Your team needs to give a partner pull access to exactly one repository in a shared registry. What is the least-privilege mechanism?

1. A Assign the AcrPull role at the registry scope
2. ✓ B Create a repository-scoped token with pull actions on that repository (correct answer)
3. C Enable the admin account and share the password
4. D Create a separate registry for the partner

Shortcut: Repository-scoped tokens grant permissions on individual repositories, which registry-level AcrPull cannot. The admin account is registry-wide and shared, so it violates least privilege.