Examkin

Question

Difficulty: MediumDeploy and Configure Azure Container Apps

An organization plans to host a background task container in Azure Container Apps. The container image is stored in a private Azure Container Registry named `myregistry.azurecr.io`. A developer creates a user-assigned managed identity named `my-pull-identity` to allow secure access to the registry. The Bicep template includes the user-assigned managed identity in the top-level `identity` block of the Container App resource.

To ensure the container app can successfully authenticate and pull the image from the private registry during deployment, which code block must be included inside the `properties` section of the Container App resource definition?

  1. configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: myPullIdentity.id
    }
    ]
    }    Answer
  2. B
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: 'System'
    }
    ]
    }
  3. C
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    username: 'my-pull-identity'
    passwordRef: 'acr-password'
    }
    ]
    }
  4. D
    configuration: {
    registries: [
    {
    server: 'myregistry.azurecr.io'
    identity: myPullIdentity.name
    }
    ]
    }

Answer

The configuration block with registries specifying the server as 'myregistry.azurecr.io' and the identity as the user-assigned managed identity's resource ID (myPullIdentity.id) inside the properties.configuration section.
The correct configuration block uses the `properties.configuration.registries` array to define the registry server and references the resource ID of the user-assigned managed identity using `myPullIdentity.id`. This complies with Azure Resource Manager specifications for pulling container images from a private Azure Container Registry using a user-assigned managed identity.

Step-by-Step Solution

1
Identify the authentication mechanism required for the private registry pull.
The requirement specifies using a user-assigned managed identity.
This determines how the credentials or identity will be passed to the Container App configuration.
2
Determine the correct property path and values inside the Bicep template properties block.
Under properties.configuration.registries, the registry configuration requires the registry server and the identity property.
This ensures the deployment engine knows which identity to use for which registry server.
3
Verify the correct value type for the identity property.
The identity property must reference the full resource ID of the user-assigned managed identity (e.g., using the .id property in Bicep).
Passing the name of the identity is insufficient for Azure to resolve the resource globally.

Key Concept

Configuring private Azure Container Registry access for Azure Container Apps using user-assigned managed identities in a Bicep template.
Rate this question

Topics

Deploy and Configure Azure Container Apps

More questions from this topic