An Azure subscription contains User1 and an Azure Container Registry named ContReg1. Content trust is enabled for ContReg1. To allow User1 to create trusted images in ContReg1 using least privilege, which two roles should you assign to User1? (Choose two.)

To create trusted images, User1 needs permissions to push images and sign them. The AcrPush role grants permissions to push images to the container registry. The AcrImageSigner role allows User1 to sign images, which is necessary for content trust to be effective. Contributor is too permissive as it grants full access to manage all resources, violating the principle of least privilege. AcrQuarantineReader and AcrQuarantineWriter are for managing quarantined images, which is not directly related to creating trusted images.