Your development team builds Docker images in a CI/CD pipeline and needs to store them securely in Azure. Only Azure Kubernetes Service (AKS) and Azure Container Instances (ACI) in the same subscription should be able to pull images without using admin credentials. What is the recommended setup?

Direct Answer (Verified)Reviewed by Sunny (Senior Cloud Engineer)

Correct Answer: Create an Azure Container Registry and assign the 'AcrPull' role to the Managed Identities of AKS and ACI

Azure Container Registry integrates with Azure AD RBAC. Assigning the built-in 'AcrPull' role to the managed identities of AKS (kubelet identity) and ACI allows them to pull images...

📋Part of Microsoft Certified: Azure Developer Associate (AZ-204) · Azure Certification Practice
Real Exam ScenarioAzure Container Registry

Your development team builds Docker images in a CI/CD pipeline and needs to store them securely in Azure. Only Azure Kubernetes Service (AKS) and Azure Container Instances (ACI) in the same subscription should be able to pull images without using admin credentials. What is the recommended setup?

✓ Correct Answer & ExplanationAzure Container Registry

Correct Answer

Create an Azure Container Registry and assign the 'AcrPull' role to the Managed Identities of AKS and ACI

Why This Answer Is Correct

Azure Container Registry integrates with Azure AD RBAC. Assigning the built-in 'AcrPull' role to the managed identities of AKS (kubelet identity) and ACI allows them to pull images without admin credentials, keeping the registry private and eliminating the need to manage or rotate passwords.

📚 What This Question Tests

This question evaluates your knowledge of Azure Container Registry — a core concept tested in Microsoft Certified: Azure Developer Associate (AZ-204). Understanding Azure Container Registry is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.

All Microsoft Certified: Azure Developer Associate (AZ-204) Questions →Browse All Azure Exams →

More Azure Container Registry Practice Questions

Your team builds Docker images in a CI/CD pipeline and needs to store them privately before deployment to Azure Kubernetes Service. The security team requires that only authenticated service principals can pull images, and that old image tags are automatically purged after 30 days to reduce storage costs. Which Azure service and features satisfy both requirements?

← Back to Microsoft Certified: Azure Developer Associate (AZ-204) Full Practice Hub