AZ-500 Exam - Question 20

Question

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

You are in the process of creating an Azure Kubernetes Service (AKS) cluster. The Azure Kubernetes Service (AKS) cluster must be able to connect to an Azure

Container Registry.

You want to make sure that Azure Kubernetes Service (AKS) cluster authenticates to the Azure Container Registry by making use of the auto-generated service principal.

Solution: You create an Azure Active Directory (Azure AD) role assignment.

Does the solution meet the goal?

Examice · Accepted Answer

When setting up an Azure Kubernetes Service (AKS) cluster to authenticate with an Azure Container Registry (ACR), the correct approach involves Azure Role-Based Access Control (RBAC). Specifically, this requires assigning the AcrPull role to allow the cluster's service principal to pull images from the ACR. The proposed solution of creating an Azure Active Directory (Azure AD) role assignment is incorrect since it does not directly handle the necessary permissions for interacting with ACR. Therefore, the solution does not meet the goal.

romaso82 · Answer

correct answer

PKPKPK · Answer

i think its B as it wold need an RBAC role instead AAD role

majstor86 · Answer

B. NO 
Needs an RBAC role

zellck · Answer

B is the answer.

https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli
The Azure Container Registry service supports a set of built-in Azure roles that provide different levels of permissions to an Azure container registry. Use Azure role-based access control (Azure RBAC) to assign specific permissions to users, service principals, or other identities that need to interact with a registry, for example to pull or push container images.

JessEsquerdo · Answer

Correct answer is A
Yes, the solution meets the goal. When using Azure Container Registry (ACR) with Azure Kubernetes Service (AKS), you need to establish an authentication mechanism. You can configure the required permissions between ACR and AKS using the Azure CLI, Azure PowerShell, or Azure portal1. The AKS to ACR integration assigns the AcrPull role to the Azure Active Directory (Azure AD) managed identity associated with the agent pool in your AKS cluster1. This is essentially creating an Azure AD role assignment. So, your solution of creating an Azure AD role assignment is correct. However, please note that there’s a latency issue with Azure Active Directory groups when attaching ACR1. If you’re running automation that requires the RBAC configuration to be complete, it’s recommended to use “Bring your own kubelet identity” as a workaround.
https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli

ltjones12 · Answer

Definitely B. This is not an Azure AD Role assignment. This needs an RBAC role

sulfur · Answer

https://www.examtopics.com/discussions/microsoft/view/13685-exam-az-500-topic-3-question-16-discussion/

Mazhar1993 · Answer

The answer is No.

When an AKS cluster is created, Azure automatically generates a service principal to facilitate interactions with other Azure resources, including ACR.
This auto-generated service principal can be directly used for authenticating the AKS cluster to the ACR registry.
Therefore, creating an additional Azure AD role assignment is unnecessary as the auto-generated service principal already fulfills the authentication requirements.
The proposed solution of creating an Azure AD role assignment adds complexity without providing any additional benefit, making it unnecessary and not meeting the goal efficiently.

https://learn.microsoft.com/bs-latn-ba/azure/aks/cluster-container-registry-integration?tabs=azure-cli

massnonn · Answer

Yes, the solution meets the goal of ensuring that the Azure Kubernetes Service (AKS) cluster can authenticate to the Azure Container Registry using the auto-generated service principal.

hfk2020 · Answer

The AKS to ACR integration assigns the AcrPull role to the Microsoft Entra ID managed identity associated with the agent pool in your AKS cluster.

Slawekyo · Answer

In Topic 3, question 16. You have the same question but to choose answer, there "Azure Active Directory (Azure AD) role assignment" is correct so answer is def A

bernedb · Answer

Correct answer is B. Azure AD roles is not the same as Azure RBAC https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

Bonesurfer · Answer

A: https://learn.microsoft.com/en-us/azure/aks/kubernetes-service-principal?tabs=azure-cli#delegate-access-to-other-azure-resources

zied01 · Answer

it's just a confusion between Azure AD roles and Azure RBAC but i think that to goal of this question is to make sure that the SPN should have a permission this is the goal and not the role/permission it self 
i think the answer is yes

Jkayx94 · Answer

Requires ACR-Pull which is an Azure RBAC Built in Role: https://learn.microsoft.com/bs-latn-ba/azure/role-based-access-control/built-in-roles#acrpull

Answer is B

Atom270 · Answer

Obviously answer is B, why would anyone select A as it is related to role assigment

fastline112003 · Answer

This should be usually done with Azure RBAC:
az aks update -n myAKSCluster -g myResourceGroup --attach-acr <acr-name>

AZ-500 Exam - Question 20

Discussion