Which built-in RBAC role grants read-only image pull access to an ACR registry?

1. A AcrPush
2. ✓ B AcrPull (correct answer)
3. C Contributor
4. D Reader

Shortcut: AcrPull grants pull (read) permission only. AcrPush adds push/write. Reader grants broader Azure management plane read access.