AZ-104 Question 163
Select 2You are tasked with deploying a containerized Node.js application to Azure Container Apps. The container image is stored in a private Azure Container Registry. You need to ensure that your container can securely pull images from your private registry and automatically scale based on HTTP requests. Which two actions should you perform?
- A
Grant the 'AcrPull' role to your Azure Container Apps environment's managed identity
- B
Use a separate Azure Key Vault secret to store the registry credentials and reference it in your app code
- C
Enable HTTPS-only endpoint in the container registry properties
- D
Configure a revision with scale rules based on HTTP concurrency in Azure Container Apps
- E
Enable the Azure Web App for Containers setting in your container app's settings blade
Show answer and explanation
Correct answers: A, D
Explanation
To provision a container in Azure Container Apps using images from a private registry, you must grant the container environment permission to pull the images. This is achieved by assigning the 'AcrPull' role to the container app's managed identity. Additionally, you configure your container's revision to scale based on HTTP concurrency, ensuring automatic scaling as traffic changes.
- A. Correct.
Assigning the 'AcrPull' role to the managed identity ensures the container app can securely pull the image from the private Azure Container Registry without manually handling credentials.
- B. Incorrect.
While using Azure Key Vault to store credentials is valid in some scenarios, it is not strictly necessary when you can assign the appropriate role directly to your container environment's managed identity.
- C. Incorrect.
Enabling HTTPS-only on the registry is a security best practice, but it does not by itself allow the container to authenticate and pull images from a private registry.
- D. Correct.
Configuring scale rules based on HTTP concurrency allows Azure Container Apps to scale out automatically when traffic increases and scale in when requests drop.
- E. Incorrect.
Enabling Azure Web App for Containers is not relevant in this scenario. Azure Container Apps and Azure Web App for Containers are separate services with different configuration processes.