Microsoft AZ-400: Containerization and Kubernetes — Study Guide

By Laurynas Brazys · 10 August 2026 · #microsoft #az-400 #certification #exam-prep #study-guide

Part of the Microsoft DevOps Engineer Expert AZ-400 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Containerization and Kubernetes underpin modern DevOps on Azure by combining reproducible builds, secure distribution, and declarative, self-healing runtime orchestration. Mastery requires understanding how images are assembled and optimized, how registries replicate and attest content, how AKS is designed and upgraded without disruption, how progressive delivery is implemented, and how to secure workloads end-to-end. Beyond raw Kubernetes, you will leverage Helm for packaging, GitOps for reconciliation, and—in the serverless space—Azure Container Apps with Dapr and KEDA to simplify microservices patterns and event-driven scaling. The following sections distill the platform decisions and operational practices you need to implement robust, compliant pipelines and resilient production clusters.

Build and Registry Fundamentals: Docker and ACR

A performant container image starts with a deterministic Dockerfile and a disciplined build context. Multi-stage builds let you separate toolchain-heavy compile stages from small runtime images. For example, compile a .NET or Go binary in a builder stage, then copy only the compiled artifact into a distroless or minimal base image (e.g., mcr.microsoft.com/dotnet/runtime-deps or gcr.io/distroless/base), yielding smaller attack surfaces and faster pull times. Every RUN, COPY, and ADD creates a layer; restructure Dockerfiles to maximize layer cache hits by placing infrequently changing steps later and aggregating commands with logical grouping while preserving readability. Always include a .dockerignore to exclude bin/obj, node_modules, tests, docs, and secrets; an oversized build context slows uploads and reduces remote cache effectiveness. Use deterministic package installs (version pins, lock files) and build arguments carefully; environment-specific files should flow via runtime configuration, not immutable images.

Azure Container Registry (ACR) is the backbone for image storage and distribution. Leverage ACR Tasks to offload builds to Azure: quick tasks for on-demand builds (az acr run), automated tasks triggered by Git commits, base-image updates, or schedules, and multi-step Task YAML for multi-arch images using Buildx. Geo-replication (Premium SKU) mirrors artifacts across regions, minimizing pull latency and egress costs for multi-region AKS/ACA deployments; combine with private endpoints and repository-scoped RBAC for least privilege. Enable content trust to sign images and verify provenance: Docker Content Trust/Notary and evolving OCI signature ecosystems (e.g., cosign) can be enforced at admission via OPA Gatekeeper constraints that require signatures for protected namespaces. Integrate vulnerability scanning: Microsoft Defender for Cloud scans images at push and at rest, surfaces CVEs with fix guidance, and can gate deployments via Azure Policy and CI checks; include base image refresh automation to reduce known-vulnerable layers.

AKS Platform and Workload Delivery

Create AKS clusters with secure-by-default settings: managed identity, Azure AD integration for RBAC, Azure CNI for VNET integration, network policy (Azure or Calico), Azure Key Vault provider (Secrets Store CSI) for secret consumption, and private clusters with authorized IP ranges. Choose workload-appropriate node pools: system pools for control-plane-critical components; user pools for applications; GPU pools for ML; spot pools for cost-saving stateless jobs; Windows node pools for Windows containers. Use taints/tolerations and topology spread constraints to control scheduling and resilience. Autoscale with cluster autoscaler and per-deployment Horizontal Pod Autoscaler; consider ephemeral OS disks and availability zones for performance and resilience.

Plan upgrades to minimize disruption. AKS upgrades the control plane first, then node pools. Use max-surge on node pool upgrades to add surge capacity, drain nodes gracefully, and respect PodDisruptionBudgets. Adopt automatic upgrade channels (rapid/stable/patch-only) for predictable cadence; separate system and user pool upgrades to limit blast radius. Perform node image upgrades regularly to pick up kernel/runtime fixes even without a Kubernetes version bump, and pin compatible CNI/CSI versions. Use blue-green node pools for zero-downtime platform changes—cordon/drain green into blue and cut over via nodeSelector/affinity.

Deployments in Kubernetes natively support rolling updates with maxUnavailable and maxSurge to maintain capacity during rollout; pair with readiness/liveness probes and startup probes to prevent premature traffic. Blue-green delivery on Kubernetes is implemented by running parallel Deployments (blue and green) and switching a stable Service selector or Endpoint object to the target revision; this yields near-instant fallback by flipping labels. Canary delivery is best done at the edge via ingress: NGINX Ingress supports weighted canary via annotations; Application Gateway Ingress Controller (AGIC) can split traffic across backends; service meshes provide traffic shifting with granular policies and telemetry. For robust pipelines, validate with smoke tests and App Insights availability checks before promoting weights.

Helm packages Kubernetes manifests into charts comprising Chart.yaml, templates, and default values.yaml. Values files layer deterministically; use values.<env>.yaml overlays and a “global” block for cross-subchart settings. Prefer Helm 3 with OCI-backed chart storage in ACR (helm registry login && helm push oci://…), enabling RBAC and geo-replication parity with images. In Azure Pipelines, install Helm at a pinned version (HelmInstaller) and deploy (HelmDeploy) via a Kubernetes/Azure Resource Manager service connection; template linting plus dry-run and diff (helm diff plugin) should gate releases. Avoid committing secrets into values; integrate external-secrets or CSI Key Vault to materialize secrets at runtime. Version charts semantically and pin appVersion to the image digest for traceability.

Operations, Security, and Traffic Control

GitOps with Flux or Argo CD ensures clusters converge continuously to a declared state. Flux v2 integrates natively with AKS via the Azure CLI/extension, reconciling Sources (Git/OCI/Bucket) and Kustomizations on an interval, and includes image automation to update Helm/Kustomize to new tags based on policies. Argo CD tracks Applications and their health, supports SSO with Azure AD, and can operate in pull-based, app-of-apps models for multi-tenant separation. Both detect drift and can auto-correct, emit events/alerts, and support progressive delivery; pair with Flagger to automate canaries and A/B tests using NGINX, Istio, or Linkerd, promoting on metrics and rolling back on SLO breaches.

Security starts in the supply chain and enforces at admission and runtime. Continuously scan images with Defender for Cloud and surface gates in CI/CD. Adopt Kubernetes Pod Security Standards (baseline/restricted) with Pod Security Admission labels on namespaces to block privileged/hostPath/unsafe sysctls by default. Enforce organization policies with OPA Gatekeeper: constraint templates ban privileged containers, require approved registries, enforce resource limits, and demand signed images or SBOM presence. Apply network policies to define permitted pod-to-pod and egress traffic; AKS supports Azure Network Policies (with Azure CNI) and Calico. Complement with Azure Firewall or NVA egress control and Application Gateway WAF ingress. Harden workloads with non-root users, read-only root filesystems, seccomp and AppArmor profiles, and regular node image upgrades. Enable audit and threat detection via Defender for Kubernetes and aggregate telemetry in Azure Monitor Container Insights; standardize logs/traces with OpenTelemetry.

A service mesh (Istio or Linkerd) adds uniform traffic management, encryption, and observability. Use DestinationRules/VirtualServices (Istio) or ServiceProfiles (Linkerd) to define retries, timeouts, circuit breaking, and weighted routing. Enable mutual TLS for service-to-service encryption and identity; enforce policies like “STRICT” mTLS to close gaps. Export metrics to Prometheus and dashboards to Grafana; capture distributed traces (Jaeger/Zipkin) and feed them to Application Insights or Azure Monitor via OpenTelemetry collectors. Mesh-based canaries and fault injection power reliable testing and progressive delivery, with Flagger automating analysis against SLOs.

Developer Productivity and Serverless Containers on Azure

AKS DevOps integration tools streamline dev inner loops. Draft detects language frameworks and scaffolds Dockerfiles, Helm charts, and launch configs, accelerating containerization. Bridge to Kubernetes redirects service calls from a live cluster to your local workstation, letting you iterate and debug a single microservice locally while the rest run in-cluster with real data and dependencies. Azure Dev Spaces has been retired; Bridge to Kubernetes is the supported local development experience and integrates with VS Code and Visual Studio.

Azure Container Apps (ACA) offers a serverless, fully managed runtime for microservices and jobs without managing Kubernetes. Each deployment creates a revision; you can route traffic across revisions by percentage for blue-green or canary-style rollouts with one command or YAML change. Native Dapr integration enables service invocation, pub/sub, bindings, state stores, and secrets without bespoke plumbing; pluggable components (e.g., Azure Service Bus, Key Vault, Cosmos DB) accelerate consistent cross-service capabilities. KEDA powers event-driven autoscaling based on HTTP concurrency and more than 60 scalers (Azure Queue/Service Bus, Kafka, Prometheus, custom), scaling to zero for cost efficiency. Use ACA Environments for network isolation and VNET integration, wire ACR via managed identity, and manage configuration through containerapps YAML to maintain declarative parity with GitOps practices.

Practical Problem Scenario

Adobe needs to modernize a multi-region customer analytics service, reducing release risk while tightening supply chain and runtime security. The team must standardize builds, automate safe rollouts, and ensure rapid, compliant delivery across the US and EU.

Implement multi-stage Dockerfiles and .dockerignore for all services

Why: Minimizes image size and attack surface, improves build cache hits, and prevents accidental inclusion of secrets or large test assets in the image.

Build and sign images with ACR Tasks, push to geo-replicated ACR

Why: Cloud builds eliminate local variance; base-image update triggers reduce CVE exposure. Premium ACR geo-replication co-locates artifacts with AKS clusters, reducing latency and egress. Signatures enable provenance.

Enable Defender for Cloud image scanning and enforce via CI gates and OPA Gatekeeper

Why: Scans at push and at rest catch CVEs early. Gatekeeper constraints enforce “approved registries only,” “signed images required,” and resource limits, preventing unsafe workloads from admission.

Provision private AKS clusters per region with Azure CNI, network policies, and managed identity

Why: Private endpoints restrict control plane exposure; Azure CNI integrates with enterprise VNETs; network policies constrain lateral movement; managed identity removes secret sprawl.

Create separate system and user node pools, add spot pools for batch jobs

Why: Isolates critical platform pods, provides cost-efficient capacity for non-critical workloads, and simplifies upgrades and SLO management.

Adopt Helm for packaging with charts stored in ACR (OCI), deploy via Azure Pipelines

Why: Consistent, versioned releases with values per environment. Pipelines run helm lint, dry-run, and diff before helm upgrade, using a Kubernetes service connection to target clusters.

Deploy Flux v2 for GitOps reconciliation and drift detection, integrate Flagger for canaries

Why: Declarative, pull-based sync reduces credentials in CI and ensures convergence. Flagger automates weighted canaries against SLOs using NGINX Ingress metrics, rolling back on errors/latency spikes.

Configure rolling updates with PDBs and readiness/startup probes; use blue-green for risky components

Why: Rolling updates preserve capacity; probes protect user traffic. Blue-green with a label switch on the Service enables instant rollback for high-risk components such as the API gateway.

Introduce Istio service mesh with strict mTLS, retries, and timeouts; export telemetry to Application Insights

Why: Mesh-wide encryption, robust traffic policies, and uniform observability. OpenTelemetry collectors ship traces/metrics to a central store for SLO monitoring and incident triage.

Establish controlled upgrade strategy with AKS auto-upgrade channel and node image upgrades

Why: Regular, predictable platform updates reduce zero-day exposure. Max-surge and PDBs ensure minimal disruption; separate user pool upgrades limit blast radius.

Use Bridge to Kubernetes for inner-loop development; scaffold with Draft

Why: Developers debug locally against in-cluster dependencies without mocking. Draft accelerates consistent containerization and Helm scaffolding across teams.

Offload long-tail services to Azure Container Apps with Dapr and KEDA

Why: Event-driven, scale-to-zero microservices (e.g., ingestion and enrichment) run cheaply with built-in traffic splitting for canaries; Dapr components standardize service-to-service calls and pub/sub without bespoke code.

This end-to-end design aligns build determinism with secure distribution, declarative operations, and progressive delivery, giving Adobe rapid, low-risk releases and a hardened runtime across regions.

← Infrastructure as Code and Configuration Management · All domains · Release Management and Deployment Strategies →

Practice these questions → · Timed practice on ExamRoll.io →