AZ-500 Question 132
Select 2You manage a containerized order-processing service that runs in Azure Container Instances (ACIs). The security team wants to detect potential threats in real time and perform vulnerability scanning on container images before deployment. Which two steps should you implement to enable robust security monitoring for the containers?
- A
Configure a Log Analytics workspace and enable diagnostic settings for the container group to forward logs and metrics to that workspace.
- B
Enable Microsoft Defender for Cloud to scan container images stored in Azure Container Registry (ACR).
- C
Activate Azure Monitor Container Insights specifically for Azure Container Instances to automatically capture container logs.
- D
Assign a public IP to each container instance so that Azure Network Watcher can be used to analyze all incoming traffic.
- E
Embed the container credentials within the application code for auditing and traceability purposes.
Show answer and explanation
Correct answers: A, B
Explanation
To configure effective security monitoring for Azure Container Instances, you should collect diagnostic logs and metrics and send them to a Log Analytics workspace for centralized analysis (see: https://learn.microsoft.com/azure/container-instances/container-instances-logs). Additionally, leverage Microsoft Defender for Cloud to perform vulnerability scanning on container images in Azure Container Registry and benefit from security alerts. While Container Insights offers monitoring capabilities for AKS, it is not designed for standalone ACIs.
- A. Correct.
Correct. Configuring a Log Analytics workspace and forwarding diagnostic logs and metrics from Azure Container Instances allows you to monitor container behavior, set up alert rules, and analyze potential issues in one place.
- B. Correct.
Correct. By enabling Microsoft Defender for Cloud scanning of images stored in ACR, you ensure vulnerabilities are identified before deployment. Defender also integrates with security alerts, improving threat detection for container workloads.
- C. Incorrect.
Incorrect. Container Insights is primarily designed for monitoring Azure Kubernetes Service (AKS) clusters and Arc-enabled Kubernetes, not standalone Azure Container Instances.
- D. Incorrect.
Incorrect. Merely assigning a public IP and using Azure Network Watcher does not provide inherent container-level threat detection or vulnerability scanning. It can capture traffic metrics but doesn’t replace a proper security monitoring setup.
- E. Incorrect.
Incorrect. Storing credentials in code presents a serious security risk and does not contribute to container-level monitoring or threat detection.