Question

Your company runs a production Azure Container Registry named prodacr. The security team requires that only digitally signed container images can be pulled and deployed from the registry, ensuring image integrity and publisher authenticity. Which action should you take to enforce this requirement?

Accepted Answer

Enable content trust on the registry and require signed images (Premium SKU)

Answer

Enable the registry firewall and restrict access to trusted Azure services only

Answer

Assign the AcrPull role only to managed identities of approved compute resources

Answer

Enable customer-managed key encryption for the registry