AZ-500 Question 131
Select 2Your organization has deployed a mission-critical batch processing solution running on Azure Container Instances (ACIs). The security team wants to ensure that suspicious behaviors (e.g., privilege escalation attempts) and known OS vulnerabilities are detected, and that container activities are properly logged for audit and analysis. Which of the following configurations should you implement to enable comprehensive security monitoring for your ACIs? (Choose two.)
- A
Enable diagnostic logs and forward them to an Azure Monitor Log Analytics workspace.
- B
Deploy a custom script extension on the container host to install the Azure Monitor Agent.
- C
Enable Microsoft Defender for Containers (part of Microsoft Defender for Cloud) for run-time threat detection and vulnerability scanning.
- D
Use the Azure CLI to run an 'az container logs enable' command that stores logs locally on the container host.
- E
Modify the container’s Dockerfile to include a custom sidecar for log collection and forwarding.
Show answer and explanation
Correct answers: A, C
Explanation
To configure security monitoring for Azure Container Instances, you should first enable diagnostic logs and send them to a Log Analytics workspace so that you can query, visualize, and analyze activities using Azure Monitor. Additionally, using Microsoft Defender for Containers (part of Microsoft Defender for Cloud) helps protect against vulnerabilities and suspicious processes or behavior in your container environments. For more information, see Microsoft’s documentation on using diagnostic logs with Azure Container Instances and enabling Microsoft Defender for Containers for run-time security posture management.
- A. Correct.
Option 1 is correct. To effectively monitor ACIs, you should enable diagnostic logs and send them to a Log Analytics workspace. This approach ensures container logs and metrics can be analyzed and correlated with other Azure service logs in Azure Monitor, providing insight into potential security events.
- B. Incorrect.
Option 2 is incorrect. You cannot deploy a script extension in the same way you would for Azure Virtual Machines because ACI is a managed service and does not support installing the Azure Monitor Agent on the underlying infrastructure.
- C. Correct.
Option 3 is correct. By enabling Microsoft Defender for Containers in Microsoft Defender for Cloud, you gain run-time threat detection and vulnerability scanning for container images residing in Azure Container Registry and running in ACI. This service helps identify and mitigate security issues early and continuously monitors container activities.
- D. Incorrect.
Option 4 is incorrect. There is no 'az container logs enable' command that solely stores logs locally on the container host in a way that satisfies compliance or long-term monitoring needs. Moreover, local storage on a container host can be ephemeral, so relying on local logs is not a recommended approach for robust monitoring.
- E. Incorrect.
Option 5 is incorrect. While deploying a sidecar container for custom logging is a concept used in some container scenarios, Azure Container Instances already provides built-in logging and diagnostics integration with Azure services without needing to modify the Dockerfile for sidecar log forwarding. Leveraging native diagnostic logging and Azure Monitor is more straightforward and reliable in ACI.