A credit-union team wants a public demo Container App to call Dapr building blocks used by the production card-dispute API. They propose placing the demo in the same Container Apps environment so both apps can “share Dapr.” What should the developer do?
Select an answer to reveal the explanation.
Short Explanation
Picture the Container Apps environment as one locked office floor: everyone on that floor can find each other and share the same wiring. Stick a public demo on that floor and you just invited strangers into the production hallway. Put untrusted apps in their own environment instead.
Full Explanation
An Azure Container Apps environment is the shared security, networking, and discovery boundary for apps that live inside it. Dapr building blocks ride that same boundary: apps in one environment can resolve and invoke one another through the sidecar mesh. For the credit-union card-dispute API, that floor must stay limited to trusted workloads. A public demo that “just wants to share Dapr” still becomes a peer on that floor, so the correct move is to keep the untrusted demo in a separate environment and never co-locate it with production dispute traffic.
Opening external ingress on every revision does not create a safe shared-Dapr pattern; it widens exposure while discovery still treats co-located apps as peers. Moving only the production API into Azure Container Instances abandons Container Apps’ managed Dapr integration for that service and is not required to isolate a demo. Standing up an AKS cluster beside Container Apps so a demo can join “the same mesh” invents an unrelated control plane; AZ-204 expects environment isolation on Container Apps, not a side Kubernetes migration.
Exam caveat: environments also share log analytics and networking defaults. “Same environment” is convenient for trusted microservices and dangerous for demos, contractors, or Internet-facing experiments that should never resolve production services by name.
Operational check: deploy the demo into a second Container Apps environment, confirm it cannot resolve the dispute API’s internal FQDN, and verify Dapr components remain scoped to the production environment only.