You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ConReg1. You enable content trust for ContReg1. You need to ensure that User1 can create trusted…

The correct answer is C. AcrPush D. AcrImageSigner. Explanation To create trusted images in Azure Container Registry with Content Trust enabled, a user needs two distinct capabilities: the ability to push images to the registry and the ability to sign those images digitally. AcrPush (C) grants the permission to push container…

Submitted by wei.xz· Mar 6, 2026Secure identity and access

Question

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ConReg1. You enable content trust for ContReg1. You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege. Which two roles should you assign to User1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Options

AAcrQuarantineReader
BContributor
CAcrPush
DAcrImageSigner
EAcrQuarantineWriter

How the community answered

(26 responses)

A
8% (2)
B
4% (1)
C
73% (19)
E
15% (4)

Explanation

To create trusted images in Azure Container Registry with Content Trust enabled, a user needs two distinct capabilities: the ability to push images to the registry and the ability to sign those images digitally. AcrPush (C) grants the permission to push container images to the registry, while AcrImageSigner (D) specifically grants the permission to sign images, which is required when content trust is enabled - together, these two roles fulfill the requirement with least privilege.

The distractors are wrong for these reasons: AcrQuarantineReader (A) and AcrQuarantineWriter (E) are related to quarantine policies for scanning images, not content trust or image signing. Contributor (B) would technically work but grants far broader permissions across the subscription, violating the principle of least privilege.

Memory Tip: Think of it as a two-step process - you must "Push then Sign" (C + D). If you can't push, you have no image; if you can't sign, you can't make it trusted. The role names literally tell you what they do: AcrPush = upload, AcrImageSigner = sign. Avoid "Contributor" on exams whenever least privilege is mentioned - it's almost always a trap.

Topics

#Azure Container Registry (ACR)#Content Trust#Role-Based Access Control (RBAC)#Least Privilege

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice