Examkin

Question

Difficulty: EasyDeploy and Configure Azure Container Apps

You are configuring a new Azure Container App to pull container images from a private Azure Container Registry (ACR). You need to configure a managed identity to authenticate the Container App to the registry. The identity's lifecycle must be managed independently of the Container App resource, and you must follow the principle of least privilege. Which managed identity type and role-based access control (RBAC) role should you use?

  1. A
    A system-assigned managed identity with the AcrPull role
  2. B
    A user-assigned managed identity with the AcrPush role
  3. A user-assigned managed identity with the AcrPull roleAnswer
  4. D
    A system-assigned managed identity with the Owner role

Answer

A user-assigned managed identity with the AcrPull role
To pull container images from a private Azure Container Registry (ACR), the Azure Container App needs a managed identity that has the AcrPull RBAC role assigned on the ACR. Since the lifecycle of the identity needs to be managed independently of the Container App resource itself (meaning the identity persists even if the Container App is deleted and can be shared among other resources), a user-assigned managed identity must be selected.

Step-by-Step Solution

1
Determine the correct type of managed identity based on resource lifecycle requirements.
Select a user-assigned managed identity.
The lifecycle of a user-assigned managed identity is independent of any single resource, allowing it to exist before the Container App is deployed and persist after it is deleted.
2
Determine the minimum permission set required for a Container App to pull images from a private registry.
Assign the AcrPull role to the identity at the Azure Container Registry scope.
The AcrPull role is the standard built-in role that permits image pull actions without granting unnecessary push or administration privileges, complying with the principle of least privilege.

Key Concept

Configuring Azure Container App registry authentication using a user-assigned managed identity and Azure RBAC roles.
Estimated Time:45s
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic