Case study

Northwind Health — regulated container platform

Northwind Health runs a patient-facing intake application and several internal batch jobs on Azure Kubernetes Service, with images stored in Azure Container Registry.

A recent audit produced three findings. First, deployments reference image tags such as api:latest, and the audit could not prove which build was running in production during an incident. Second, several pods read a database password from a Kubernetes Secret that was committed to the deployment repository. Third, container images are pulled over the public internet, and the auditor requires that registry traffic never traverse it.

The intake workload is bursty: near zero overnight, then a sharp spike each morning. The batch jobs are interruptible and cost is a concern. The platform team also needs each workload to hold only the Azure permissions it actually needs, and must be able to prove which identity performed a given action.

Requirements

Provably immutable, verifiable image references in production
No long-lived secrets in the cluster or in source control
Registry traffic must not traverse the public internet
Scale to near zero overnight, absorb a morning spike
Reduce cost for interruptible batch workloads
Per-workload Azure identity with least privilege and an audit trail

Q44 Container Registry Domain 1 · 20–25% of exam Priority · Real Exam

The audit cannot prove which build was running during an incident. Which change addresses the finding at its root?

A Add a build number to the tag and keep deploying by tag
B Deploy by image digest (sha256) and enable tag locking on released tags (correct answer)
C Increase ACR retention
D Enable ACR geo-replication

Shortcut: A tag is a mutable pointer, so api:latest can resolve to different images over time. A digest is content-addressed and cannot be reassigned, which is what makes the deployed artefact provable after the fact. Tag locking prevents an already-released tag being overwritten.

The audit cannot prove which build was running during an incident. Which change addresses the finding at its root?

More Container Registry questions