Exam AZ-500 topic 3 question 1 discussion

Super Confusing and Tricky:- https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles As per the above link, AcrImageSigner role - only has permission to Sign Images but the text below seems to suggest that usually this permission of "Sign Images" - The ability to sign images, usually assigned to an automated process, which would use a service principal. This permission is typically combined with push image to allow pushing a trusted image to a registry. For details, see Content trust in Azure Container Registry. But then the confusion is, "Sign Images" seems usually assigned to an automated process, the question talks about assigning 2 roles (Principle of least privilege) to a USER not an automated process. So if it has to be roles assigned to a USER, shouldnt it be AcrPush and Contributor. Ofcource Owner can also push an Image, but it will not follow the Principle of least privilege.

Correct it should be ArcPush and AcrImageSigner Because the question states that we should follow the principle of least priviledge

https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli#:~:text=This%20permission%20is%20typically%20combined%20with%20push%20image%20to%20allow%20pushing%20a%20trusted%20image%20to%20a%20registry.%20For%20details%2C%20see%20Content%20trust%20in%20Azure%20Container%20Registry.