Case study

Northwind Health — regulated container platform

Northwind Health runs a patient-facing intake application and several internal batch jobs on Azure Kubernetes Service, with images stored in Azure Container Registry.

A recent audit produced three findings. First, deployments reference image tags such as api:latest, and the audit could not prove which build was running in production during an incident. Second, several pods read a database password from a Kubernetes Secret that was committed to the deployment repository. Third, container images are pulled over the public internet, and the auditor requires that registry traffic never traverse it.

The intake workload is bursty: near zero overnight, then a sharp spike each morning. The batch jobs are interruptible and cost is a concern. The platform team also needs each workload to hold only the Azure permissions it actually needs, and must be able to prove which identity performed a given action.

Requirements

Provably immutable, verifiable image references in production
No long-lived secrets in the cluster or in source control
Registry traffic must not traverse the public internet
Scale to near zero overnight, absorb a morning spike
Reduce cost for interruptible batch workloads
Per-workload Azure identity with least privilege and an audit trail

Q46 Container Registry Domain 1 · 20–25% of exam Priority · Real Exam

Registry traffic must never traverse the public internet. Which configuration satisfies this?

A A firewall rule allowing only the AKS egress IP
B A Premium registry with a private endpoint, public network access disabled, and the privatelink DNS zone linked to the cluster VNet (correct answer)
C A service endpoint on the node subnet
D Anonymous pull with an allow list

Shortcut: A private endpoint gives the registry a private IP inside the VNet. io, or clients would still resolve and use the public endpoint. Private endpoints require the Premium tier.

A private endpoint gives the registry a private IP inside the VNet. Public access must also be disabled, and the VNet must resolve privatelink.azurecr.io, or clients would still resolve and use the public endpoint. Private endpoints require the Premium tier.

Registry traffic must never traverse the public internet. Which configuration satisfies this?

More Container Registry questions