Your organisation requires that only images signed by the release pipeline can be deployed to AKS. Which combination enforces this end to end?
- A ACR Content Trust alone
- B ACR Content Trust plus an Azure Policy or admission controller that rejects unsigned images (correct answer)
- C Repository-scoped tokens plus quarantine
- D Private endpoints plus RBAC
Shortcut: Content Trust handles signing and verification at the registry, but the cluster must also refuse unsigned images. An admission controller such as Azure Policy for Kubernetes or Ratify provides that enforcement at deploy time.