AZ-500 Question 124
Select 2You have an Azure Kubernetes Service (AKS) cluster running production workloads that handle sensitive data. You suspect malicious traffic targeting your cluster and you also need to monitor container performance. Which two actions should you implement to enhance both security and observability?
- A
Configure and enable a network policy in AKS to restrict traffic to approved IP ranges.
- B
Install Microsoft Defender for Containers to provide threat detection and vulnerability assessments.
- C
Expose node IP addresses publicly to simplify container debugging operations.
- D
Store all container logs on ephemeral storage within each container to reduce overhead.
Show answer and explanation
Correct answers: A, B
Explanation
Enabling network policies (Option 1) helps ensure that only authorized traffic can flow within your cluster and to external endpoints, reducing exposure to malicious sources. Adding Microsoft Defender for Containers (Option 2) provides advanced security capabilities, such as threat detection and vulnerability assessments, which are critical for production workloads. For more information, refer to Microsoft's official documentation on securing and monitoring AKS: https://learn.microsoft.com/azure/defender-for-cloud/defender-for-containers-introduction.
- A. Correct.
Option 1 is CORRECT. Network policies in AKS (such as Azure Network Policy or Calico) allow you to restrict east-west and north-south traffic, preventing unauthorized network connections and reducing the attack surface.
- B. Correct.
Option 2 is CORRECT. Microsoft Defender for Containers (part of Microsoft Defender for Cloud) provides real-time threat detection, vulnerability scanning, and security recommendations, helping to identify and mitigate potential attacks in AKS clusters.
- C. Incorrect.
Option 3 is INCORRECT. Exposing node IP addresses publicly increases the cluster’s attack surface. Best practices recommend restricting direct access to AKS nodes, often using a jump box or Azure Bastion for secure administrative access if needed.
- D. Incorrect.
Option 4 is INCORRECT. Storing logs on ephemeral container storage means you lose telemetry once containers restart or scale down. Persistent storage, such as Azure Monitor Logs or Azure Storage, is preferred to ensure continuous auditing and performance insights.