Practice Test 3 | Designing And Implementing Microsoft DevOps Solutions | AZ-400 | Dumps | Mock Test

Answer – D

To provide access for the Azure Kubernetes cluster to the Azure Container registry, we have two options:

• Managed Identity
• Service Principal

In the above scenario, we can use Service Principal. This is also mentioned in the Microsoft documentation.

Option A is incorrect because with Azure AD add user feature you can create accounts for users, with this we can assign users access to different Azure services. This is not going to allow AKS to access ACR.

Option B is incorrect because Azure AD groups are used to create group users. Now the permissions can be assigned to user groups rather than to individual users. Similar to users, the user group is not going to allow AKS to access ACR (Azure Container Registry).

Option C is incorrect because Azure Automation Account is used for delivering cloud-based automation, operating system updates, and configuration service that supports consistent management across your Azure and non-Azure environments. As the scope is for automating the process, this can not be used for allowing AKS to access ACR.

Option D is CORRECT because Azure Service Principal is the local representation of an application object in a single tenant or directory, ‎it functions as the identity of the application instance. We can use this identity for AKS, and then this identity can be given permission to access ACR. This way we can satisfy the requirement mentioned in the question.

For more information on providing access for Azure Kubernetes to the Azure Container Registry, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/cluster-container-registry-integration
• https://docs.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli