Exam AZ-500 topic 3 question 16 discussion

1. When you create an AKS cluster, Azure also creates a service principal to support cluster operability with other Azure resources. 2. This service principal can already authenticate to AAD (since it was created in AAD). 3. But it needs to be RBAC permissions on the ACR Registry to pull images. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry.

B for sure. (Azure AD) role assignment

There is one more question in the bank in topic1 qustion 20 I think here we need to assign RBAC not Azure AD ROLE

B. an Azure Active Directory (Azure AD) role assignment

Thank you for the explanation DeepMoon. The answer is: Azure AD role assignment

B. an Azure Active Directory (Azure AD) role assignment

You need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry- Answer is correct

B is correct answer.

Repeat question I believe, I wish I remembered the other question. I think it was the same "role assignment" answer though.

Azure AD role assignment is the closest answer but is wrong. It would be an Azure role. Not Azure AD role.

Well, what makes me confused is the word used in this question. Azure role assignment is different from Azure AD role assignment. Why does the service principal need an Azure AD role assignment? https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli#service-principal https://docs.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli#authentication-options https://docs.microsoft.com/en-us/azure/container-registry/authenticate-kubernetes-options https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

Correct This is a duplicate Question of Q1 topic3. Slightly different wording but same.

b is correct

# IN EXAM - 31/8/2021

Given Answer is correct. Service principal must be assigned atleast Reader role to the ACR for deploying to ACI or AKS

1. When you create an AKS cluster, Azure also creates a service principal to support cluster operations with other Azure resources. 2. This service principal can already authenticate to AAD (since it was created in AAD by Azure). 3. But it needs to be RBAC permissions on the ACR Registry to pull images. 4. To do so, you need to create an Azure AD role assignment that grants the cluster's service principal access to the container registry.

the given answer is the most reasonable between the choices.