AZ-204 Develop Azure compute solutions Practice Question
A Kubernetes-based image resize worker on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?
⚠ Common exam trap
Many candidates think storing credentials in Kubernetes secrets (option A) is acceptable, but the question explicitly forbids that, and they might overlook the managed identity integration as the secure, password-less alternative.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the ACR to AKS or grant the kubelet managed identity AcrPull
Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role eliminates the need to store registry passwords in Kubernetes secrets. This leverages Microsoft Entra ID managed identities for secure, password-less authentication, where the AKS cluster's kubelet uses its managed identity to authenticate with ACR via Azure Resource Manager tokens. The AcrPull role assignment authorizes the identity to pull images, ensuring credentials are never exposed in manifests or secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the ACR admin password in every deployment manifest
Why it's wrong here
Embedding the ACR admin password in manifests stores a registry password in Kubernetes configuration, directly violating the stated requirement. Admin credentials are tempting because they grant push and pull access immediately, but the scenario demands credential-free pulls, which a kubelet-managed identity satisfies instead.
- ✓
Attach the ACR to AKS or grant the kubelet managed identity AcrPull
Why this is correct
Attaching the registry to AKS, or granting the kubelet managed identity the AcrPull role, lets nodes authenticate to Azure Container Registry using their Microsoft Entra ID identity. This removes stored registry passwords from Kubernetes secrets, satisfying the credential-free pull constraint.
- ✗
Make the container registry public
Why it's wrong here
Public registry access removes authentication entirely, exposing the image resize worker's images to anonymous pulls and breaching the no-password requirement's security intent. Anonymous access suits open-source base images, yet private ACR repositories should be reached through an identity-based pull mechanism.
- ✗
Use an App Service deployment slot
Why it's wrong here
App Service deployment slots orchestrate web app staging and swaps; they have no relationship to AKS pod image pulls or registry authentication. Slots are tempting when the workload were an App Service web app needing staged releases, but this worker runs as Kubernetes pods on AKS.
Go deeper
Related to this question
Learn chapter
Azure Resource Manager REST API
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
About these practice questions
One of 883 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.