Examkin

Question

Difficulty: HardConfigure Azure Container Instances (ACI)

An administrator is deploying a containerized analytics application to Azure Container Instances (ACI). The application consists of a single container that must run a batch-processing script daily.

The deployment must meet the following requirements:
- The container must access an Azure SQL database over a private endpoint located in a subnet named SQLSubnet within a virtual network named VNet1.
- The container must retrieve database credentials securely from Azure Key Vault without storing them in the container image or deployment configuration files.
- The container must terminate and stop consuming compute resources once the script completes successfully, but must restart if the script fails.

You create a new subnet named AppSubnet in VNet1 for the container group.

Which configuration settings should you apply to the container group and AppSubnet?

  1. Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to OnFailure, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.Answer
  2. B
    Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to Always, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.
  3. C
    Delegate AppSubnet to Microsoft.Web/serverFarms, set the container group restart policy to OnFailure, and store the database credentials as standard environment variables in the container group deployment files.
  4. D
    Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to Never, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.

Answer

Delegate AppSubnet to Microsoft.ContainerInstance/containerGroups, set the container group restart policy to OnFailure, and configure the container group with a system-assigned managed identity to authenticate to Azure Key Vault.
Delegating AppSubnet to Microsoft.ContainerInstance/containerGroups is required for Azure Container Instances virtual network integration. Using a restart policy of OnFailure meets the requirement that the container terminates upon successful script execution but restarts if it fails. Assigning a system-assigned managed identity allows secure access to Key Vault without hardcoding secrets in configuration files.

Step-by-Step Solution

1
Determine the required subnet delegation for Azure Container Instances (ACI).
The subnet must be delegated to Microsoft.ContainerInstance/containerGroups.
ACI VNet integration requires a subnet dedicated and delegated specifically to ACI container groups.
2
Select the correct restart policy based on the execution requirements.
The restart policy must be set to OnFailure.
The container needs to run to completion and stop on success (ruling out Always) but must retry if it fails (ruling out Never).
3
Identify the secure authentication method to retrieve Key Vault secrets.
Assign a system-assigned managed identity to the container group and grant it permissions on the Key Vault.
This allows the application within the container to acquire an Microsoft Entra ID token and securely access Key Vault without storing credentials in the image or deployment files.

Key Concept

Azure Container Instances VNet integration, restart policies, and managed identity configuration.
Rate this question

Topics

Configure Azure Container Instances (ACI)

More questions from this topic