nerdexam
Microsoft

AZ-500 · Question #627

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is B. No. The provided solution of assigning the Kubernetes Agentless Operator role to the AKS agent pool's managed identity does not grant the necessary permissions for AKS to pull images from Azure Container Registry. This role is intended for security scanning and does not include…

Submitted by zhang_li· Mar 6, 2026Secure compute, storage, and databases

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1 and an Azure container registry named AZCR1. You need to ensure that AKS1 can deploy container images stored in AZCR1. Solution: You assign the Kubernetes Agentless Operator role to the system-assigned managed identity of the agent pool for AKS1. Does this meet the requirement?

Options

  • AYes
  • BNo

How the community answered

(20 responses)
  • A
    15% (3)
  • B
    85% (17)

Why each option

The provided solution of assigning the Kubernetes Agentless Operator role to the AKS agent pool's managed identity does not grant the necessary permissions for AKS to pull images from Azure Container Registry. This role is intended for security scanning and does not include data pull permissions for container registries.

AYes

Assigning the Kubernetes Agentless Operator role to the AKS agent pool's managed identity does not provide the necessary data pull permissions from an Azure Container Registry.

BNoCorrect

The Kubernetes Agentless Operator role is primarily used by Azure Defender for Cloud for agentless vulnerability scanning of Kubernetes clusters and does not include permissions to pull container images from an Azure Container Registry. To deploy images from an Azure Container Registry, the AKS cluster's managed identity requires a data-access role like AcrPull on the registry.

Concept tested: AKS image pull permissions from ACR

Source: https://learn.microsoft.com/en-us/azure/defender-for-cloud/permissions-roles#kubernetes-agentless-operator

Topics

#AKS#Azure Container Registry#managed identity#container security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice