AI-200 practice: Build, store, version, and manage container images by using Azure Container Registry

Question 1

A company deploys AI inference containers to AKS clusters in three Azure regions and wants each region to pull images from a registry replica in its own region to reduce latency and cross-region egress, while also requiring the registry to be reachable only via Private Link, with no public endpoint at all.

Which ACR configuration is required?

Accepted Answer

Premium tier ACR with geo-replication to all three regions, private endpoints enabled, and public network access disabled on the registry

Answer

Basic tier ACR with three separate registries, one in each region, kept in sync by a custom pipeline that copies tags between registries

Answer

Standard tier ACR with a registry firewall allowlisting the outbound IPs of each regional AKS cluster subnet for image pull operations

Answer

Standard tier ACR fronted by Azure Traffic Manager, which routes each AKS pull request to the geographically nearest registry hostname

Question 2

Your team builds a Python FastAPI service and needs the smallest possible production image while keeping build tooling out of the final image.

The initial Dockerfile uses a multi-stage build:
```dockerfile
FROM python:3.12 AS build
WORKDIR /app
COPY requirements.txt .
RUN pip install --user -r requirements.txt
COPY . .

FROM python:3.12-slim
WORKDIR /app
COPY --from=build /root/.local /root/.local
COPY --from=build /app /app
ENV PATH=/root/.local/bin:$PATH
CMD ["uvicorn", "main:app", "--host", "0.0.0.0"]
```

The image builds successfully but is still 950 MB. What is the most effective change to reduce final image size while preserving functionality?

Accepted Answer

Change the build stage base image from python:3.12 to python:3.12-slim so both stages share a smaller base, since the multi-stage copy already excludes build tooling from the final layer.

Answer

Replace python:3.12-slim with python:3.12-alpine in the final stage only.

Answer

Add --no-cache-dir to the pip install command in the build stage.

Answer

Add a .dockerignore file excluding .git, __pycache__, and virtual environment directories.

Question 3

You are tagging and pushing images to Azure Container Registry (ACR) as part of a CI/CD pipeline using:
```bash
az acr build \
  --registry myregistry \
  --image myapp:{{.Run.ID}} \
  .
```
You need every image to be immutable and traceable to a specific commit, while still supporting a floating `latest` tag for convenience.

Which addition best satisfies the requirement of immutable, commit-traceable tags and a floating tag?

Accepted Answer

Tag the build with the Git commit SHA (myapp:$GIT_SHA) and separately re-tag/push the same digest as myapp:latest using az acr import or a second docker tag/push.

Answer

Replace {{.Run.ID}} with latest only, and enable content trust on the registry.

Answer

Enable ACR's retention policy on untagged manifests; no additional tagging change is required.

Answer

Use az acr build --image myapp:{{.Run.ID}} --image myapp:latest in the same command to build the image twice.

Question 4

Your team needs a private registry to store and version container images for an AI inference service before deploying to Azure Container Apps. Which service should you provision?

Accepted Answer

Azure Container Registry

Answer

Azure Artifacts package feed

Answer

Docker Hub public registry

Answer

Azure Blob object storage

Question 5

Which ACR feature helps enforce that only signed, trusted images can be deployed to production AKS or Container Apps environments?

Accepted Answer

Content Trust signing with deploy policy

Answer

Geo-replication for multi-region pulls

Answer

Scheduled ACR Tasks for nightly builds

Answer

Quarantine without any enforce policy

Question 6

Your CI pipeline pushes a new build of `inference-api:latest` to a Premium Azure Container Registry about 40 times a day. Each push leaves the previous manifest untagged, and registry storage keeps growing. You want untagged manifests removed automatically 7 days after they lose their tag, without scheduling any build or purge task. What should you configure?

Accepted Answer

Run az acr config retention update --registry myregistry --status enabled --days 7 --type UntaggedManifests

Answer

Run az acr repository update --name myregistry --image inference-api:latest --delete-enabled true so older manifests are deleted when the tag moves

Answer

Enable geo-replication so untagged manifests are compacted across replicas and stop counting towards storage

Answer

Run az acr import --force for every build so the new image overwrites the old manifest instead of creating a new one

Question 7

A model-serving image tagged `scorer:2.3.1` has passed validation and is approved for production. Auditors require that nobody can push a different image to that tag or delete it, while other tags in the same repository must stay writable. What should you do?

Accepted Answer

Run az acr repository update --name myregistry --image scorer:2.3.1 --write-enabled false --delete-enabled false

Answer

Remove the AcrPush role from every identity that has access to the registry

Answer

Enable a retention policy so tagged manifests are kept for 365 days

Answer

Disable the registry's public network access so that only private endpoints can reach it

Question 8

After an incident, you learn that two AKS nodes ran different code for the same Deployment because the `rag-api:prod` tag was re-pushed during a rollout. You must guarantee that every replica runs exactly the same image bytes until a deliberate change is made. Which two actions meet this requirement? Select two.

Accepted Answer

Reference the image by digest in the manifest, for example rag-api@sha256:<digest>

Accepted Answer

Lock the release tag with az acr repository update --write-enabled false and deploy only immutable, versioned tags

Answer

Set imagePullPolicy: Always so each node pulls the newest image behind the tag

Answer

Enable the ACR admin user so all nodes authenticate with the same credentials

Answer

Enable geo-replication so all nodes pull from the same regional replica

Question 9

You want to copy `python:3.12-slim` from Docker Hub into your registry as `base/python:3.12-slim` once, keeping the original manifest digest. The build agent has no Docker daemon. Which command should you run?

Accepted Answer

az acr import --name myregistry --source docker.io/library/python:3.12-slim --image base/python:3.12-slim

Answer

az acr build --registry myregistry --image base/python:3.12-slim . with a Dockerfile containing only FROM python:3.12-slim

Answer

docker pull python:3.12-slim, then docker tag and docker push to myregistry.azurecr.io

Answer

az acr repository show --name myregistry --image base/python:3.12-slim --source docker.io

Question 10

An external partner's build system can't authenticate with Microsoft Entra ID. It must be able to push and pull images in the `partner/vision` repository of your registry and must have no access to any other repository. What should you configure?

Accepted Answer

Create a scope map with content/read and content/write on partner/vision, then create a repository-scoped token from it

Answer

Enable the registry admin user and share its password with the partner

Answer

Assign the AcrPush role to a guest account for the partner at the registry scope

Answer

Enable anonymous pull on the registry and let the partner push through a webhook

11 questions