Tag: Container Images

Build and Run Images by Using Azure Container Registry Tasks (AI-200 Exam Prep)

This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Develop containerized solutions on Azure (20–25%)
   --> Implement container application hosting
      --> Build and Run Images by Using Azure Container Registry Tasks


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure Container Registry Tasks (ACR Tasks) provides cloud-based capabilities for building, testing, and managing container images in Azure Container Registry (ACR).

ACR Tasks is particularly useful when developers want to move container image builds into the cloud rather than relying on a locally installed Docker engine. It can support simple on-demand builds, automated builds triggered by source-code or base-image changes, and more sophisticated multi-step workflows involving multiple containers.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand not only how to execute an ACR Task, but also when to use each type of task, how build contexts work, how images are tagged, how multi-step tasks are defined, how tasks are triggered, and how tasks can securely access other resources.

Microsoft’s AI-200 training specifically identifies building and managing container images in the cloud with ACR Tasks and using the Azure CLI to run ACR quick tasks as learning objectives.


1. What Are Azure Container Registry Tasks?

ACR Tasks is a collection of capabilities within Azure Container Registry that allows you to perform container image operations in Azure.

At a high level:

Source Code / Dockerfile
|
v
ACR Task
|
+-----+-----+
| |
v v
Build Test
| |
+-----+-----+
|
v
Container Image
|
v
ACR

ACR Tasks can:

  • Build container images in Azure
  • Push images to ACR
  • Run containers as part of a task
  • Test container images
  • Build multiple images
  • Execute steps sequentially or in parallel
  • Automatically trigger builds from source-code changes
  • Automatically rebuild images when base images change
  • Run tasks on a schedule
  • Integrate into CI/CD workflows

ACR Tasks supports Linux, Windows, and ARM image platforms, depending on the configuration and supported scenarios.


2. Why Use ACR Tasks?

A traditional container development workflow might look like this:

Developer Computer
|
+-- Docker build
|
+-- Docker test
|
+-- Docker push
|
v
Azure Container Registry

This requires the developer’s machine to have the appropriate container tooling.

With an ACR Task:

Developer
|
| Azure CLI
v
Azure Container Registry
|
+-- Build
+-- Test
+-- Push

The build is performed in Azure.

This has several advantages:

  • No local Docker Engine is required for an ACR quick task.
  • Builds can be standardized.
  • Builds can be automated.
  • Container images can be built close to the registry.
  • Build workflows can be triggered by source-code changes.
  • Base-image updates can automatically initiate rebuilds.
  • More complex build/test workflows can be defined using YAML.

Microsoft describes quick tasks as an integrated development experience that offloads container image builds to Azure and can perform the equivalent of docker build and docker push in the cloud.


3. Three Important ACR Task Scenarios

For AI-200, understand these three categories:

Task typePrimary purpose
Quick taskOn-demand build and push
Automatically triggered taskAutomatically execute when an event occurs
Multi-step taskBuild, test, run, and push multiple images/workflows

These aren’t mutually exclusive concepts.

For example, a multi-step task can also be automatically triggered by a Git commit.


4. Quick Tasks

A quick task is an on-demand container image build performed in Azure.

It is particularly useful during development.

The Azure CLI command is:

az acr build

For example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The final . represents the build context.

Conceptually, this performs:

Dockerfile + build context
|
v
ACR Task
|
v
Build image
|
v
Push image
|
v
ACR

The important point is that the build takes place in Azure rather than requiring a local Docker engine.

ACR Tasks’ quick-build capability is essentially a cloud-based equivalent of performing a Docker build and push operation.


5. Understanding the Build Context

One of the most important concepts when using az acr build is the build context.

Consider:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The . specifies the current directory as the build context.

The build context contains files that are available to the Docker build process.

For example:

orders-api/
├── Dockerfile
├── requirements.txt
├── app.py
└── src/

Running:

az acr build ... .

makes that directory the build context.

The context can also come from other supported locations, including source repositories.


6. Dockerfile and ACR Tasks

ACR Tasks uses familiar Docker build syntax.

For example:

FROM python:3.12
WORKDIR /app
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY . .
CMD ["python", "app.py"]

You can then build the image with:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The Dockerfile defines how the container image is constructed.

ACR Tasks handles the build environment and performs the build in Azure.


7. Specifying a Dockerfile

If the Dockerfile has a different name or location, specify it using --file.

For example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
--file Dockerfile.production \
.

You can also specify a Dockerfile located elsewhere relative to the build context.

The important exam concept is:

The build context and Dockerfile are related but are not necessarily the same thing.

The Dockerfile describes the build instructions.

The build context identifies the files available to the build.


8. ACR Tasks Versus Local Docker Builds

Consider this traditional command:

docker build -t orders-api:v1 .

With ACR Tasks, you can use:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

The conceptual difference is:

Local DockerACR Tasks
Build occurs locallyBuild occurs in Azure
Requires Docker EngineNo local Docker Engine required for quick tasks
Image initially exists locallyImage can be pushed directly to ACR
Developer manages build environmentAzure provides the task execution environment

This distinction is a likely source of scenario-based exam questions.


9. Building Without a Local Docker Engine

Suppose a developer has:

  • Azure CLI
  • Access to an Azure Container Registry
  • A Dockerfile
  • Application source code

but doesn’t have Docker installed.

The developer can still build the image using:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

This is one of the strongest scenarios for recognizing ACR Tasks on the exam.


10. Running an Image with ACR Tasks

ACR Tasks can also run containers as part of a task.

The cmd step is used for this purpose in multi-step tasks.

For example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID

The cmd step runs a container using the specified image.

This makes it possible to use ACR Tasks for testing.

For example:

Build image
|
v
Run image
|
v
Execute tests
|
v
Push image

The cmd step supports parameters similar to familiar container-run operations, including environment variables and detached execution.


11. Multi-Step Tasks

A multi-step task allows you to create a more sophisticated container workflow.

Instead of simply:

Build → Push

you can implement:

Build
|
v
Run
|
v
Test
|
v
Push

You can also build multiple images:

             +--> Build API ----+
             |                  |
Source ------+                  +--> Test --> Push
             |                  |
             +--> Build Worker -+

Multi-step tasks are defined in a YAML file.

Microsoft identifies three primary ACR Tasks step types:

  • build
  • push
  • cmd

12. The build Step

The build step builds a container image.

Example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .

Conceptually, this is similar to:

docker build

but the build is performed within the ACR Tasks environment.

The image name should identify the image that the task builds.


13. The push Step

The push step pushes an image to a container registry.

Example:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

The build step creates the image.

The push step publishes it to the registry.

An important exam distinction is that in a multi-step az acr run task, you should not assume that a built image is automatically pushed simply because it was built. The task definition can explicitly use a push step to publish it.


14. The cmd Step

The cmd step executes a container.

For example:

version: v1.1.0
steps:
- cmd: bash:3.0 echo "Hello from ACR Tasks"

It can also execute an image produced by an earlier build:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID

This is especially useful for testing.

The cmd step can use environment variables and other execution options.


15. Build, Test, and Push

A common ACR Tasks pattern is:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- cmd: $Registry/orders-api:$ID
- push:
- $Registry/orders-api:$ID

Conceptually:

             BUILD
               |
               v
          Container Image
               |
               v
              TEST
               |
         Tests successful
               |
               v
              PUSH
               |
               v
              ACR

This pattern can prevent an image from being pushed until validation has occurred.


16. Step Dependencies

ACR Tasks allows steps to have dependencies.

The when property can specify which previous steps must complete before a step executes.

For example:

version: v1.1.0
steps:
- id: build
build: -t $Registry/orders-api:$ID .
- id: test
cmd: $Registry/orders-api:$ID
when: ["build"]
- id: push
push:
- $Registry/orders-api:$ID
when: ["test"]

The sequence is:

build
|
v
test
|
v
push

This allows the task to express workflow dependencies explicitly.


17. Parallel Execution

ACR Tasks can also execute independent steps concurrently.

For example:

version: v1.1.0
steps:
- id: build-api
build: -t $Registry/api:$ID .
when: ["-"]
- id: build-worker
build: -t $Registry/worker:$ID ./worker
when: ["-"]

The special:

when: ["-"]

indicates that the step has no dependency on another step and can begin immediately.

Therefore:

        +--> Build API ---+
        |                 |
START --+                 +--> Continue
        |                 |
        +--> Build Worker-+

This can reduce total task execution time when operations are independent.

Microsoft’s ACR Tasks YAML reference specifically documents when: ["-"] for steps that have no dependency and can execute concurrently.


18. Build Dependencies Versus Sequential Steps

If when isn’t specified, a step is dependent on the previous step in the task definition.

For example:

steps:
- id: build
build: -t $Registry/api:$ID .
- id: test
cmd: $Registry/api:$ID
- id: push
push:
- $Registry/api:$ID

This naturally produces:

build → test → push

If explicit dependencies are needed, use when.


19. Running an ACR Task

The Azure CLI command commonly used to execute a task definition is:

az acr run

For example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
.

You can also use a Git repository as the context.

For example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
https://github.com/example/project.git

The task receives the specified source context and executes the defined workflow.


20. az acr build Versus az acr run

This is an important distinction for AI-200.

az acr build

Designed primarily for a quick cloud-based image build.

Example:

az acr build \
--registry myregistry \
--image orders-api:v1 \
.

Think:

Build an image quickly in Azure.

az acr run

Executes an ACR Tasks workflow.

Example:

az acr run \
--registry myregistry \
--file acr-task.yaml \
.

Think:

Run a defined task workflow.

A multi-step task uses az acr run.


21. ACR Tasks Run Variables

ACR Tasks provides built-in run variables.

These variables can be used to create standardized image names and tags.

One particularly useful variable is:

Run.ID

which can be represented in task YAML using the $ID alias.

For example:

steps:
- build: -t $Registry/orders-api:$ID .

This gives each task run a unique identifier that can be incorporated into the image tag.

ACR Tasks also provides variables associated with:

  • Registry
  • Registry name
  • Run ID
  • Date
  • Operating system
  • Architecture
  • Git commit
  • Git branch
  • Task name


22. Why Use Unique Build Tags?

Suppose every build uses:

orders-api:latest

You lose an easy way to distinguish individual builds.

Instead, you could use:

orders-api:build-123
orders-api:build-124
orders-api:build-125

ACR Tasks’ run ID can help automate this.

For example:

steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

This produces unique image references for individual runs.

This is especially useful for CI/CD scenarios.


23. Automatically Triggered Tasks

ACR Tasks can automatically execute based on events.

Important trigger scenarios include:

Source-code updates

A task can run when code is committed to a supported Git repository.

For example:

Developer commits code
|
v
Git repository
|
v
ACR Task trigger
|
v
Build image
|
v
Push image

Base-image updates

A task can be triggered when a base image changes.

For example:

FROM python:3.12

If the base image is updated, an ACR Task can rebuild the application image.

This is useful for automatically incorporating updated OS or framework components.

Scheduled execution

ACR Tasks can also support scheduled execution.

For example:

Every night
|
v
ACR Task
|
v
Build/test image

Microsoft documents source-code, base-image, and timer-based triggers as ACR Tasks automation scenarios.


24. Base Image Update Triggers

Base image triggers are especially relevant to security and maintenance.

Suppose:

FROM ubuntu:24.04

A security update causes a newer version of the base image to become available.

Without automation:

Base image updated
|
X
Application image remains unchanged

With an ACR Task:

Base image updated
|
v
ACR Task trigger
|
v
Rebuild application image
|
v
Push updated image

This allows organizations to automatically rebuild images when their dependencies change.

Microsoft describes this scenario as a way to automate OS and framework patching for container images.


25. Source-Code Triggers

ACR Tasks can integrate with source repositories.

For example:

Git commit
|
v
ACR Task
|
+-- Build
+-- Test
+-- Push

This provides a simple cloud-based container CI workflow.

A task can be configured to respond to commits and, depending on the configuration, pull-request activity in supported Git repositories.


26. Multi-Container Workflows

ACR Tasks becomes particularly valuable when an application contains multiple containers.

Suppose you have:

Web API
Worker
Test suite

You could define:

Build API
|
Build Worker
|
Run tests
|
Push API
|
Push Worker

Or independent builds could execute concurrently:

            +--> Build API -----+
            |                   |
START ------+                   +--> Test --> Push
            |                   |
            +--> Build Worker --+

Multi-step tasks are designed specifically for these types of workflows.


27. ACR Tasks and CI/CD

ACR Tasks can be incorporated into a broader CI/CD architecture.

For example:

Developer
|
v
Git Repository
|
v
ACR Task
|
+--> Build
|
+--> Test
|
+--> Push
|
v
Azure Container Registry
|
v
Container Apps / AKS / App Service

ACR Tasks is therefore not merely a command for building images. It can serve as a container lifecycle building block within an automated development process.


28. Accessing Other Registries

An ACR Task may need to access images or artifacts outside the registry where the task runs.

For example:

ACR Task
|
| Pull base image
v
External Registry

or:

ACR Task
|
| Push image
v
Another Registry

ACR Tasks supports authentication mechanisms for accessing protected resources.

Managed identities are particularly useful when an ACR Task needs to access other Azure resources without embedding credentials in the task definition.

Microsoft documents both system-assigned and user-assigned managed identities for ACR Tasks.


29. Managed Identities for ACR Tasks

An ACR Task can have a managed identity.

Two types are available:

System-assigned managed identity

The identity is associated with the specific ACR Task resource.

Its lifecycle is tied to that resource.

User-assigned managed identity

The identity is an independent Azure resource that can be assigned to multiple resources.

This can be useful when the same identity needs to be reused.

The key exam concept is:

Managed identities allow ACR Tasks to access protected Azure resources without embedding credentials in the task definition.


30. ACR Tasks and Azure Key Vault

ACR Tasks can also integrate with Azure Key Vault for scenarios where a task needs access to secrets.

A secure architecture might look like:

                 Azure Key Vault
                       |
                       | Secret
                       v
ACR Task ------ Managed Identity
                       |
                       v
                  Build/Test

This is preferable to hard-coding credentials into Dockerfiles, scripts, or task definitions.


31. Security Considerations

When designing ACR Task workflows:

Avoid putting secrets directly on command lines

Command-line arguments can potentially be captured by diagnostic or logging systems.

Avoid embedding credentials in Dockerfiles

A Dockerfile should not contain permanent passwords, tokens, or keys.

Prefer managed identities

When the target resource supports identity-based authentication, managed identities reduce credential-management overhead.

Use least privilege

Give the task only the permissions it needs.

Be careful with external registry credentials

If a task must access another private registry, configure authentication appropriately rather than placing credentials in source code.

Microsoft specifically warns that information supplied through command lines or URIs can appear in ACR diagnostic tracing, including sensitive values.


32. Task YAML Structure

A basic multi-step task looks like:

version: v1.1.0
steps:
- build: -t $Registry/orders-api:$ID .
- push:
- $Registry/orders-api:$ID

A more sophisticated task could look like:

version: v1.1.0
steps:
- id: build-api
build: -t $Registry/orders-api:$ID .
- id: test-api
cmd: $Registry/orders-api:$ID
when: ["build-api"]
- id: push-api
push:
- $Registry/orders-api:$ID
when: ["test-api"]

The key elements are:

ElementPurpose
versionYAML task format version
stepsDefines task operations
buildBuilds an image
pushPushes an image
cmdRuns a container
idGives a step an identifier
whenDefines dependencies
$RegistryRegistry run-variable alias
$IDRun ID alias

ACR Tasks currently supports YAML as the task-definition format.


33. A Complete Build-Test-Push Example

Consider an API application with:

Dockerfile
src/
tests/

A multi-step task could conceptually perform:

version: v1.1.0
steps:
- id: build
build: -t $Registry/orders-api:$ID .
- id: test
cmd: $Registry/orders-api:$ID
when: ["build"]
- id: push
push:
- $Registry/orders-api:$ID
when: ["test"]

The workflow becomes:

                  +----------------+
                  |     Source     |
                  +-------+--------+
                          |
                          v
                       BUILD
                          |
                          v
                    Container Image
                          |
                          v
                        TEST
                          |
                    Tests pass
                          |
                          v
                        PUSH
                          |
                          v
                         ACR

This is an excellent pattern to recognize in scenario-based questions.


34. az acr build Versus Multi-Step Tasks

A useful exam comparison is:

RequirementAppropriate approach
Build one image nowaz acr build
Build image without local Dockeraz acr build
Build and push a simple imageQuick task
Build and test an imageMulti-step task
Build several imagesMulti-step task
Run a container during a workflowcmd step
Push an image from a multi-step taskpush step
Trigger from Git commitAutomatically triggered ACR Task
Rebuild when base image changesBase-image trigger
Run periodicallyScheduled task

35. Common Exam Traps

Trap 1: Choosing Azure Container Instances

ACR Tasks is about building and managing container image workflows.

Azure Container Instances is primarily about running containers.

If the question says:

“Build a container image in Azure without installing Docker locally.”

Think:

ACR Tasks

not Azure Container Instances.


Trap 2: Confusing ACR with ACR Tasks

ACR is the registry.

ACR Tasks provides cloud-based build and automation capabilities.

Think:

ACR
Store images
ACR Tasks
Build/test/automate images

Trap 3: Assuming az acr run and az acr build are identical

They are not.

az acr build is designed for the quick cloud build scenario.

az acr run executes a task definition or command in the ACR Tasks environment.


Trap 4: Assuming every build automatically pushes an image

For a quick az acr build, the resulting image is pushed to the registry by default.

For an az acr run multi-step task, you should explicitly define a push step when you want to push the built image.

This distinction is explicitly documented in the ACR Tasks YAML reference.


Trap 5: Using cmd when you need to build an image

cmd runs a container.

build builds a container image.

Remember:

build → create image
cmd → run container
push → publish image

Trap 6: Ignoring the build context

The build context determines what files are available to the Docker build.

A Dockerfile alone isn’t necessarily sufficient if it references files from the context.


Trap 7: Putting secrets in the Dockerfile

Never assume that a secret belongs in:

ENV PASSWORD=...

or:

RUN some-command --password ...

Use appropriate Azure identity and secret-management mechanisms instead.


36. AI-200 Exam-Focused Review

Make sure you understand the following:

ACR Tasks

Cloud-based container build and automation capabilities.

Quick task

On-demand image build, commonly using:

az acr build

az acr run

Executes an ACR task workflow or command.

Build context

The files supplied to the container build.

build

Builds a container image.

push

Pushes an image to a registry.

cmd

Runs a container as part of a task.

when

Defines dependencies between task steps.

$Registry

Identifies the registry associated with the task run.

$ID

Identifies the current task run and can be used to generate unique tags.

Multi-step task

Supports complex workflows involving building, testing, running, and pushing containers.

Source trigger

Automatically runs a task when supported source-code changes occur.

Base-image trigger

Automatically rebuilds images when a base image changes.

Scheduled trigger

Runs tasks according to a schedule.

Managed identity

Allows a task to access protected Azure resources without embedding credentials.


37. The Mental Model to Remember

For AI-200, think of ACR Tasks as a cloud-based container build and automation engine attached to Azure Container Registry.

                    SOURCE
                       |
             +---------+---------+
             |                   |
          Dockerfile          Git Repo
             |                   |
             +---------+---------+
                       |
                       v
                  ACR TASK
                       |
          +------------+------------+
          |            |            |
        BUILD         CMD         PUSH
          |            |            |
          |          TEST           |
          |            |            |
          +------------+------------+
                       |
                       v
                  ACR IMAGE
                       |
                       v
             Container Service
        +----------+----------+
        |          |          |
       AKS    Container Apps  App Service

The most important distinction is:

ACR stores the image; ACR Tasks builds, tests, and automates the image lifecycle.


Practice Exam Questions

Question 1

A developer has a Dockerfile and application source code but does not have Docker installed locally. The developer needs to build the image in Azure and store it in an Azure Container Registry.

Which command should the developer use?

A. az container create

B. az acr repository create

C. az acr build

D. az aks create

Answer: C

Explanation: az acr build performs a cloud-based container image build using Azure Container Registry Tasks. The build occurs in Azure, so a local Docker Engine isn’t required for this scenario. The command can build and push the resulting image to ACR.


Question 2

A development team wants to create an automated workflow with the following steps:

  1. Build an API container image.
  2. Run the image.
  3. Execute functional tests.
  4. Push the image only if the tests succeed.

Which ACR Tasks capability should be used?

A. A multi-step task

B. ACR geo-replication

C. An ACR repository

D. An Azure Container Apps revision

Answer: A

Explanation: Multi-step ACR Tasks are designed for workflows that combine multiple container operations. The build, cmd, and push step types can be combined, and dependencies can be defined using the when property. This allows testing to occur before the image is pushed.


Question 3

An ACR Task contains the following YAML:

steps:
- id: build
build: -t $Registry/api:$ID .
- id: test
cmd: $Registry/api:$ID
when: ["build"]
- id: push
push:
- $Registry/api:$ID
when: ["test"]

What is the purpose of when: ["test"] on the final step?

A. It causes the push to run before testing

B. It causes the push to run concurrently with testing

C. It causes the push step to be skipped

D. It makes the push step dependent on successful completion of the test step

Answer: D

Explanation: The when property establishes dependencies between task steps. Here, the push step depends on the step identified as test, so it won’t execute until the test step completes successfully.


Question 4

An organization wants an ACR Task to automatically rebuild application images whenever a new version of a base image becomes available.

Which trigger should be configured?

A. A repository namespace trigger

B. A base-image update trigger

C. A container restart trigger

D. An Azure Monitor alert trigger

Answer: B

Explanation: ACR Tasks supports base-image update triggers. When the configured base image changes, the task can automatically rebuild the application image. This is particularly useful for incorporating updated operating-system and framework components.


Question 5

An ACR Task needs to execute two independent image builds at the same time. Which YAML configuration allows the steps to start without depending on another task step?

A. when: ["-"]

B. when: ["parallel"]

C. when: ["async"]

D. when: ["none"]

Answer: A

Explanation: In ACR Tasks, when: ["-"] indicates that the step has no dependency on another step and can begin immediately. This can allow independent steps to execute concurrently.


Question 6

A developer wants to create a unique container image tag for every ACR Task execution. Which ACR Tasks variable is specifically designed to identify the current task run?

A. $Branch

B. $Registry

C. $ID

D. $Architecture

Answer: C

Explanation: $ID is an ACR Tasks alias for the current run ID. It can be used to create unique image tags, such as:

-t $Registry/api:$ID

This is useful for distinguishing images produced by different task executions.


Question 7

A multi-step ACR Task has the following steps:

steps:
- build: -t $Registry/api:$ID .
- push:
- $Registry/api:$ID

What is the primary purpose of the push step?

A. Run the container

B. Upload the built image to a container registry

C. Compile the Dockerfile

D. Create an Azure Container Apps revision

Answer: B

Explanation: The push step publishes a built or retagged container image to a container registry. The build step creates the image; push publishes it.


Question 8

An organization wants an ACR Task to execute whenever developers commit code to a supported Git repository. Which capability should be configured?

A. A source-code trigger

B. An ACR retention policy

C. An ACR private endpoint

D. A container health probe

Answer: A

Explanation: ACR Tasks supports source-code triggers that can automatically execute builds or multi-step tasks when changes occur in supported Git repositories. This provides a simple mechanism for integrating container builds into a CI workflow.


Question 9

An ACR Task must access a protected Azure resource. The organization doesn’t want credentials embedded in the task definition.

Which approach provides the most appropriate Azure-native solution?

A. Store the credential in the Dockerfile

B. Put the password in the task’s command line

C. Use a managed identity for the ACR Task

D. Make the Azure resource publicly accessible

Answer: C

Explanation: ACR Tasks can use system-assigned or user-assigned managed identities to access protected resources without embedding credentials in task definitions. The identity must be granted the required permissions on the target resource.


Question 10

A developer executes:

az acr build \
--registry myregistry \
--image orders-api:v2 \
.

What does the final . represent?

A. The ACR registry name

B. The image tag

C. The Docker image digest

D. The build context

Answer: D

Explanation: The final . specifies the current directory as the build context. Files in the build context are made available to the Docker build process. The Dockerfile and files referenced during the build generally need to be available through the selected context.


Key Takeaways

For the AI-200 exam, remember these relationships:

ConceptRemember
ACRStores and manages container images
ACR TasksBuilds, runs, tests, and automates container workflows
az acr buildPerforms an on-demand cloud image build
az acr runRuns an ACR Tasks workflow/command
Build contextFiles supplied to the image build
buildCreates a container image
cmdRuns a container
pushPublishes an image to a registry
whenControls task-step dependencies
when: ["-"]Allows an independent step to start immediately
$IDCurrent task run identifier
$RegistryRegistry associated with the task
Multi-step taskBuild/test/run/push workflows
Source triggerRun when source code changes
Base-image triggerRebuild when a base image changes
Scheduled triggerRun according to a schedule
Managed identitySecure access without embedding credentials

The single most useful mental model for this objective is:

                  ACR TASKS
                      |
       +--------------+--------------+
       |              |              |
     BUILD           CMD            PUSH
       |              |              |
   Create image    Run/test       Publish image
       |              |              |
       +--------------+--------------+
                      |
                      v
                     ACR

And when the exam gives you a scenario, ask:

  1. Do I need to build an image in Azure?az acr build / ACR Tasks
  2. Do I need multiple build/test/run operations? → Multi-step ACR Task
  3. Do I need to execute a container?cmd
  4. Do I need to publish an image?push
  5. Do steps have dependencies?when
  6. Do independent steps need to run concurrently?when: ["-"]
  7. Should builds happen automatically after source changes? → Source trigger
  8. Should images rebuild when a base image changes? → Base-image trigger
  9. Does the task need secure access to another Azure resource? → Managed identity
  10. Do I need unique image versions for task runs? → Use $ID in the image tag

These distinctions are especially important because AI-200 scenario questions are likely to test which ACR Tasks capability best fits a particular development or deployment requirement, rather than simply asking you to recall an individual command.


Go to the AI-200 Exam Prep Hub main page

Build, Store, Version, and Manage Container Images by Using Azure Container Registry (AI-200 Exam Prep)

This post is a part of the AI-200: Developing AI Cloud Solutions on Azure  Exam Prep Hub.
This topic falls under these sections:
Develop containerized solutions on Azure (20–25%)
   --> Implement container application hosting
      --> Build, store, version, and manage container images by using Azure Container Registry


Note that there are 10 practice questions (with answers) at the end of each section to help you solidify your knowledge of the material. Also, there are 4 practice tests with 30 questions each available from the hub's main page below the exam topics section.

Overview

Azure Container Registry (ACR) is a managed, private registry service in Azure for storing and managing container images and other OCI-compatible artifacts. It provides a central location from which containerized applications can obtain the images they need to run on services such as Azure App Service, Azure Container Apps, Azure Kubernetes Service (AKS), and Azure Container Instances.

For the AI-200: Developing AI Cloud Solutions on Azure exam, you should understand more than simply how to push an image into ACR. You should be comfortable with the hierarchy of registries, repositories, images, tags, manifests, and layers; image versioning strategies; building images using ACR Tasks; managing and deleting images; and selecting appropriate authentication and registry capabilities.

The current Microsoft Learn study guide specifically identifies this objective as part of Implement container application hosting. It also separately identifies ACR Tasks as an exam objective, so understanding how ACR stores images and how ACR Tasks builds them is particularly important.


1. What Is Azure Container Registry?

Azure Container Registry is a private container registry service hosted in Azure.

A container registry solves a fundamental problem in containerized application development:

Where do applications securely obtain the container images they need to run?

Instead of relying exclusively on a public registry, an organization can maintain its own private registry in Azure.

A typical workflow looks like this:

Developer
|
| Build container image
v
Docker / ACR Tasks
|
| Push
v
Azure Container Registry
|
+------------------+
| |
v v
Azure App Service AKS
| |
v v
Container Apps Container workloads

ACR provides capabilities for:

  • Storing container images
  • Storing OCI artifacts
  • Organizing images into repositories
  • Tagging and versioning images
  • Pushing and pulling images
  • Building images using ACR Tasks
  • Managing image metadata
  • Controlling access
  • Replicating images across regions
  • Integrating with Azure container services

Microsoft describes ACR as a private, managed registry that supports building, storing, and managing images for container deployments.


2. Understand the ACR Hierarchy

One of the most important concepts for AI-200 is understanding how ACR organizes container content.

The hierarchy can be thought of as:

Azure Container Registry
|
+-- Repository
| |
| +-- Image : Tag
| +-- Image : Tag
| +-- Image : Tag
|
+-- Repository
|
+-- Image : Tag
+-- Image : Tag

The important concepts are:

  1. Registry
  2. Repository
  3. Artifact/Image
  4. Tag
  5. Manifest
  6. Layer
  7. Digest

Understanding the distinctions between these concepts is a common source of exam questions.


2.1 Registry

The registry is the overall ACR resource.

For example:

contosoregistry.azurecr.io

The registry provides the endpoint through which clients push and pull container images.

A registry can contain many repositories.


2.2 Repository

A repository is a collection of related container images or artifacts.

For example:

contosoregistry.azurecr.io/customer-api

The repository could contain:

customer-api:v1
customer-api:v2
customer-api:v3

Repositories can also use namespaces:

contosoregistry.azurecr.io/marketing/campaign-api:v2

Namespaces help organize repositories logically, although they aren’t independent Azure resources or hierarchical security boundaries simply because they contain / characters.

Microsoft notes that repository names can include namespaces and are managed independently by the registry.


3. Container Image Tags

A tag provides a human-readable identifier for a particular version or variant of an image.

For example:

customer-api:v1
customer-api:v2
customer-api:2026-08-07
customer-api:production

The complete image reference might be:

contosoregistry.azurecr.io/customer-api:v2

The structure is:

<registry>/<repository>:<tag>

For example:

contosoregistry.azurecr.io/customer-api:v2

where:

ComponentValue
Registrycontosoregistry.azurecr.io
Repositorycustomer-api
Tagv2

Microsoft recommends using appropriate tagging strategies for deployment scenarios and notes that latest is used by default when no tag is specified in Docker commands.


4. Tagging and Versioning Strategies

Image versioning is extremely important for reliable deployments.

Consider:

customer-api:latest

This tag is convenient, but it does not necessarily identify an immutable version.

Suppose today’s latest points to:

Image A

and tomorrow the same tag is updated:

latest → Image B

A deployment configured to use latest may therefore receive a different image without its configuration changing.

For production deployments, a better approach is generally to use unique version identifiers.

Examples:

customer-api:v1.0.0
customer-api:v1.1.0
customer-api:v1.2.0

or:

customer-api:20260807.1
customer-api:20260807.2

or a source-control commit identifier:

customer-api:a81f42c

A useful pattern is:

latest → convenient development/testing reference
v1.4.2 → human-readable release
a81f42c → unique build identifier

Exam Tip

If a question asks how to ensure that a deployment consistently uses a specific image version, be cautious about answers using:

:latest

A unique tag or, even more strongly, an image digest provides better version specificity.


5. Image Digests

Container images are also identified by a digest.

For example:

contosoregistry.azurecr.io/customer-api@sha256:abc123...

A digest identifies the content associated with a manifest.

Compare:

customer-api:v2

with:

customer-api@sha256:abc123...

A tag can be moved to point to another image.

A digest identifies a specific content-addressed version.

Microsoft specifically notes that pulling by digest guarantees the image version being retrieved even if an identically tagged image is subsequently pushed.

Exam Tip

Remember:

Tag = human-friendly version reference

Digest = content-addressed, precise image reference


6. Container Image Layers

Container images consist of one or more layers.

Dockerfiles commonly create multiple layers.

For example:

FROM python:3.12
COPY requirements.txt .
RUN pip install -r requirements.txt
COPY app.py .

The resulting image is composed of layers.

One of the advantages of layers is reuse.

If two images share the same base layers, those layers don’t necessarily have to be independently stored and transferred each time.

This can reduce storage and transfer requirements.


7. Manifests

A container image is associated with a manifest.

The manifest contains information needed to identify the image and its layers.

Conceptually:

Image Manifest
|
+-- Configuration
|
+-- Layer 1
+-- Layer 2
+-- Layer 3

The manifest is also associated with the image’s digest.

This distinction matters when managing images in ACR.

For example, removing a tag doesn’t necessarily mean that all image data is immediately removed.

An untagged manifest and its associated layers may continue to consume storage until they are deleted and no longer referenced.

Microsoft specifically warns that repeatedly pushing modified artifacts with identical tags can create untagged artifacts that continue consuming registry storage.


8. Pushing an Image to ACR

A common workflow is:

Step 1: Build the image

docker build -t customer-api:v1 .

Step 2: Tag the image with the ACR login server

docker tag customer-api:v1 \
contosoregistry.azurecr.io/customer-api:v1

Step 3: Authenticate to ACR

az acr login --name contosoregistry

Step 4: Push the image

docker push \
contosoregistry.azurecr.io/customer-api:v1

The image is now stored in:

contosoregistry.azurecr.io/customer-api

with the tag:

v1

9. Pulling an Image

A client can pull the image by tag:

docker pull \
contosoregistry.azurecr.io/customer-api:v1

Or by digest:

docker pull \
contosoregistry.azurecr.io/customer-api@sha256:<digest>

The second approach provides stronger guarantees regarding exactly which image content is retrieved.


10. Azure Container Registry Tasks

One of the most important ACR features for AI-200 is ACR Tasks.

ACR Tasks allows container images to be built in Azure rather than requiring the developer to perform the build locally.

Microsoft describes ACR Tasks as a suite of capabilities for building, testing, and managing container images.

For example:

az acr build \
--registry contosoregistry \
--image customer-api:v1 \
--file Dockerfile .

The command:

  1. Sends the build context to Azure.
  2. Uses the Dockerfile.
  3. Builds the image in Azure.
  4. Tags the resulting image.
  5. Pushes the resulting image into the registry.

This is particularly useful when a developer doesn’t have Docker installed locally.

Microsoft’s current quickstart explicitly demonstrates building, pushing, and running an image using ACR Tasks without requiring a local Docker installation.


11. ACR Tasks Quick Tasks

A quick task is useful for an on-demand image build.

For example:

az acr build \
--registry contosoregistry \
--image customer-api:v1 \
.

This is useful during the development inner loop.

Instead of:

Developer machine
|
+-- docker build
+-- docker tag
+-- docker push

you can use:

Developer
|
| az acr build
v
Azure
|
+-- Build
+-- Tag
+-- Push
v
ACR

12. Automated ACR Tasks

ACR Tasks can also be configured to automatically execute when certain events occur.

For example:

Git commit
|
v
ACR Task
|
+-- Build image
+-- Test image
+-- Push image

ACR Tasks can also respond to base image updates.

For example, suppose an application uses:

FROM python:3.12

A base-image update can trigger an ACR Task to rebuild the application image.

This is useful for keeping application images current when their base images change.

Microsoft documents ACR Tasks triggers for Git commits and base-image updates.


13. Multi-Step ACR Tasks

ACR Tasks can execute more sophisticated workflows.

For example:

Build application image
|
v
Run application
|
v
Run test container
|
v
Push image

Multi-step tasks are defined using YAML.

A simplified example is:

version: v1.1.0
steps:
- build: -t $Registry/customer-api:$ID .
- push:
- $Registry/customer-api:$ID
- cmd: $Registry/customer-api:$ID

ACR Tasks supports three major step types:

StepPurpose
buildBuild a container image
pushPush an image to a registry
cmdRun a container as a command

Exam Tip

If a question describes a workflow that needs to build, test, and push multiple containers, think:

ACR Tasks multi-step task


14. ACR Tasks and External Registries

ACR Tasks can also interact with other registries.

For example, a task may need to:

ACR
|
+-- Pull base image from another registry
|
+-- Build application
|
+-- Push application image to ACR

Credentials can be configured for tasks when access to another registry is required.

For more secure scenarios, ACR Tasks can use managed identities to access protected Azure resources without embedding credentials directly in task definitions.


15. Authentication to Azure Container Registry

ACR is generally private, so clients need appropriate authentication and authorization to access it.

Common authentication approaches include:

  • Microsoft Entra identities
  • Managed identities
  • Service principals
  • Administrator credentials
  • Repository-scoped access mechanisms
  • Anonymous pull, where explicitly configured and supported

Microsoft’s documentation emphasizes that ACR operations such as push and pull require authentication unless anonymous pull is enabled.


16. Managed Identity and ACR

Managed identities are particularly important in Azure-native applications.

Suppose an AKS cluster needs to pull an image:

AKS
|
| Managed Identity
v
Azure Container Registry
|
v
customer-api:v1

Rather than storing a registry password in application configuration, the Azure resource can use a managed identity and appropriate permissions.

For a non-ABAC-enabled registry, a common pull-only role is:

AcrPull

For push and pull:

AcrPush

For ABAC-enabled registries, Microsoft documents repository-scoped roles such as:

Container Registry Repository Reader
Container Registry Repository Writer

The exact role depends on the registry’s authorization model.

Exam Tip

When the question says:

“An Azure service needs to pull images from ACR without storing credentials.”

Think:

Managed identity + appropriate ACR permissions


17. ACR Pricing Tiers

Azure Container Registry currently provides three pricing tiers:

  • Basic
  • Standard
  • Premium

The tiers provide increasing capacity and capabilities.

CapabilityBasicStandardPremium
Intended useLower-volume scenariosProduction scenariosHigh-volume/advanced scenarios
Included storage10 GiB100 GiB500 GiB
Geo-replicationNoNoYes
Private endpointsNoNoYes
Content trustNoNoYes
Customer-managed keysNoNoYes
Dedicated Tasks agent poolsNoNoYes
Higher throughput/concurrencyLowerMediumHigher

All three tiers provide core registry capabilities, while Premium adds advanced capabilities and higher limits.

Important Exam Distinction

If the requirement is:

“Replicate a registry across multiple Azure regions.”

Think:

Premium ACR

Geo-replication is a Premium feature.


18. Geo-Replication

Geo-replication allows an ACR to replicate its content across multiple Azure regions.

For example:

                 Azure Container Registry
                          |
             +------------+------------+
             |                         |
             v                         v
         East US                  West Europe
        Geo-replica               Geo-replica
             |                         |
             v                         v
          AKS US                  AKS Europe

When an image is pushed to the geo-replicated registry, its content is synchronized to the configured replicas.

The advantage is that applications can access images from regions closer to where they run.

Microsoft describes geo-replication as providing a single registry management experience while synchronizing content across selected regions.

Don’t confuse:

Availability zones and geo-replication.

Availability zones provide resilience across zones within a region.

Geo-replication distributes registry content across different Azure regions.

Current Microsoft documentation states that zone redundancy is enabled by default for ACR registries in supported regions across Basic, Standard, and Premium tiers.


19. Managing Images and Repositories

You can manage repositories and images through:

  • Azure portal
  • Azure CLI
  • REST APIs
  • SDKs
  • Docker/OCI tooling

For example, you can list repositories:

az acr repository list \
--name contosoregistry \
--output table

List tags:

az acr repository show-tags \
--name contosoregistry \
--repository customer-api \
--output table

You can also inspect manifests and image metadata.

The Azure portal exposes repositories and their image tags through the registry’s Repositories interface.


20. Deleting Images

Suppose a repository contains:

customer-api:v1
customer-api:v2
customer-api:v3

You can remove an image tag using Azure CLI.

For example:

az acr repository untag \
--name contosoregistry \
--image customer-api:v1

However, remember an important distinction:

Untagging an image does not necessarily immediately remove the underlying image data.

The manifest may become untagged while its layers continue consuming storage.

Microsoft specifically warns about the accumulation of untagged artifacts when images are repeatedly pushed using the same tags.


21. Retention of Untagged Manifests

ACR supports a retention policy for untagged manifests.

The purpose is to automatically remove untagged manifests after a configured period.

For example:

Image:v1
Image:v2
Image:v3

If v2 is removed:

Image:v2 → untagged manifest

A retention policy can eventually remove the untagged manifest.

The current Microsoft documentation identifies the untagged-manifest retention policy as a Premium feature and currently documents it as a preview feature. The policy can be configured for a retention period from 0 through 365 days.

Important Warning

If an application relies on pulling an image by its digest, automatically deleting untagged manifests can make that image unavailable.

This is an important operational consideration and a potential exam scenario.


22. Image Tagging Best Practices

A strong production tagging strategy should make image identification predictable.

A useful approach is to use multiple tags for different purposes.

For example:

customer-api:v2.4.1
customer-api:build-1847
customer-api:a81f42c

You might also maintain:

customer-api:production

as a deployment-oriented alias.

However, don’t rely on a mutable tag such as production or latest when you require immutable deployment behavior.

A good pattern is:

Human-readable release
+
Unique build identifier
+
Optional environment alias

For example:

customer-api:v2.4.1
customer-api:build-1847
customer-api:production

The production deployment can ultimately be pinned to a specific immutable image reference/digest.


23. Common ACR Mistakes

Mistake 1: Using latest for production deployments

latest can change.

Better: use unique version tags and/or digests.


Mistake 2: Assuming deleting a tag deletes the image immediately

An untagged manifest may continue consuming storage.

Better: understand manifests, layers, untagging, deletion, and retention.


Mistake 3: Giving every workload push permissions

An application that only needs to run an image generally doesn’t need permission to push images.

Better: follow least privilege.

For example:

Application → AcrPull
Build pipeline → AcrPush

Mistake 4: Storing registry passwords in application code

This creates unnecessary credential-management risks.

Better: use managed identities or another appropriate identity mechanism.


Mistake 5: Choosing Premium solely because it sounds better

Premium should be selected because its capabilities are required.

Examples include:

  • Geo-replication
  • Private endpoints
  • Content trust
  • Higher throughput
  • Advanced networking
  • Dedicated Tasks agent pools

Mistake 6: Confusing ACR with ACR Tasks

They are related but different concepts.

ACR:

Stores and manages container images.

ACR Tasks:

Builds, tests, and automates container image workflows.

A single ACR resource can therefore be used to store images while ACR Tasks provides the automation to build those images.


24. Important AI-200 Concepts to Know

For this exam objective, make sure you can explain the following without referring to documentation:

ConceptWhat you should know
Azure Container RegistryManaged private container registry
RegistryTop-level ACR resource
RepositoryCollection of related images/artifacts
TagHuman-readable image/version reference
DigestContent-addressed image reference
ManifestDescribes image/artifact and its layers
LayerComponent of a container image
az acr loginAuthenticates a client to ACR
docker pushUploads an image to ACR
docker pullDownloads an image from ACR
az acr buildBuilds an image using ACR Tasks
ACR TasksCloud-based image build/test automation
Multi-step taskBuild/test/push workflows using YAML
AcrPullPull permission for applicable non-ABAC registry scenarios
AcrPushPush/pull permission for applicable non-ABAC registry scenarios
Managed identityCredential-free Azure resource authentication
BasicEntry-level ACR tier
StandardHigher capacity production-oriented tier
PremiumAdvanced capabilities such as geo-replication/private endpoints
Geo-replicationReplicate registry content across regions
Retention policyAutomatically remove eligible untagged manifests

25. AI-200 Scenario Patterns to Recognize

The exam is likely to test your ability to choose the appropriate Azure capability based on a scenario.

Scenario: Build without Docker locally

Requirement: Developers don’t have Docker installed.

Answer: ACR Tasks / az acr build.


Scenario: Automatically rebuild after a Git commit

Requirement: Every source-code commit should trigger an image build.

Answer: ACR Task with a source-code trigger.


Scenario: Rebuild after base image updates

Requirement: Automatically rebuild application images when their base image changes.

Answer: ACR Tasks base-image trigger.


Scenario: Run the same image in several Azure regions

Requirement: Applications in multiple regions should access registry content efficiently.

Answer: ACR Premium with geo-replication.


Scenario: Application only needs to pull images

Requirement: A workload should retrieve images but shouldn’t be able to modify them.

Answer: Grant an appropriate pull-only role, such as AcrPull where applicable, or the appropriate repository reader role for an ABAC-enabled registry.


Scenario: Avoid credentials in application configuration

Requirement: An Azure-hosted application needs to access ACR without storing passwords.

Answer: Managed identity + appropriate registry permissions.


Scenario: Guarantee a specific image

Requirement: A deployment must always retrieve exactly the same image content.

Answer: Use an image digest rather than relying solely on a mutable tag.


26. Quick Review

The following mental model is useful for the exam:

                    AZURE CONTAINER REGISTRY
                             |
             +---------------+---------------+
             |                               |
        Repositories                    ACR Tasks
             |                               |
      +------+------+                  Build/Test/Push
      |             |
   Image          Image
      |             |
    Tags          Tags
      |             |
   Manifest      Manifest
      |
    Layers

And remember the major distinction:

ACR
Store/manage images
ACR Tasks
Build/test/automate images

For production deployments:

Avoid:
:latest
Prefer:
:v2.4.1
:build-1847
@sha256:<digest>

For authentication:

Azure workload
|
| Managed Identity
v
ACR
|
| Appropriate least-privilege role
v
Pull image

For global deployments:

ACR Premium
|
+---- Region 1
|
+---- Region 2
|
+---- Region 3

Practice Exam Questions

Question 1

A development team has a Dockerfile and wants to build a container image directly in Azure. Developers should not need Docker installed on their local computers. The resulting image should be pushed to Azure Container Registry.

Which Azure capability should you use?

A. Azure Container Registry Tasks

B. Azure App Service deployment slots

C. Azure Container Apps revisions

D. Azure Kubernetes Service Jobs

Answer: A

Explanation: Azure Container Registry Tasks can build container images in Azure using a Dockerfile. The az acr build command provides an on-demand build capability and can push the resulting image to ACR. A local Docker installation isn’t required for this workflow.


Question 2

An application image is stored as:

contosoregistry.azurecr.io/orders:v4

What does v4 represent?

A. The registry name

B. The image tag

C. The image digest

D. The repository namespace

Answer: B

Explanation: In an image reference such as:

registry/repository:tag

the portion after the colon is the tag. Therefore, v4 is the image tag. Tags are commonly used to identify image versions.


Question 3

A production application must always retrieve exactly the same container image content. Developers are concerned that a tag could later be reassigned to a different image.

Which image reference should the application use?

A. :latest

B. :production

C. :stable

D. @sha256:<digest>

Answer: D

Explanation: Tags can be moved to different image versions. A digest is a content-addressed identifier and can be used to pull a specific image version. Microsoft specifically identifies digest-based pulls as a way to guarantee the image version being retrieved.


Question 4

An organization deploys applications to Azure regions in North America and Europe. The organization wants container images to be replicated to both regions while maintaining a single ACR management experience.

Which ACR capability should be used?

A. Repository namespaces

B. Availability zones

C. Geo-replication

D. Image tags

Answer: C

Explanation: ACR geo-replication synchronizes registry content across selected Azure regions while allowing the organization to manage the registry as a single logical registry. Geo-replication is a Premium ACR capability.


Question 5

An AKS workload needs to pull private container images from ACR. The organization does not want to store registry passwords in Kubernetes configuration.

Which approach is most appropriate?

A. Use a managed identity with appropriate ACR permissions

B. Store the ACR administrator password in the container image

C. Make the repository publicly accessible

D. Embed an ACR password in the application source code

Answer: A

Explanation: Azure resources can use managed identities to authenticate to ACR without storing credentials in application code or configuration. The identity must be granted the appropriate pull permissions.


Question 6

A development team wants an automated container workflow that performs the following:

  1. Builds an application image.
  2. Runs a test container.
  3. Builds another image.
  4. Pushes the resulting images.

Which ACR capability should the team use?

A. ACR repository namespaces

B. ACR multi-step Tasks

C. ACR geo-replication

D. ACR anonymous pull

Answer: B

Explanation: ACR Tasks supports multi-step workflows using YAML. The workflow can build, run/test, and push one or more images. The available step types include build, push, and cmd.


Question 7

An organization repeatedly pushes new builds using the same image tag. After several months, the registry contains significant amounts of storage that cannot be explained by the currently tagged images.

What is the most likely explanation?

A. ACR automatically creates a new repository for every push

B. Geo-replication is duplicating every image within the same region

C. Previous manifests became untagged while their image data remained in the registry

D. ACR stores every Dockerfile indefinitely

Answer: C

Explanation: Repeatedly pushing modified images using the same tag can result in previous manifests becoming untagged. Their layers can continue consuming registry storage until the underlying content is deleted.


Question 8

A company needs to automatically rebuild its application container whenever a new version of the application’s base container image becomes available.

Which capability should be configured?

A. Azure App Service deployment slots

B. ACR geo-replication

C. ACR repository tagging

D. An ACR Task with a base-image update trigger

Answer: D

Explanation: ACR Tasks can automatically trigger builds when a base image is updated. This is useful for rebuilding application images when their underlying base images change.


Question 9

An organization requires private connectivity to its Azure Container Registry through Azure Private Link. Which ACR pricing tier supports this capability?

A. Premium

B. Basic

C. Standard

D. All three tiers

Answer: A

Explanation: Azure Container Registry Premium supports private endpoints through Private Link. Basic and Standard do not provide this capability according to the current ACR SKU documentation.


Question 10

An administrator removes the v1 tag from an image in an ACR repository. The administrator assumes that the underlying image data has immediately been removed from the registry.

Which statement is correct?

A. Removing a tag always immediately deletes every associated layer

B. Removing a tag converts the image automatically into a public image

C. Removing a tag deletes the entire repository

D. The manifest can become untagged while its data continues consuming storage

Answer: D

Explanation: Removing a tag can leave the manifest untagged while its associated data remains in the registry. Untagged artifacts can continue consuming storage until they are deleted. ACR provides mechanisms such as retention policies for eligible untagged manifests.


Final AI-200 Takeaways

For this particular AI-200 objective, concentrate on these distinctions:

Azure Container Registry

Store and manage container images and artifacts.

ACR repository

Organizes related images.

Tag

Human-readable version/reference that can be reassigned.

Digest

Content-addressed identifier for a specific image version.

Manifest

Describes the image/artifact and its layers.

ACR Tasks

Build, test, and automate container image workflows.

az acr build

Perform an on-demand cloud-based container build.

Multi-step ACR Task

Build/test/push multiple images or perform multi-stage workflows.

Managed identity

Authenticate Azure workloads to ACR without managing passwords.

AcrPull

Pull permission for applicable non-ABAC registry scenarios.

AcrPush

Push/pull permission for applicable non-ABAC registry scenarios.

Premium

Required for capabilities such as geo-replication and private endpoints.

Geo-replication

Replicate registry content across Azure regions.

Retention

Help clean up eligible untagged manifests.

The most important exam mindset is to distinguish where the image is stored, how it is identified, how it is built, and how the workload is authorized to retrieve it. Those four dimensions—registry/repository, tag/digest, ACR Tasks, and authentication/RBAC—cover a large portion of the practical knowledge behind this objective.


Go to the AI-200 Exam Prep Hub main page