AZ-204 Develop Azure compute solutions Practice Question
A Kubernetes-based IoT command API on AKS must pull images from Azure Container Registry without storing registry passwords in Kubernetes secrets. What should be used?
⚠ Common exam trap
Watch out — candidates often confuse AKS authentication with App Service features or assume that making the registry public is acceptable for development, when in fact Azure AD managed identity with AcrPull is the secure, recommended approach for production workloads.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach the ACR to AKS or grant the kubelet managed identity AcrPull
Attaching an ACR to an AKS cluster or granting the kubelet managed identity the AcrPull role enables Azure AD-based authentication without storing credentials in Kubernetes secrets. The kubelet on each node uses its managed identity to obtain an ACR access token via Azure AD, allowing secure image pulls. This approach eliminates the need for manual password management and follows security best practices for Azure-integrated workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an App Service deployment slot
Why it's wrong here
Using an App Service deployment slot is entirely irrelevant to authenticating an Azure Kubernetes Service (AKS) cluster with an Azure Container Registry (ACR). App Service is a Platform-as-a-Service offering for hosting web applications, and its deployment slots are features for managing different versions of those web apps. AKS, being a container orchestrator, operates on a fundamentally different infrastructure model and uses distinct mechanisms for pulling container images, completely separate from App Service functionalities.
- ✗
Store the ACR admin password in every deployment manifest
Why it's wrong here
Storing the Azure Container Registry (ACR) admin password directly within every Kubernetes deployment manifest, even if encoded, is a severe security vulnerability and a significant anti-pattern. This practice grants highly privileged access to the entire registry and exposes sensitive credentials to anyone with access to the cluster's configuration or etcd. It violates the principle of least privilege and secure credential management, making the system susceptible to unauthorized image pulls, pushes, or even registry deletion.
- ✓
Attach the ACR to AKS or grant the kubelet managed identity AcrPull
Why this is correct
Attaching the Azure Container Registry (ACR) to an Azure Kubernetes Service (AKS) cluster, or explicitly granting the kubelet's managed identity the AcrPull role, is the recommended and most secure method for image authentication. This approach leverages Azure's native identity and access management, allowing the AKS cluster's nodes (via their managed identity) to securely pull images from the private ACR without requiring explicit credentials in Kubernetes manifests. It adheres to the principle of least privilege, providing only the necessary read access.
- ✗
Make the container registry public
Why it's wrong here
Making the container registry public would indeed allow AKS to pull images without authentication, but it introduces a critical security flaw by exposing all stored container images to the entire internet. This approach completely negates the purpose of a private registry and is unacceptable for any production environment containing proprietary or sensitive software. Public exposure bypasses all security controls, making the images vulnerable to unauthorized access, analysis, or intellectual property theft.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.