AZ-104 Deploy and Manage Azure Compute Practice Question
This AZ-104 practice question tests your understanding of deploy and manage azure compute. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: managed identities provide an Azure AD identity for Azure resources.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Exhibit
Template excerpt:
```
resources:
- type: Microsoft.ContainerInstance/containerGroups
name: cg-transform
properties:
containers:
- name: transform
properties:
image: contoso.azurecr.io/transform:3.0
imageRegistryCredentials: []
```
Requirement: the image is stored in Azure Container Registry and no username, password, or connection string may be embedded in the deployment
Based on the exhibit, what should the administrator configure so the container group can pull the private image without storing registry credentials?
Exhibit
Template excerpt:
```
resources:
- type: Microsoft.ContainerInstance/containerGroups
name: cg-transform
properties:
containers:
- name: transform
properties:
image: contoso.azurecr.io/transform:3.0
imageRegistryCredentials: []
```
Requirement: the image is stored in Azure Container Registry and no username, password, or connection string may be embedded in the deployment
A
Assign a managed identity to the container group and grant it AcrPull on the registry.
Managed identity-based access is the correct secret-free method for Azure Container Instances to authenticate to Azure Container Registry. By assigning an identity to the container group and granting that identity the AcrPull role on the registry, the group can pull the private image without storing credentials in the template. This satisfies both security and operational requirements.
B
Store the ACR admin account password in a container environment variable.
Why wrong: Embedding a password in configuration violates the requirement to avoid stored credentials.
C
Use a SAS token for the container image reference.
Why wrong: SAS tokens are not the normal authentication method for pulling private container images from ACR.
D
Place the registry in the same resource group as the container group.
Why wrong: Resource group placement does not authorize access to a private registry.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign a managed identity to the container group and grant it AcrPull on the registry.
Option A is correct because Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.
Key principle: Managed identities provide an Azure AD identity for Azure resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Assign a managed identity to the container group and grant it AcrPull on the registry.
Why this is correct
Managed identity-based access is the correct secret-free method for Azure Container Instances to authenticate to Azure Container Registry. By assigning an identity to the container group and granting that identity the AcrPull role on the registry, the group can pull the private image without storing credentials in the template. This satisfies both security and operational requirements.
Related concept
Managed identities provide an Azure AD identity for Azure resources.
✗
Store the ACR admin account password in a container environment variable.
Why it's wrong here
Embedding a password in configuration violates the requirement to avoid stored credentials.
When this WOULD be correct
This option would be correct if the question asked for a simple way to authenticate to ACR for testing purposes, without requiring managed identities or key vault, and security concerns were not a factor.
✗
Use a SAS token for the container image reference.
Why it's wrong here
SAS tokens are not the normal authentication method for pulling private container images from ACR.
When this WOULD be correct
If the question were about accessing a private container image stored in Azure Blob Storage (e.g., using a custom container runtime), a SAS token on the image reference would provide temporary access without storing credentials.
✗
Place the registry in the same resource group as the container group.
Why it's wrong here
Resource group placement does not authorize access to a private registry.
When this WOULD be correct
If the question asked about minimizing cross-resource group costs or simplifying resource management, placing resources in the same resource group could be correct. For example, 'What should an administrator do to reduce network egress costs between a container registry and a container group?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Assign a managed identity to the container group and grant it AcrPull on the registry.Correct answer▾
Why this is correct
Managed identity-based access is the correct secret-free method for Azure Container Instances to authenticate to Azure Container Registry. By assigning an identity to the container group and granting that identity the AcrPull role on the registry, the group can pull the private image without storing credentials in the template. This satisfies both security and operational requirements.
✗Store the ACR admin account password in a container environment variable.Wrong answer — click to see why▾
Why this is wrong here
Storing the ACR admin account password in a container environment variable exposes credentials in plain text, which violates security best practices and does not meet the requirement of 'without storing registry credentials.'
★ When this WOULD be the correct answer
This option would be correct if the question asked for a simple way to authenticate to ACR for testing purposes, without requiring managed identities or key vault, and security concerns were not a factor.
Why candidates choose this
Candidates may think environment variables are a secure way to pass secrets, or they may be unaware of managed identity as a more secure alternative for Azure resources.
✗Use a SAS token for the container image reference.Wrong answer — click to see why▾
Why this is wrong here
A SAS token is used for granting time-limited access to Azure Storage resources, not for authenticating to Azure Container Registry. Container groups pull images using registry credentials, not SAS tokens.
★ When this WOULD be the correct answer
If the question were about accessing a private container image stored in Azure Blob Storage (e.g., using a custom container runtime), a SAS token on the image reference would provide temporary access without storing credentials.
Why candidates choose this
Candidates may confuse SAS tokens with other access methods, thinking they can be used for any Azure resource, or they may recall that SAS tokens are used for secure access without credentials in storage scenarios.
✗Place the registry in the same resource group as the container group.Wrong answer — click to see why▾
Why this is wrong here
Placing the registry in the same resource group as the container group does not grant any authentication permissions; the container group still needs credentials to pull a private image.
★ When this WOULD be the correct answer
If the question asked about minimizing cross-resource group costs or simplifying resource management, placing resources in the same resource group could be correct. For example, 'What should an administrator do to reduce network egress costs between a container registry and a container group?'
Why candidates choose this
Candidates may mistakenly believe that same resource group implies automatic access or trust, confusing resource group scope with actual authentication mechanisms.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse SAS tokens (used for Azure Storage) with ACR authentication, or assume that resource group placement or admin credentials are valid solutions, when the core requirement is to use Azure AD-based authentication via a managed identity to avoid storing any credentials.
Detailed technical explanation
How to think about this question
Under the hood, when a managed identity is assigned to a container group, Azure automatically provisions a service principal in Azure AD and injects an access token into the container's environment via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254. The container runtime (e.g., containerd) uses this token to authenticate to ACR via the OAuth2 token exchange flow, which is defined in RFC 6749. In a real-world scenario, this approach is critical for production workloads where rotating admin keys or storing secrets in environment variables is impractical and insecure.
KKey Concepts to Remember
Managed identities provide an Azure AD identity for Azure resources.
They eliminate the need to store credentials in code or configuration.
The 'AcrPull' role grants read-only access to pull images from Azure Container Registry.
Azure Container Instances can use managed identities to authenticate to ACR.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Managed identities provide an Azure AD identity for Azure resources.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this AZ-104 question in full detail.
Review managed identities provide an Azure AD identity for Azure resources., then practise related AZ-104 questions on the same topic to reinforce the concept.
Deploy and Manage Azure Compute — This question tests Deploy and Manage Azure Compute — Managed identities provide an Azure AD identity for Azure resources..
What is the correct answer to this question?
The correct answer is: Assign a managed identity to the container group and grant it AcrPull on the registry. — Option A is correct because Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.
What should I do if I get this AZ-104 question wrong?
Review managed identities provide an Azure AD identity for Azure resources., then practise related AZ-104 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
Managed identities provide an Azure AD identity for Azure resources.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.