Microsoft Azure Security Technologies (AZ-500)

When creating an Azure Kubernetes Service (AKS) cluster, what is necessary for it to connect to an Azure Container Registry using the auto-generated service principal?

1. You need to create an Azure Active Directory (Azure AD) role assignment.

2. You need to create a new Azure Storage account.

3. You need to enable multi-factor authentication.

4. You need to configure virtual network service endpoints.

The correct answer is: You need to create an Azure Active Directory (Azure AD) role assignment.

When establishing a connection between an Azure Kubernetes Service (AKS) cluster and Azure Container Registry (ACR), the essential step involves creating an Azure Active Directory (Azure AD) role assignment. This is crucial because AKS needs the appropriate permissions to pull container images from ACR. By assigning the "Reader" and "AcrPull" roles of Azure AD to the service principal that AKS uses, you ensure that the AKS cluster can authenticate against ACR and retrieve the necessary images for deploying workloads. The other options do not directly address the authentication or permission requirements between AKS and ACR. For example, creating a new Azure Storage account is unrelated to the specific process of granting access for AKS to pull images. Similarly, enabling multi-factor authentication, while a good security practice, does not pertain to service principal permissions and access to ACR. Configuring virtual network service endpoints may improve connectivity and security but doesn't address the fundamental requirement of the service principal's role assignment necessary for accessing ACR.