Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
A company uses Azure DevOps to deploy microservices to Azure Kubernetes Service (AKS). They need to securely pull container images from Azure Container Registry (ACR) during deployment without storing credentials. Which authentication method should they use?
⚠ Common exam trap
A common mix-up: candidates confuse ACR admin keys (which are simple to enable) with a secure solution, but the question explicitly requires 'without storing credentials,' making managed identity the only option that avoids any secret storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Managed Identity
Managed Identity allows AKS to authenticate to ACR without storing any credentials in Azure DevOps or Kubernetes secrets. By enabling the AKS cluster's system-assigned or user-assigned managed identity with AcrPull role assignment, Azure AD automatically handles token acquisition via the Azure Instance Metadata Service (IMDS) endpoint, eliminating the need for static secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ACR Tasks
Why it's wrong here
ACR Tasks are primarily designed for automating container image builds, OS and framework patching, and running multi-step tasks directly within Azure Container Registry. They function as a serverless compute primitive for image lifecycle management, not as an authentication mechanism for external services like Azure Kubernetes Service (AKS) to pull images during deployment. Therefore, using ACR Tasks would not facilitate AKS authenticating to ACR to retrieve application images for deployment.
- ✗
ACR admin keys
Why it's wrong here
ACR admin keys provide full, unrestricted administrative access to the entire Azure Container Registry, bypassing granular access controls. These static credentials are not designed for production deployments due to their inability to be scoped to specific permissions or resources, making them highly insecure. Their use violates the principle of least privilege and creates a significant security vulnerability because they are shared, unmanaged, and difficult to revoke without broad impact.
- ✓
Managed Identity
Why this is correct
Managed Identities provide an Azure Active Directory identity for Azure services, eliminating the need for developers to manage credentials. By assigning a system-assigned or user-assigned managed identity to the AKS cluster and granting it the `AcrPull` role on the Azure Container Registry, AKS can securely authenticate to ACR using Azure AD tokens. This method adheres to the principle of least privilege and significantly enhances security by removing the need to store, rotate, or expose any secrets.
- ✗
Service principal with password
Why it's wrong here
While a service principal can be configured with the `AcrPull` role to grant access to Azure Container Registry, using a password (client secret) for authentication introduces significant operational overhead and security risks. This approach necessitates securely storing the client secret, implementing a robust rotation policy, and managing its lifecycle, which is prone to errors and credential leakage. This is less secure and more complex compared to the automated, secret-less authentication provided by managed identities.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.