How Do You Restrict ACI Container Group Port 5000 Exposure?
HOTSPOT
You have an Azure Container Instances container group named CGI that has a DNS name of cg1.contoso.com. CG1 has the following configurations:
A Linux container named container1 that serves HTTPS over TCP port 443 and hosts an application named App1
A Linux container named contained that listens on TCP port 5000 and is accessed only by App1
A public IP address
A security review finds that external clients can reach TCP port 5000 by using the public IP address of CG1.
You need to meet the following requirements:
Ensure that the external clients can access container1 only by using TCP port 443.
Ensure that container1 can continue to access contained.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
The exam tests the split between ACI public port publishing and shared localhost networking; the trap is trying to block port 5000 internally when only its public exposure must be removed.
Azure Container Instances publishes only ports declared on the container group's public IP, while containers in the same group can still communicate over localhost. This page establishes that CG1 should expose TCP 443 only and leave TCP 5000 unpublished.
A common mistake is adding a deny rule or disabling container2's port-5000 listener, which either is unnecessary or breaks App1's dependency, instead of removing 5000 from CG1's declared public ports.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
ACI container groups share a network namespace, so container1 can reach the port-5000 container via localhost regardless of whether 5000 is published on the group's public IP. External reachability comes from the container group's declared ports, so configuring CG1's public IP to expose only TCP 443 closes the external path to 5000. The requirement to keep App1 working is satisfied because internal loopback traffic is not filtered by the public port list.Why Other Candidate Answers Are Wrong
Selecting TCP 5000 alongside 443 leaves the exact exposure the review found, even if the application is otherwise secured. Changing the DNS name, IP address type, or container restart policy does not change which ports are published. Adding an NSG deny rule is unnecessary for this public-IP scenario, and disabling the port-5000 listener would break App1's dependency rather than merely hide it from external clients. The correct control is at the container group port declaration.Community Comment Notes
Craigg noted that containers in the same group "share the localhost network interface" and can reach each other on any port via localhost or 127.0.0.1 even when that port is not exposed externally. That comment directly supports leaving TCP 5000 out of CG1's public ports while preserving container1-to-container2 traffic. No other comment disputes the port-publishing model.Official Reference
Exam Strategy
Treat the word external as the key: ACI publishes only ports declared on the container group IP, not every port a container listens on. For hotspot items, deselect or omit TCP 5000 and keep only TCP 443, then confirm the internal dependency uses localhost.
Frequently Asked Questions
Why can container1 still reach port 5000 after TCP 5000 is removed from CG1's public IP?
Containers in the same ACI container group share localhost, so internal traffic to port 5000 does not depend on the group's public port list.
Does ACI need an NSG to hide port 5000 on CG1's public IP?
No. ACI publishes only the ports declared for the container group's public IP, so omitting TCP 5000 removes external reachability without an NSG rule.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →