AZ-204 Develop Azure compute solutions Practice Question
You are deploying a containerized application to Azure Container Instances. The container image is stored in a private Azure Container Registry (ACR). You need to ensure that ACI can pull the image without storing credentials in the container group definition. What should you use?
⚠ Common exam trap
Many candidates confuse SAS tokens (which are for Azure Storage) with ACR authentication, or they assume that a service principal is acceptable even though it requires embedding credentials, missing the managed identity option that eliminates credential storage entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable managed identity for the container group and assign the AcrPull role.
Enabling a managed identity for the container group and assigning the AcrPull role allows Azure Container Instances to authenticate to Azure Container Registry using Azure AD without storing any credentials in the container group definition. The managed identity is automatically authenticated by Azure, and ACR supports token exchange via Azure AD, so ACI can pull the image securely without embedding secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable managed identity for the container group and assign the AcrPull role.
Why this is correct
Enabling a managed identity for the Azure Container Instance (ACI) container group provides an Azure Active Directory identity that the ACI can use to authenticate. By assigning the AcrPull role to this managed identity on the Azure Container Registry (ACR), ACI can securely pull images without requiring any explicit credentials to be stored or managed within the container group definition. This eliminates the risk of credential exposure and simplifies credential rotation, adhering to the principle of least privilege.
- ✗
Generate a SAS token for the ACR and use it in the image registry credential.
Why it's wrong here
Azure Container Registry (ACR) does not support Shared Access Signature (SAS) tokens as an authentication mechanism for pulling container images into Azure Container Instances (ACI). While SAS tokens are commonly used for granular access to other Azure storage services, they are not a valid credential type for authenticating ACI with ACR. Therefore, attempting to use a SAS token would result in an authentication failure when ACI tries to retrieve the image.
- ✗
Create a service principal with AcrPull role and pass its credentials.
Why it's wrong here
While a service principal with the AcrPull role can be used to authenticate with Azure Container Registry, its credentials (client ID and client secret) must be explicitly provided and stored within the Azure Container Instance (ACI) container group definition. This approach requires manual management of these sensitive credentials, increasing the risk of exposure if not handled carefully. Unlike managed identities, service principals do not inherently abstract away credential management, making it a less secure and more complex option.
- ✗
Use the ACR admin account and provide the credentials in the container group.
Why it's wrong here
Using the Azure Container Registry (ACR) admin account directly exposes highly privileged credentials within the container group configuration, which is a significant security vulnerability. The admin account grants full administrative access to the registry, far exceeding the 'pull' permissions needed by a container group. This practice violates the principle of least privilege and makes credential rotation more complex, as any compromise could lead to unauthorized access to the entire registry.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.