Practice Test #3

Running a LUIS container with the version set as an environment variable is not how LUIS containers select a model. The container does not dynamically pull a specific LUIS app version from the authoring resource based on an environment variable. Instead, the container loads a model package that you provide (exported artifact). Environment variables are used for container configuration (for example, billing endpoint, API key, EULA acceptance, logging), but not for selecting a LUIS app version from the service. Version selection happens before runtime: you choose the version in the LUIS portal (or via APIs), export that version for containers, and then mount it into the container. Therefore, this action is not part of the correct sequence to ensure the container uses the latest deployable version.

Exporting the model using “Export as JSON” is not the correct export format for deploying to a LUIS container. The JSON export is primarily for moving the LUIS app definition (intents, entities, utterances, settings) between environments or for source control, and it is typically used for re-importing into LUIS authoring. For containers, Microsoft provides a specific export option that packages the trained model in a container-consumable format (GZIP). The container expects the exported model artifact, not the authoring JSON schema. So while JSON export can be useful for DevOps workflows, it will not directly enable the container to run predictions with that model. Hence, it is not one of the required actions.

Selecting v1.1 is required because it is the latest version that is deployable for a container. The table shows v1.2 has no trained date, meaning it has not been trained and therefore cannot be exported as a runnable model artifact. v1.0 is trained and published, but it is older than v1.1. For LUIS containers, “published date” is not the gating factor; training is. Publishing is relevant for the hosted LUIS prediction endpoint in Azure, but container deployment relies on exporting a trained version. Therefore, to create a container that uses the latest deployable version, you must choose v1.1 (newest trained version) before exporting for containers.

Running the container and mounting the model file is a required step for LUIS container deployment. The LUIS container does not automatically retrieve models from the LUIS service at runtime; it loads the model from the filesystem inside the container. The standard pattern is: - Export the trained LUIS app version for containers (GZIP). - Place the exported package on the host. - Start the container with a volume mount (for example, -v hostPath:containerPath) so the container can access the model package. This approach supports repeatable deployments and aligns with best practices: treat the model as a versioned artifact, enabling rollback and consistent promotion across environments (dev/test/prod).

Selecting v1.0 is not correct because the requirement is to use the latest deployable version. Although v1.0 is trained and published, it is older than v1.1. In container scenarios, publishing is not required; training is the key prerequisite. Since v1.1 is trained more recently (2020-10-01) and v1.2 is not trained, v1.1 is the newest version that can be exported and deployed to a container. Choosing v1.0 would result in deploying an older model than necessary, failing the “latest deployable version” requirement. Therefore, v1.0 should not be selected.

Exporting the model using “Export for containers (GZIP)” is the correct export action for deploying LUIS to a container. This option produces the container-compatible model package that includes the trained artifacts needed by the runtime. The container expects this packaged model format; it is different from the “Export as JSON” option, which exports the app definition for authoring/import scenarios rather than a runtime-ready model. In the correct sequence, after selecting the latest trained version (v1.1), you export that version using the container export option (GZIP). This ensures the artifact you mount into the container matches the intended version and is usable by the container to serve predictions.

Selecting v1.2 is not correct because it is not deployable: the table shows no trained date and no published date. A LUIS version must be trained to produce a model that can be exported for runtime use (including containers). Without training, there is no trained model artifact to export. Even if v1.2 is the numerically latest version, it does not meet the deployability requirement. The question specifically asks for the “latest deployable version,” which implies the newest version that can actually be deployed. Therefore, you should not select v1.2; you should select v1.1 instead, then export for containers and mount the model when running the container.

Create a custom Dockerfile is not required for the stated requirements. The goal is not to modify the Anomaly Detector container image (for example, adding packages, changing entrypoints, or baking configuration into the image). Instead, you need to (1) prevent billing/API information from being typed into interactive command lines (handled operationally via a script or environment file/secret mechanism) and (2) control access to the image using Azure RBAC (handled by storing the image in Azure Container Registry). A custom Dockerfile could even be counterproductive if it tempts you to bake secrets into the image layers, which is a security anti-pattern. The Microsoft-provided container image should be used as-is, then re-tagged and pushed to ACR. Therefore, the correct answer is No.

You must pull the Anomaly Detector container image as a prerequisite to re-hosting it in your own registry. The requirement to control access via Azure RBAC implies using Azure Container Registry (ACR). To push an image into ACR, you first need the image locally (or in a pipeline) so you can tag it with the ACR login server name and then push it. In practice, you pull the Microsoft-provided image from the source registry (commonly Microsoft Container Registry, depending on the product documentation), then re-tag it (e.g., myregistry.azurecr.io/anomalydetector:tag) and push it to ACR. Without pulling the image, you cannot perform the subsequent push step. Therefore, Yes is correct.

Distributing a docker run script (or an equivalent standardized launch mechanism) directly addresses the requirement to prevent billing and API information from being stored in command-line histories. If operators manually run a command like docker run -e Eula=accept -e Billing=... -e ApiKey=..., those values can be captured in shell history, terminal logging, or process auditing. By distributing a script, you can centralize how the container is started and reduce or eliminate interactive typing of secrets. In real deployments, this script often reads values from a protected location (environment variables set outside the shell history, an env-file, a secret store, or a secure configuration management tool). While the exam item specifically lists “Distribute a docker run script,” the intent is to avoid exposing secrets on the command line. Therefore, Yes is correct.

Pushing the image to an Azure container registry is required to meet the Azure RBAC access-control requirement. ACR integrates with Azure Active Directory and supports Azure role assignments such as AcrPull (for consumers) and AcrPush (for publishers). This allows you to control which users/devices/identities can pull the Anomaly Detector container image, aligning with least privilege and centralized governance. Once the image is in ACR, on-prem devices can authenticate (for example, using an AAD principal, service principal, or other supported mechanism) and pull the image only if they have the appropriate role assignment. This is the key differentiator versus public registries. Therefore, Yes is correct.

Building the image is not necessary for these requirements. You are not asked to customize the container image; you are asked to control access to it and to avoid exposing billing/API details in command history. Those are solved by re-hosting the existing image in ACR (no build required) and distributing a standardized run script (or similar) to avoid typing secrets. A “build” step would only be needed if you created a custom Dockerfile or otherwise modified the image. Since the recommended approach is to pull the vendor-provided image and then re-tag/push it to ACR, building is an unnecessary action and adds complexity and risk (e.g., accidental inclusion of secrets or drift from the supported image). Therefore, No is correct.

Pushing the image to Docker Hub does not satisfy the requirement to control access using Azure RBAC. Docker Hub has its own authentication/authorization model and does not integrate with Azure role assignments (AcrPull/AcrPush) or Azure AD in the same way ACR does. The question explicitly requires Azure RBAC for controlling access to the container images, which points to Azure Container Registry. Additionally, Docker Hub is often public by default and, even with private repositories, it would not meet the “use Azure RBAC” requirement. For exam purposes, the correct registry choice is ACR. Therefore, No is correct.