AZ-700 Question 10
Select 2You plan to deploy multiple container groups using Azure Container Instances (ACI) in a virtual network for an internal application. The container groups must communicate with a backend database service running in the same virtual network. You decide to create a delegated subnet for ACI. Which two actions are required to ensure the subnet is correctly delegated for Azure Container Instances? (Choose two.)
- A
Specify 'Microsoft.ContainerInstance/containerGroups' as the delegated service for the subnet.
- B
Enable a Microsoft.ContainerRegistry service endpoint on the delegated subnet.
- C
Place the delegated subnet in the same region and subscription as the container group deployment.
- D
Attach a network security group that blocks all inbound and outbound traffic.
Show answer and explanation
Correct answers: A, C
Explanation
For Azure Container Instances to run in a virtual network, you need to delegate a subnet by specifying 'Microsoft.ContainerInstance/containerGroups' as the service. Additionally, the subnet must be in the same region and subscription as the container group to avoid deployment errors. Blocking all traffic with a network security group would prevent any necessary communications, and enabling a Microsoft.ContainerRegistry service endpoint is unrelated to the delegation requirement. For more details, refer to Microsoft� official documentation on Azure Container Instances and subnet delegation: https://learn.microsoft.com/azure/container-instances/container-instances-vnet#subnet-delegation.
- A. Correct.
Correct. When configuring subnet delegation for Azure Container Instances, you must set the delegated service to 'Microsoft.ContainerInstance/containerGroups.' This ensures that the subnet is specifically reserved for ACI usage.
- B. Incorrect.
Incorrect. Enabling a service endpoint for Azure Container Registry on the subnet is not a requirement for subnet delegation to ACI. Service endpoints are used for controlling traffic to specific Azure services, but this is not mandatory for basic ACI network connectivity.
- C. Correct.
Correct. The subnet used for ACI must reside in the same region and subscription as the container group deployment. A mismatch in region or subscription can cause deployment failures.
- D. Incorrect.
Incorrect. While you can use network security groups with ACI, blocking all inbound and outbound traffic would prevent the container group from communicating with the internal backend database or any external service. This does not fulfill the requirement of allowing traffic within the virtual network.