Azure AI Cloud Developer Flashcards & Memory Notes

Container images and tags. A host such as App Service, Container Apps, or AKS must pull and run the image.

Application images when a base image updates or on a schedule. That keeps patched bases from waiting on a manual push.

When you want revisions, environments, and KEDA scaling without managing Kubernetes nodes. AKS is the full Kubernetes path.

An immutable deployment of the app. You can split traffic across revisions and roll back by shifting weight.

Event sources such as HTTP load or queue depth. Replica count can drop when idle according to the rules you set.

When you need full Kubernetes manifests, custom controllers, or cluster-level troubleshooting. Container Apps abstracts that control plane.

Outside the image, in Key Vault references or secret app settings. Do not bake passwords into layers.

Pod logs and Kubernetes events. Then check connectivity before resizing the node pool.

A pull problem: authentication, tag name, or network path to the registry. It is not a Cosmos RU issue.

It hosts a web or API container with platform scaling without writing Kubernetes YAML. ACR still stores the image.

Documents plus vector similarity search, with RU and consistency awareness, and change feed for processors.

The throughput cost of Cosmos reads and writes. Broader queries and stronger consistency cost more.

A stream of inserts and updates for downstream processors without polling the whole container.

Relational schemas, SQL joins, and pgvector similarity with metadata filters for RAG.

Embedding storage and vector similarity search inside PostgreSQL. Pair it with filters for tenancy or document type.

To keep the wrong tenant or document type out of the prompt context. Similarity alone is not enough.

Caching with expiration and invalidation, plus optional vector indexing for low-latency lookups.

Expiration removes a key after a TTL. Invalidation deletes or refreshes it when the source data changes.

Vector indexes and similarity queries are memory sensitive. Under-provisioned memory shows up as slow retrieval.

Cosmos is a durable document store. Redis is the hot cache, not the only system of record.

When one competing consumer path should pull durable work later. A topic fans out to subscriptions.

When one publish must reach many subscriptions, optionally filtered. Each handler gets its own copy path.

Messages that exceed max delivery attempts or are dead-lettered for inspection. Fix the consumer, then reprocess or dispose.

Filtered delivery of Azure or custom events to handlers, with retries. Plan a dead-letter path when handlers stay down.

A trigger such as HTTP, Service Bus, Event Grid, or timer.

Declarative inputs and outputs to other services so you write less glue code. Authorization still matters.

Queues hold a backlog for competing consumers. Event Grid routes filtered events; use Service Bus when you need DLQ and competing pull semantics.

In Key Vault or app setting references, not in the deployment package.

A serverless API without a long-lived host you manage. Configure and deploy the function app for repeatable releases.

Another consumer may receive the same message. Make handling idempotent or adjust lock duration.

Key Vault stores secrets with rotation and retrieval. App Configuration stores non-secret settings and feature flags.

In Key Vault, retrieved at runtime, often with managed identity. Not in App Configuration or the image.

It must retrieve the current version and refresh so old credentials stop working.

When behavior must change without rebuilding the container image. The app still needs a refresh strategy.

Distributed traces with spans across services so you can see which hop is slow or failing.

A trace follows one request across services. KQL aggregates logs or metrics over a time window.

With managed identity and least-privilege access on the vault, not a long-lived client secret in the image.

Time range and the relevant resources or tables, then severity, operation id, or custom dimensions.

So one request id links Container Apps, Functions, and downstream calls in a single distributed trace.

Passwords are secrets and belong in Key Vault. App Configuration is for non-secret settings and flags.