
Retention policy
Automatically remove eligible untagged manifests
25. AI-200 Scenario Patterns to Recognize
The exam is likely to test your ability to choose the appropriate Azure capability based on a scenario.
Scenario: Build without Docker locally
Requirement: Developers don’t have Docker installed.
Answer: ACR Tasks / az acr build.
Scenario: Automatically rebuild after a Git commit
Requirement: Every source-code commit should trigger an image build.
Answer: ACR Task with a source-code trigger.
Scenario: Rebuild after base image updates
Requirement: Automatically rebuild application images when their base image changes.
Answer: ACR Tasks base-image trigger.
Scenario: Run the same image in several Azure regions
Requirement: Applications in multiple regions should access registry content efficiently.
Answer: ACR Premium with geo-replication.
Scenario: Application only needs to pull images
Requirement: A workload should retrieve images but shouldn’t be able to modify them.
Answer: Grant an appropriate pull-only role, such as AcrPull where applicable, or the appropriate repository reader role for an ABAC-enabled registry.
Scenario: Avoid credentials in application configuration
Requirement: An Azure-hosted application needs to access ACR without storing passwords.
A development team has a Dockerfile and wants to build a container image directly in Azure. Developers should not need Docker installed on their local computers. The resulting image should be pushed to Azure Container Registry.
Which Azure capability should you use?
A. Azure Container Registry Tasks
B. Azure App Service deployment slots
C. Azure Container Apps revisions
D. Azure Kubernetes Service Jobs
Answer: A
Explanation: Azure Container Registry Tasks can build container images in Azure using a Dockerfile. The az acr build command provides an on-demand build capability and can push the resulting image to ACR. A local Docker installation isn’t required for this workflow.
Question 2
An application image is stored as:
contosoregistry.azurecr.io/orders:v4
What does v4 represent?
A. The registry name
B. The image tag
C. The image digest
D. The repository namespace
Answer: B
Explanation: In an image reference such as:
registry/repository:tag
the portion after the colon is the tag. Therefore, v4 is the image tag. Tags are commonly used to identify image versions.
Question 3
A production application must always retrieve exactly the same container image content. Developers are concerned that a tag could later be reassigned to a different image.
Which image reference should the application use?
A. :latest
B. :production
C. :stable
D. @sha256:<digest>
Answer: D
Explanation: Tags can be moved to different image versions. A digest is a content-addressed identifier and can be used to pull a specific image version. Microsoft specifically identifies digest-based pulls as a way to guarantee the image version being retrieved.
Question 4
An organization deploys applications to Azure regions in North America and Europe. The organization wants container images to be replicated to both regions while maintaining a single ACR management experience.
Which ACR capability should be used?
A. Repository namespaces
B. Availability zones
C. Geo-replication
D. Image tags
Answer: C
Explanation: ACR geo-replication synchronizes registry content across selected Azure regions while allowing the organization to manage the registry as a single logical registry. Geo-replication is a Premium ACR capability.
Question 5
An AKS workload needs to pull private container images from ACR. The organization does not want to store registry passwords in Kubernetes configuration.
Which approach is most appropriate?
A. Use a managed identity with appropriate ACR permissions
B. Store the ACR administrator password in the container image
C. Make the repository publicly accessible
D. Embed an ACR password in the application source code
Answer: A
Explanation: Azure resources can use managed identities to authenticate to ACR without storing credentials in application code or configuration. The identity must be granted the appropriate pull permissions.
Question 6
A development team wants an automated container workflow that performs the following:
Builds an application image.
Runs a test container.
Builds another image.
Pushes the resulting images.
Which ACR capability should the team use?
A. ACR repository namespaces
B. ACR multi-step Tasks
C. ACR geo-replication
D. ACR anonymous pull
Answer: B
Explanation: ACR Tasks supports multi-step workflows using YAML. The workflow can build, run/test, and push one or more images. The available step types include build, push, and cmd.
Question 7
An organization repeatedly pushes new builds using the same image tag. After several months, the registry contains significant amounts of storage that cannot be explained by the currently tagged images.
What is the most likely explanation?
A. ACR automatically creates a new repository for every push
B. Geo-replication is duplicating every image within the same region
C. Previous manifests became untagged while their image data remained in the registry
D. ACR stores every Dockerfile indefinitely
Answer: C
Explanation: Repeatedly pushing modified images using the same tag can result in previous manifests becoming untagged. Their layers can continue consuming registry storage until the underlying content is deleted.
Question 8
A company needs to automatically rebuild its application container whenever a new version of the application’s base container image becomes available.
Which capability should be configured?
A. Azure App Service deployment slots
B. ACR geo-replication
C. ACR repository tagging
D. An ACR Task with a base-image update trigger
Answer: D
Explanation: ACR Tasks can automatically trigger builds when a base image is updated. This is useful for rebuilding application images when their underlying base images change.
Question 9
An organization requires private connectivity to its Azure Container Registry through Azure Private Link. Which ACR pricing tier supports this capability?
A. Premium
B. Basic
C. Standard
D. All three tiers
Answer: A
Explanation: Azure Container Registry Premium supports private endpoints through Private Link. Basic and Standard do not provide this capability according to the current ACR SKU documentation.
Question 10
An administrator removes the v1 tag from an image in an ACR repository. The administrator assumes that the underlying image data has immediately been removed from the registry.
Which statement is correct?
A. Removing a tag always immediately deletes every associated layer
B. Removing a tag converts the image automatically into a public image
C. Removing a tag deletes the entire repository
D. The manifest can become untagged while its data continues consuming storage
Answer: D
Explanation: Removing a tag can leave the manifest untagged while its associated data remains in the registry. Untagged artifacts can continue consuming storage until they are deleted. ACR provides mechanisms such as retention policies for eligible untagged manifests.
Final AI-200 Takeaways
For this particular AI-200 objective, concentrate on these distinctions:
Azure Container Registry
Store and manage container images and artifacts.
ACR repository
Organizes related images.
Tag
Human-readable version/reference that can be reassigned.
Digest
Content-addressed identifier for a specific image version.
Manifest
Describes the image/artifact and its layers.
ACR Tasks
Build, test, and automate container image workflows.
az acr build
Perform an on-demand cloud-based container build.
Multi-step ACR Task
Build/test/push multiple images or perform multi-stage workflows.
Managed identity
Authenticate Azure workloads to ACR without managing passwords.
AcrPull
Pull permission for applicable non-ABAC registry scenarios.
AcrPush
Push/pull permission for applicable non-ABAC registry scenarios.
Premium
Required for capabilities such as geo-replication and private endpoints.
Geo-replication
Replicate registry content across Azure regions.
Retention
Help clean up eligible untagged manifests.
The most important exam mindset is to distinguish where the image is stored, how it is identified, how it is built, and how the workload is authorized to retrieve it. Those four dimensionsโregistry/repository, tag/digest, ACR Tasks, and authentication/RBACโcover a large portion of the practical knowledge behind this objective.
This post is a part of the DP-900: Microsoft Azure Data Fundamentals Exam Prep Hub. This topic falls under these sections: Describe an analytics workload (25โ30%) --> Describe considerations for real-time data analytics --> Identify Microsoft Cloud Services for real-time analytics
Note that there are 10 practice questions (with answers and explanations) for each section to help you solidify your knowledge of the material. Also, there are 2 practice tests with 60 questions each available on the hub below the exam topics section.
Real-time analytics enables organizations to ingest, process, and analyze data as it is generated, allowing for immediate insights and actions. Microsoft Azure provides several services specifically designed to support real-time analytics workloads.
For the DP-900 exam, you should understand which services are used, their roles, and how they work together in a streaming architecture.
What Is Real-Time Analytics?
Real-time analytics refers to:
Processing data as it arrives (streaming data)
Producing insights with low latency (seconds or milliseconds)
Supporting immediate decision-making
Key Components of a Real-Time Analytics Solution
A typical real-time pipeline includes:
Ingestion โ Capture streaming data
Processing โ Analyze and transform data
Storage โ Persist results
Visualization โ Display insights
Core Azure Services for Real-Time Analytics
1. Event Ingestion Services
Azure Event Hubs
Purpose
High-throughput event ingestion service
Key Features
Handles millions of events per second
Scalable and distributed
Supports real-time data pipelines
Use Cases
IoT telemetry ingestion
Application logs
Streaming data pipelines
โ Think: โEntry point for streaming dataโ
Azure IoT Hub
Purpose
Specialized ingestion for IoT devices
Key Features
Device-to-cloud communication
Secure device management
Use Cases
Sensor data
Connected devices
โ Think: โEvent Hubs for IoT scenariosโ
2. Stream Processing Services
Azure Stream Analytics
Purpose
Real-time data processing using SQL-like queries
Key Features
Low-latency processing
Easy-to-use query language
Built-in integrations with Azure services
Use Cases
Real-time dashboards
Fraud detection
Alerting systems
โ Think: โReal-time analytics with SQLโ
Azure Databricks
Purpose
Advanced stream and batch processing using Apache Spark
Key Features
Supports structured streaming
Handles large-scale data processing
Integrates with machine learning workflows
Use Cases
Complex event processing
Advanced analytics
Machine learning pipelines
โ Think: โPowerful, flexible streaming + big data processingโ
3. Real-Time Analytics & Query Services
Azure Synapse Analytics
Purpose
Analyze streaming and batch data
Key Features
Integrates with streaming pipelines
Supports near real-time analytics
โ Often used as part of a larger analytics architecture
Microsoft Fabric
Purpose
End-to-end analytics including real-time capabilities
Key Features
Real-Time Analytics workloads
Integrated with OneLake and Power BI
Unified platform for ingestion, processing, and visualization
Which Azure service is primarily used for ingesting large volumes of streaming data?
A. Azure Data Factory B. Azure Event Hubs C. Azure SQL Database D. Azure Files
โ Answer: B
Explanation: Azure Event Hubs is designed for high-throughput event ingestion in real time.
Question 2
Which Azure service is specifically designed for ingesting data from IoT devices?
A. Azure Blob Storage B. Azure IoT Hub C. Azure Synapse Analytics D. Azure Table Storage
โ Answer: B
Explanation: Azure IoT Hub enables secure communication with IoT devices and ingests telemetry data.
Question 3
Which Azure service allows real-time data processing using a SQL-like query language?
A. Azure Databricks B. Azure Data Factory C. Azure Stream Analytics D. Azure Virtual Machines
โ Answer: C
Explanation: Azure Stream Analytics processes streaming data using SQL-like queries.
Question 4
Which service is BEST suited for advanced real-time analytics and machine learning on streaming data?
A. Azure Files B. Azure Databricks C. Azure Table Storage D. Azure DNS
โ Answer: B
Explanation: Azure Databricks supports advanced analytics, Spark processing, and ML workflows.
Question 5
Which service provides a unified analytics platform that includes real-time analytics capabilities?
A. Azure Virtual Machines B. Azure Blob Storage C. Microsoft Fabric D. Azure Files
โ Answer: C
Explanation: Microsoft Fabric integrates real-time analytics, data engineering, and BI into one platform.
Question 6
Which component of a real-time analytics solution is responsible for capturing incoming data?
A. Processing B. Storage C. Visualization D. Ingestion
โ Answer: D
Explanation: The ingestion layer is responsible for capturing streaming data.
Question 7
You need to process streaming data with minimal setup using SQL-like queries. Which service should you choose?
A. Azure Databricks B. Azure Synapse Analytics C. Azure Stream Analytics D. Azure Data Factory
โ Answer: C
Explanation: Stream Analytics is ideal for simple, real-time processing with SQL syntax.
Question 8
Which service is MOST appropriate for handling millions of streaming events per second?
A. Azure SQL Database B. Azure Files C. Azure Event Hubs D. Azure Table Storage
โ Answer: C
Explanation: Event Hubs is built for high-throughput event ingestion at scale.
Question 9
Which of the following describes a typical real-time analytics pipeline?
A. Storage โ Visualization โ Ingestion โ Processing B. Processing โ Ingestion โ Storage โ Visualization C. Ingestion โ Processing โ Storage โ Visualization D. Visualization โ Storage โ Processing โ Ingestion
โ Answer: C
Explanation: The standard flow is: Ingestion โ Processing โ Storage โ Visualization
Question 10
Which scenario BEST demonstrates a real-time analytics use case?
A. Generating a yearly financial report B. Archiving historical data C. Monitoring live sensor data and triggering alerts D. Migrating legacy databases
โ Answer: C
Explanation: Real-time analytics is used for immediate insights and actions, such as alerts from live data.
โ Quick Exam Takeaways
โ Real-time analytics = low-latency insights from streaming data
โ Core services:
Ingestion
Azure Event Hubs
Azure IoT Hub
Processing
Azure Stream Analytics
Azure Databricks
Platform
Microsoft Fabric
โ Key roles:
Event Hubs โ ingestion
Stream Analytics โ real-time processing
Databricks โ advanced analytics
Fabric โ unified analytics platform
โ Exam tip: ๐ Ingest streaming data โ Event Hubs ๐ Process with SQL โ Stream Analytics ๐ Advanced analytics โ Databricks ๐ End-to-end solution โ Fabric