AZ-204 Develop Azure compute solutions Practice Question
You are developing a solution that uses Azure Container Registry (ACR) to store Docker images. You need to ensure that only authorized users can deploy images from ACR to an AKS cluster. What should you do?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the AKS cluster's managed identity with AcrPull role assignment.
Using an AKS cluster's managed identity with the AcrPull role assignment enables secure, password-less authentication to ACR. Option A is incorrect because AKS RBAC controls Kubernetes resources, not ACR permissions. Option B is incorrect because storing ACR credentials as Kubernetes secrets is less secure and requires manual management. Option D is incorrect because enabling the admin account on ACR is a shared credential approach that is not recommended for production.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure AKS RBAC to limit image pull permissions.
Why it's wrong here
AKS RBAC controls Kubernetes resources, not ACR.
- ✗
Use Kubernetes secrets to store ACR credentials.
Why it's wrong here
Kubernetes secrets require manual rotation.
- ✓
Use the AKS cluster's managed identity with AcrPull role assignment.
Why this is correct
Managed identity provides secure access without secrets.
- ✗
Enable the admin account on ACR and use the credentials in AKS.
Why it's wrong here
Admin account is not recommended for security.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.