Examkin

Question

Difficulty: MediumRun Containerized Solutions using Azure Container Instances

You are deploying a containerized background worker to Azure Container Instances (ACI) using a YAML template. The containerized application requires a database connection string that contains sensitive credentials. You must ensure that the connection string is passed to the container as an environment variable, but the plaintext value of the connection string must not be visible to users who run the 'az container show' command or view the container properties in the Azure portal. Which of the following configurations should you define in the YAML template to meet this requirement?

  1. A
    Define the connection string in the container's environmentVariables array using the @Microsoft.KeyVault(SecretUri=...) reference syntax.
  2. B
    Configure a system-assigned managed identity for the container group to authenticate with Azure Container Registry (ACR) and pull the container image containing the embedded connection string.
  3. Define the connection string in the container's environmentVariables array using the secureValue property.Answer
  4. D
    Enable a system-assigned managed identity for the container group, but do not assign any access policies or RBAC roles to it on the Key Vault containing the connection string secret.

Answer

Define the connection string in the container's environmentVariables array using the secureValue property.
The correct approach is to define the connection string using the secureValue property inside the environmentVariables list. Azure Container Instances treats secureValue objects as write-only, masking their values in the Azure Portal, CLI command output (such as 'az container show'), and resource logs, while still presenting them to the running container as standard environment variables.

Step-by-Step Solution

1
Analyze how environment variables are handled in ACI YAML templates.
Standard environment variables use the 'value' property, which displays the plaintext configuration in the portal and CLI outputs.
To identify that the default value property exposes sensitive data.
2
Select the correct mechanism for securing environment variables.
ACI supports 'secureValue' to mask the variable's value from the control plane while leaving it accessible to the container process.
This meets the security requirement of masking the connection string from administrative users.
3
Apply the secureValue property in the environmentVariables definition.
The connection string is securely passed to the container's environment.
To correctly configure the deployment template according to Azure Resource Manager and ACI schemas.

Key Concept

Secure environment variables in Azure Container Instances
Estimated Time:1m 30s
Rate this question

Topics

Run Containerized Solutions using Azure Container Instances

More questions from this topic