Slot-sticky settings remain with the relevant slot across swaps. In this case, a risky release was swapped into production and must be reversed quickly. “Mark the application setting as a deployment-slot setting” would not satisfy that requirement; the supported action is “Swap back to the previous slot state when applicable”. Deployment slot swap supports a common rollback path for code/configuration.

Not every app setting should move with the deployed code during promotion. In this case, a risky release was swapped into production and must be reversed quickly. “Slot-specific setting flags for connection strings and secrets” would not satisfy that requirement; the supported action is “Swap back to the previous slot state when applicable”. Deployment slot swap supports a common rollback path for code/configuration.

App Service transport configuration helps prevent plaintext application access. In this case, a risky release was swapped into production and must be reversed quickly. “Enforce HTTPS Only and review application redirects” would not satisfy that requirement; the supported action is “Swap back to the previous slot state when applicable”. Deployment slot swap supports a common rollback path for code/configuration.

Deploying directly to production removes the intended staging validation gate and increases customer-facing release risk. In this case, an administrator needs to use an App Service staging slot to validate the next production release without sending real customers to untested code. “Deploy untested code directly to production and use a slot only after an outage” would not satisfy that requirement; the supported action is “Deploy the new build to a staging slot, validate application behavior there, and swap with production only after approval”.

A swap without a successful preproduction validation does not demonstrate that dependencies, settings and application startup are correct. In this case, an administrator needs to use an App Service staging slot to validate the next production release without sending real customers to untested code. “Swap the staging slot immediately without testing the deployment or dependent configuration” would not satisfy that requirement; the supported action is “Deploy the new build to a staging slot, validate application behavior there, and swap with production only after approval”.

Exposing customers to an unvalidated staging deployment defeats the separation intended by a staged release. In this case, an administrator needs to use an App Service staging slot to validate the next production release without sending real customers to untested code. “Point production traffic to the staging site before validating its health” would not satisfy that requirement; the supported action is “Deploy the new build to a staging slot, validate application behavior there, and swap with production only after approval”.

App Service slots enable controlled promotion of a tested deployment into production. In this case, a staging connection string accidentally becomes production after swap. “Deploy to a staging slot and swap after validation” would not satisfy that requirement; the supported action is “Slot-specific setting flags for connection strings and secrets”. Not every app setting should move with the deployed code during promotion.

Deployment slot swap supports a common rollback path for code/configuration. In this case, a staging connection string accidentally becomes production after swap. “Swap back to the previous slot state when applicable” would not satisfy that requirement; the supported action is “Slot-specific setting flags for connection strings and secrets”. Not every app setting should move with the deployed code during promotion.

Vertical scale changes per-worker capacity, whereas horizontal scale adds instances. In this case, a staging connection string accidentally becomes production after swap. “Scale up to a larger App Service plan SKU” would not satisfy that requirement; the supported action is “Slot-specific setting flags for connection strings and secrets”. Not every app setting should move with the deployed code during promotion.

Autoscaling changes worker count when configured thresholds and limits are met. In this case, an App Service plan has high CPU across all apps and needs additional worker capacity. “An autoscale rule on the eligible App Service plan” would not satisfy that requirement; the supported action is “Scale out the plan with additional supported instances”. Scale-out increases the number of workers sharing the plan.

Capability alone does not create scaling behavior without a rule. In this case, an App Service plan has high CPU across all apps and needs additional worker capacity. “Autoscale profile, metric trigger and scale limits” would not satisfy that requirement; the supported action is “Scale out the plan with additional supported instances”. Scale-out increases the number of workers sharing the plan.

Slot-sticky settings remain with the relevant slot across swaps. In this case, an App Service plan has high CPU across all apps and needs additional worker capacity. “Mark the application setting as a deployment-slot setting” would not satisfy that requirement; the supported action is “Scale out the plan with additional supported instances”. Scale-out increases the number of workers sharing the plan.

Autoscaling changes worker count when configured thresholds and limits are met. In this case, a plan has too little RAM per instance despite enough worker count. “An autoscale rule on the eligible App Service plan” would not satisfy that requirement; the supported action is “Scale up to a larger App Service plan SKU”. Vertical scale changes per-worker capacity, whereas horizontal scale adds instances.

Capability alone does not create scaling behavior without a rule. In this case, a plan has too little RAM per instance despite enough worker count. “Autoscale profile, metric trigger and scale limits” would not satisfy that requirement; the supported action is “Scale up to a larger App Service plan SKU”. Vertical scale changes per-worker capacity, whereas horizontal scale adds instances.

Not every app setting should move with the deployed code during promotion. In this case, a plan has too little RAM per instance despite enough worker count. “Slot-specific setting flags for connection strings and secrets” would not satisfy that requirement; the supported action is “Scale up to a larger App Service plan SKU”. Vertical scale changes per-worker capacity, whereas horizontal scale adds instances.

Manual repeated changes do not provide a stable metric-driven autoscaling strategy and remove automated control. The competing choice “Disable monitoring and keep scaling up every time the administrator opens the portal” does not meet the specific requirement: An App Service autoscale policy repeatedly adds and removes instances within minutes as a CPU metric fluctuates near a threshold. Which configuration refinement best reduces this instability. The supported action is “Use supported autoscale cooldown periods, evaluation windows and differentiated scale-in or scale-out thresholds”.

Moving applications to unrelated plans does not correct a noisy policy and may add cost and architecture complexity. The competing choice “Assign every app to an unrelated worker plan without adjusting the scale policy” does not meet the specific requirement: An App Service autoscale policy repeatedly adds and removes instances within minutes as a CPU metric fluctuates near a threshold. Which configuration refinement best reduces this instability. The supported action is “Use supported autoscale cooldown periods, evaluation windows and differentiated scale-in or scale-out thresholds”.

Identical close thresholds with no cooldown make oscillation more likely when CPU varies near the boundary. The competing choice “Lower both opposing scale thresholds to the same value with zero stabilization delay” does not meet the specific requirement: An App Service autoscale policy repeatedly adds and removes instances within minutes as a CPU metric fluctuates near a threshold. Which configuration refinement best reduces this instability. The supported action is “Use supported autoscale cooldown periods, evaluation windows and differentiated scale-in or scale-out thresholds”.

Scale-out increases the number of workers sharing the plan. In this case, an App Service plan supports autoscale but never changes capacity. “Scale out the plan with additional supported instances” would not satisfy that requirement; the supported action is “Autoscale profile, metric trigger and scale limits”. Capability alone does not create scaling behavior without a rule.

Vertical scale changes per-worker capacity, whereas horizontal scale adds instances. In this case, an App Service plan supports autoscale but never changes capacity. “Scale up to a larger App Service plan SKU” would not satisfy that requirement; the supported action is “Autoscale profile, metric trigger and scale limits”. Capability alone does not create scaling behavior without a rule.

Regional VNet integration enables outbound connectivity into supported virtual networks. In this case, an App Service plan supports autoscale but never changes capacity. “App Service regional virtual network integration” would not satisfy that requirement; the supported action is “Autoscale profile, metric trigger and scale limits”. Capability alone does not create scaling behavior without a rule.

Changing application capacity does not correct a hostname that resolves to the wrong network endpoint. The competing choice “Enable App Service worker autoscale but leave the database hostname unchanged” does not meet the specific requirement: A web app already uses regional VNet integration to reach a backend database private endpoint. The database hostname still resolves to its public IP address from the application. What additional configuration is essential. The supported action is “Configure the appropriate private DNS resolution for the backend endpoint and verify App Service VNet routing to that IP”.

Publicly advertising a private address is not the appropriate authorized private DNS architecture and can expose internal addressing information. The competing choice “Create an anonymous public DNS A record containing the backend private IP and expose it to all internet clients” does not meet the specific requirement: A web app already uses regional VNet integration to reach a backend database private endpoint. The database hostname still resolves to its public IP address from the application. What additional configuration is essential. The supported action is “Configure the appropriate private DNS resolution for the backend endpoint and verify App Service VNet routing to that IP”.

An additional public frontend does not repair private endpoint name resolution or satisfy the private-backend requirement. The competing choice “Assign a new public IP to the web app and connect to the database over the public Internet” does not meet the specific requirement: A web app already uses regional VNet integration to reach a backend database private endpoint. The database hostname still resolves to its public IP address from the application. What additional configuration is essential. The supported action is “Configure the appropriate private DNS resolution for the backend endpoint and verify App Service VNet routing to that IP”.

Regional VNet integration is outbound-facing and does not by itself restrict inbound access to App Service. In this case, a team expects VNet integration to make an App Service frontend private automatically. “Enable only regional VNet integration for outbound traffic and assume it makes the inbound web-app endpoint private” would not satisfy that requirement; the supported action is “A private endpoint or appropriate inbound access control”. Outbound VNet integration and inbound private exposure are separate features.

Private ingress requires separate networking and access configuration. In this case, a team expects VNet integration to make an App Service frontend private automatically. “VNet integration primarily concerns outbound traffic, not private ingress” would not satisfy that requirement; the supported action is “A private endpoint or appropriate inbound access control”. Outbound VNet integration and inbound private exposure are separate features.

Autoscaling changes worker count when configured thresholds and limits are met. In this case, a team expects VNet integration to make an App Service frontend private automatically. “An autoscale rule on the eligible App Service plan” would not satisfy that requirement; the supported action is “A private endpoint or appropriate inbound access control”. Outbound VNet integration and inbound private exposure are separate features.

An NSG for an unrelated network does not make App Service reachable solely by an intended private endpoint. In this case, a web app must be reachable only from a private network, not the public Internet. “Add a network security group to a disconnected VNet without creating the app private ingress connection” would not satisfy that requirement; the supported action is “Use an App Service private endpoint with appropriate DNS and access controls”. Private endpoints enable private ingress connectivity to eligible web apps.

Regional VNet integration enables outbound connectivity into supported virtual networks. In this case, a web app must be reachable only from a private network, not the public Internet. “App Service regional virtual network integration” would not satisfy that requirement; the supported action is “Use an App Service private endpoint with appropriate DNS and access controls”. Private endpoints enable private ingress connectivity to eligible web apps.

Access restrictions control allowed inbound traffic sources. In this case, a web app must be reachable only from a private network, not the public Internet. “App Service access restrictions with the correct allowed network rules” would not satisfy that requirement; the supported action is “Use an App Service private endpoint with appropriate DNS and access controls”. Private endpoints enable private ingress connectivity to eligible web apps.

Outbound VNet integration and inbound private exposure are separate features. In this case, a web app has VNet integration but still has public inbound traffic. “A private endpoint or appropriate inbound access control” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.

Regional VNet integration enables outbound connectivity into supported virtual networks. In this case, a web app has VNet integration but still has public inbound traffic. “App Service regional virtual network integration” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.

Outbound routes do not themselves define inbound client admission. In this case, a web app has VNet integration but still has public inbound traffic. “Inbound access restriction rule configuration and priority” would not satisfy that requirement; the supported action is “VNet integration primarily concerns outbound traffic, not private ingress”. Private ingress requires separate networking and access configuration.