AZ-204 Implement Azure security Practice Question
A financial services company uses Azure Container Instances (ACI) to run batch processing jobs. Each job processes sensitive financial data and must use a custom container image stored in Azure Container Registry (ACR). The security requirements are: the ACI container must authenticate to ACR using a managed identity, the container must run as a non-root user, and all secrets must be injected via environment variables from Azure Key Vault using the managed identity. The ACI instance must also be deployed into a virtual network (VNet) to restrict network access. What configuration should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a user-assigned managed identity, assign it to both ACI and ACR (with AcrPull role), grant it Key Vault access, and deploy ACI with the identity and VNet integration.
Using a user-assigned managed identity provides a persistent identity that can be assigned to both Azure Container Instances (ACI) and granted access to Azure Container Registry (ACR) and Azure Key Vault. This satisfies all security requirements: authentication to ACR via managed identity, non-root user execution (configured separately), and secret injection from Key Vault. VNet integration restricts network access. Option A is incorrect because a system-assigned managed identity is tied to the ACI lifecycle and cannot be shared across resources; while you can assign permissions to that identity on ACR, it does not provide the same level of control and persistence as a user-assigned identity. Option C is incorrect because using admin credentials for ACR is not secure and defeats the purpose of managed identities. Option D is incorrect because a service principal requires managing credentials, introducing security risks and additional overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a system-assigned managed identity for ACI, assign AcrPull role to the identity, and grant it Key Vault access. Deploy ACI with VNet integration.
Why it's wrong here
A system-assigned managed identity can authenticate to ACR and Key Vault, but it is tied to the ACI lifecycle and cannot be reused across multiple instances. Also, the identity must be assigned after ACI creation, making it less flexible. A user-assigned identity is preferred.
- ✓
Create a user-assigned managed identity, assign it to both ACI and ACR (with AcrPull role), grant it Key Vault access, and deploy ACI with the identity and VNet integration.
Why this is correct
Correct. A user-assigned managed identity provides a persistent identity that can be pre-created, assigned to the ACI container group, and granted AcrPull on ACR and appropriate permissions on Key Vault. This fulfills all security requirements: managed identity authentication to ACR, non-root execution (configured separately), secret injection from Key Vault, and VNet integration.
- ✗
Enable ACR admin account, use admin credentials in ACI, and store secrets in Key Vault with a system-assigned managed identity for ACI.
Why it's wrong here
Enabling the Azure Container Registry (ACR) admin account and using its credentials directly in Azure Container Instances (ACI) is a significant security anti-pattern. The admin account provides root-level access to the entire registry, making it a high-value target, and its credentials must be manually managed and rotated. Crucially, this approach bypasses the use of a managed identity entirely for ACR authentication, directly violating a core security requirement for credential-less access.
- ✗
Create a service principal, assign AcrPull role and Key Vault access, store the service principal secret in Key Vault, and configure ACI to use the service principal.
Why it's wrong here
While a service principal can be assigned the necessary AcrPull role and Key Vault access, its use necessitates the manual creation, storage, and rotation of a client secret or certificate. Storing this secret in Key Vault still requires ACI to authenticate to Key Vault to retrieve it, introducing a credential management burden that managed identities are designed to eliminate. This method does not leverage a managed identity for authenticating to ACR or Key Vault, failing to meet the requirement for credential-less authentication.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Container registry
A container registry is a centralized storage and distribution system for container images, enabling developers to push, pull, and manage versions of application snapshots across environments.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.