AZ-204 Develop Azure compute solutions Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Place an Azure Application Gateway in front of the container group.

  Why this is correct

  Azure Application Gateway serves as a Layer 7 load balancer and web application firewall, perfectly suited for exposing containerized applications like those in Azure Container Instances (ACI). It provides robust SSL/TLS termination at the edge, offloading this compute-intensive task from the backend containers. Furthermore, Application Gateway enables custom domain mapping and advanced routing rules, allowing traffic to be directed to specific container instances based on URL paths or hostnames, ensuring secure and flexible access to the application.

• ✗

  Configure the container to listen on port 443 and map a custom domain.

  Why it's wrong here

  Azure Container Instances (ACI) does not natively support custom domain mapping or integrated SSL certificate management for its public IP endpoints. While a container within ACI can be configured to listen on port 443, ACI itself does not provide the necessary DNS integration or certificate provisioning mechanisms to associate a custom domain directly with its public FQDN. This limitation necessitates an external service to handle custom domain resolution and TLS termination for public-facing applications.

• ✗

  Upload the certificate to the container and configure the web server.

  Why it's wrong here

  Uploading an SSL certificate directly into an Azure Container Instance (ACI) and configuring the web server within the container is generally not a secure or scalable practice for production environments. ACI does not offer a managed way to securely store and rotate certificates, making manual certificate management prone to expiration issues and security vulnerabilities. This approach bypasses Azure's robust certificate management capabilities and increases the operational overhead for maintaining secure communication.

• ✗

  Use a private endpoint with a custom domain.

  Why it's wrong here

  Using a private endpoint with a custom domain is incorrect because private endpoints are designed to provide secure, private connectivity to Azure services from within a virtual network, not to expose services publicly with custom domains. A private endpoint bypasses the public internet entirely, making the service accessible only via private IP addresses within your VNet. It does not facilitate public DNS resolution for custom domains or provide SSL termination for external clients.

Go deeper

Related to this question