AZ-500 Question 123
Single answerYou have an existing AKS cluster configured with the Azure CNI plugin, and your organization now requires that all inbound traffic to the cluster be restricted to on-premises networks only. Additionally, you need to enforce fine-grained network rules to block unwanted communications between pods. Which configuration should you implement to satisfy both requirements?
- A
A) Convert the AKS cluster to a private cluster, specify your on-premises ranges in Azure Network Security Groups (NSGs), and enable a network policy plugin (such as Azure Network Policy or Calico).
- B
B) Reconfigure the AKS cluster to use the kubenet networking mode, enable the public endpoint, and rely solely on Azure Firewall to block unauthorized inbound traffic.
- C
C) Keep the existing Azure CNI plugin, enable authorized IP ranges for the AKS API server, and disable all NSG rules for the subnet hosting AKS.
- D
D) Deploy the AKS cluster in a default configuration using Azure CNI without any additional network customizations, assuming the cluster is already secured by default.
Show answer and explanation
Correct answer: A
Explanation
To enforce strict inbound access to AKS, limited to an on-premises network, and provide pod-level segmentation, you need both private cluster access and network policies. Configuring a private cluster removes the public endpoint and uses private IPs, which NSGs can then control to allow only on-premises traffic. Network policy solutions (Azure Network Policy or Calico) then let you define fine-grained pod-to-pod communication rules. Refer to Microsoft Docs (https://learn.microsoft.com/azure/aks/use-network-policies) for detailed guidance on configuring and enforcing network policies in AKS.
- A. Correct.
Option A is correct. Converting your AKS cluster to a private cluster effectively removes a public endpoint for the API server, ensuring Azure traffic must come from your private network (e.g., via VPN or ExpressRoute). Adding your on-premises ranges to NSGs allows only that traffic to access the cluster. Furthermore, enabling a network policy plugin (Azure Network Policy or Calico) enforces rules to permit or deny traffic between pods.
- B. Incorrect.
Option B is incorrect. While using kubenet and Azure Firewall can help filter external traffic, it does not address pod-level isolation effectively, and the presence of a public IP for the cluster still allows external inbound traffic. This approach does not fulfill the requirement to limit access strictly to on-premises networks.
- C. Incorrect.
Option C is incorrect. Authorized IP ranges only limit access to the AKS API server, not the actual pod traffic within the cluster. Disabling NSG rules also makes the environment vulnerable to undesired communications. This does not provide complete network isolation for pod traffic.
- D. Incorrect.
Option D is incorrect. A default AKS configuration using Azure CNI does not inherently block all but on-premises traffic nor enforce pod-level isolation. Additional configurations (like NSGs, network policies, and private cluster settings) are necessary for complete isolation.