A platform team must guarantee that pods on an AKS cluster can only run container images pulled from the organization's approved registries. Which control enforces this at deployment time?
Show answer and explanation
Answer: B
Azure Policy for AKS installs Gatekeeper, the Open Policy Agent admission controller, in the cluster. A built-in definition that restricts allowed container images, set to Deny, rejects any pod that references an image outside the approved list before it starts. This makes the rule preventive rather than advisory. Audit-only policies report violations after they occur, handbook rules depend on compliance, and monthly reviews detect problems too late.
Why the other options are wrong
- A. The Audit effect records violations for review but still lets non-approved images run, so the guarantee is not enforced.
- C. A handbook rule relies on every team reading and obeying it, which provides no technical barrier against a non-approved image.
- D. Monthly reviews find violations after the containers have already run, so the exposure can persist for weeks before anything is corrected.