nerdexam
Microsoft

AZ-500 · Question #628

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might…

The correct answer is A. Yes. Assigning the AcrPull role to the system-assigned managed identity of the AKS cluster grants it the necessary permissions to pull container images from the specified Azure Container Registry. This meets the requirement for AKS to deploy images stored in AZCR1.

Submitted by priya_blr· Mar 6, 2026Secure compute, storage, and databases

Question

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1 and an Azure container registry named AZCR1. You need to ensure that AKS1 can deploy container images stored in AZCR1. Solution: You assign the AcrPull role-based access control (RBAC) role to the system-assigned managed identity of AKS1. Does this meet the requirement?

Options

  • AYes
  • BNo

How the community answered

(50 responses)
  • A
    82% (41)
  • B
    18% (9)

Why each option

Assigning the AcrPull role to the system-assigned managed identity of the AKS cluster grants it the necessary permissions to pull container images from the specified Azure Container Registry. This meets the requirement for AKS to deploy images stored in AZCR1.

AYesCorrect

The AcrPull RBAC role provides read-only access to pull container images and artifacts from an Azure Container Registry. By assigning this role to the system-assigned managed identity of AKS1, the cluster gains the necessary permissions to authenticate with AZCR1 and retrieve container images for deployment. This is the standard and recommended method for AKS clusters to securely access images from ACR.

BNo

The solution correctly assigns the AcrPull role, which provides the required data-access permissions for AKS to pull images from an Azure Container Registry.

Concept tested: AKS image pull permissions from ACR

Source: https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli

Topics

#AKS#Azure Container Registry#managed identity#container security

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice