SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

Question

You have an Azure subscription containing a user named User1 and an Azure Container Registry named ContReg1.

You enable content trust for ContReg1. You need to ensure that User1 can create trusted images in ContReg1. The solution must follow the principle of least privilege.

Which two roles should you assign to User1? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Choose two

Explanation

Pushing a trusted image with Docker Content Trust requires image-push permission in addition to signing permission. AcrPush grants the required artifact push capability, and AcrImageSigner grants the permissions to sign trusted images in a content-trust-enabled registry. Together they provide the required access without the broader permissions of Contributor.

Learn more

SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

AstroTutor

Notes

Readiness

QuestionQ11

Community Discussion