HOTSPOT You develop a containerized application. You plan to deploy the application to a new Azure Container instance by using a third-party continuous integration and continuous delivery (CI/CD) utility. The deployment must be unattended and include all application assets. The third-party utility must only be able to push and pull images from the registry. The authentication must be managed by Azure Active Directory (Azure AD). The solution must use the principle of least privilege. You need to ensure that the third-party utility can access the registry. Which authentication options should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

For an unattended, third-party CI/CD utility that requires Azure AD-managed authentication, a service principal is the appropriate identity type. Service principals are designed for applications and automated services to access Azure resources without human interaction.

To adhere to the principle of least privilege, the utility should only be granted permissions to push and pull images. The AcrPush role is the most specific built-in role for this purpose. It includes permissions to both pull images (Microsoft.ContainerRegistry/registries/pull/read) and push images (Microsoft.ContainerRegistry/registries/push/write), without granting unnecessary administrative permissions found in the Contributor or Owner roles. The AcrPull role would be insufficient as it does not allow pushing images.

Microsoft. (2023). Azure Container Registry authentication with service principals. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal. In the "Scenarios" section, it states, "In a scripted, 'headless,' or automated scenario, you can provide a service principal with permissions to an Azure container registry."

Microsoft. (2023). Azure Container Registry roles and permissions. Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/container-registry/container-registry-roles-permissions. The documentation table under "Role permissions" specifies that the AcrPush role includes both Microsoft.ContainerRegistry/registries/pull/read and Microsoft.ContainerRegistry/registries/push/write actions, making it the least-privileged choice for CI/CD scenarios that need to both read and write images.

National Institute of Standards and Technology (NIST). (2013). Security and Privacy Controls for Federal Information Systems and Organizations (Special Publication 800-53 Rev. 4). §AC-6, "Principle of Least Privilege". Retrieved from https://doi.org/10.6028/NIST.SP.800-53r4. This document formally defines the principle of least privilege, which requires that users and processes are granted only those permissions necessary to perform their assigned functions. This principle directly supports the selection of AcrPush over more permissive roles.