You have an Azure Kubernetes Service (AKS) cluster that will connect to an Azure Container Registry. You need to use automatically generated service principal for the AKS cluster to authenticate to…

Question

Options

• Aa secret in Azure Key Vault
• Ba role assignment
• Can Azure Active Directory (Azure AD) user
• Dan Azure Active Directory (Azure AD) group

• A
  3% (1)
• B
  76% (26)
• C
  6% (2)
• D
  15% (5)

Explanation

Explanation

Creating a role assignment grants the AKS cluster's automatically generated service principal the necessary permissions (specifically the AcrPull role) on the Azure Container Registry, allowing it to authenticate and pull images without storing any credentials manually. This is the recommended, secure approach using Azure Role-Based Access Control (RBAC) to connect AKS to ACR.

• Option A (Key Vault secret) is incorrect because storing credentials in Key Vault is used for manual secret management, not for granting a service principal direct access to ACR through identity-based authentication.
• Option C (Azure AD user) is incorrect because AKS uses a service principal (or managed identity), not a user account, for service-to-service authentication.
• Option D (Azure AD group) is incorrect because groups are used to manage collections of users or principals, not to directly grant an AKS service principal access to a registry.

Memory Tip: Think "Role Assignment = Permission Grant." Whenever you need one Azure service to access another using a service principal or managed identity, the answer almost always involves creating a role assignment - it's the RBAC "bridge" between services in Azure.

No community discussion yet for this question.