AZ-500 · Question #250
VNet1 is an Azure virtual network (VNet) where several development servers of the company are running. There development team has numerous Docker images stored in a private repository. These…
The correct answer is A. Deploy the container instances into VNet1. To restrict access to Azure Container Instances (ACI) to a specific Azure virtual network (VNet), the container instances must be deployed directly into that VNet.
Question
Options
- ADeploy the container instances into VNet1.
- BUse a managed identity with the container instances
- CModify the role-based access control (RBAC) permissions on the container instances.
- DAdd a Domain Name System (DNS) name label to each container instance
How the community answered
(38 responses)- A76% (29)
- B5% (2)
- C16% (6)
- D3% (1)
Why each option
To restrict access to Azure Container Instances (ACI) to a specific Azure virtual network (VNet), the container instances must be deployed directly into that VNet.
Deploying Azure Container Instances (ACI) directly into VNet1 allows them to communicate securely with other resources within that VNet and isolates them from public network access, effectively restricting access as required. This leverages VNet integration for private, network-isolated container deployments.
Using a managed identity helps authenticate the container instance to other Azure services, but it does not control network access to the container itself.
Modifying RBAC permissions controls who can manage the container instances in Azure, not how network traffic accesses the running containers.
Adding a DNS name label provides a public FQDN for the container instance but does not restrict its network access to a private VNet; it implies public accessibility.
Concept tested: Azure Container Instances (ACI) VNet integration for network isolation
Source: https://learn.microsoft.com/en-us/azure/container-instances/container-instances-vnet
Community Discussion
No community discussion yet for this question.