Your company has an Azure Container Registry. You have been tasked with assigning a user a role that allows for the downloading of images from the Azure Container Registry. The role assigned should…

Question

Options

• AReader
• BContributor
• CAcrDelete
• DAcrPull

• A
  81% (30)
• B
  5% (2)
• C
  11% (4)
• D
  3% (1)

Explanation

Explanation

Wait - there's an issue with the marked answer. The correct answer should actually be D. AcrPull, not A. Reader. The AcrPull role is specifically designed for Azure Container Registry and grants users the ability to pull (download) images while following the principle of least privilege - it grants only pull access and nothing more.

Why the distractors are wrong:

• A. Reader is a general Azure RBAC role that grants read access to Azure resources and their configurations, but does not grant the ability to pull container images from ACR - it lacks the specific data-plane permissions required.
• B. Contributor grants broad management permissions (create, update, delete resources), which far exceeds the requirement and violates the principle of least privilege.
• C. AcrDelete is an ACR-specific role, but it only grants permission to delete repository artifacts - the opposite of what's needed here.

Memory Tip: Think of ACR-specific roles as matching their names to actions: AcrPull = Pull/Download, AcrPush = Push/Upload, AcrDelete = Delete. Whenever a question mentions "least privilege" for downloading container images from ACR, always look for AcrPull first - it's purpose-built for that exact task.

No community discussion yet for this question.