Which TWO measures make a production image reference tamper-evident?

1. ✓ A Deploy by digest rather than by tag (correct answer)
2. ✓ B Sign images with Notation and enforce verification with a Ratify policy (correct answer)
3. C Enable the ACR soft delete policy
4. D Use latest for the newest build
5. E Enable admin user on the registry

Shortcut: A digest pins the exact content, and signature verification proves the image came from your pipeline. Soft delete aids recovery but says nothing about authenticity; latest is mutable; the admin user is a shared credential and weakens security.