AZ-500 Question 127
Select 2You are the security engineer for a retail company that uses Azure Kubernetes Service (AKS) to host microservices. The DevOps team wants to ensure that all developers use their corporate Azure Active Directory (Azure AD) credentials to access the cluster with kubectl. They also want to automatically map Azure AD groups to specific Kubernetes RBAC roles for fine-grained access control. You plan to configure Azure AD integration on the existing AKS cluster to meet these requirements. Which two actions should you take? (Choose two.)
- A
Enable Azure AD and Azure RBAC in the cluster using the command: az aks update --enable-aad --enable-azure-rbac
- B
Create an Azure Application Gateway with WAFv2 to direct traffic to the AKS cluster for all authentication requests
- C
Create custom Azure AD server and client applications, then specify their application IDs in the cluster configuration
- D
Create or update Kubernetes RoleBindings or ClusterRoleBindings that map Azure AD groups to Kubernetes roles
Show answer and explanation
Correct answers: A, D
Explanation
To integrate AKS with Azure Active Directory and manage fine-grained permissions, you typically enable Azure AD and Azure RBAC on the cluster and then configure RBAC bindings within Kubernetes. Optionally, you can assign roles via Azure RBAC at the subscription or resource group level. References: Microsoft Learn documentation on 'Integrate AKS with Azure AD' (https://learn.microsoft.com/azure/aks/managed-aad).
- A. Correct.
Option 1 is correct. Enabling the AKS cluster for Azure AD authentication and Azure RBAC integrates user authentication with Azure AD and ties Kubernetes RBAC to Azure roles. By using --enable-aad and --enable-azure-rbac, you allow the cluster to use Azure AD for user logins and manage role assignments at the Azure level.
- B. Incorrect.
Option 2 is incorrect. An Azure Application Gateway with WAFv2 is used for HTTP/HTTPS traffic routing and application-level firewall protection. It does not configure or manage Azure AD authentication to the cluster. Azure AD-based cluster authentication is managed at the AKS configuration level, not via an Application Gateway.
- C. Incorrect.
Option 3 is incorrect. While manually creating Azure AD server and client applications was required in older or legacy implementations, the newer 'managed' approach no longer requires creating custom applications. The az aks update command with --enable-aad can handle the integration automatically.
- D. Correct.
Option 4 is correct. After enabling Azure AD integration, you must create or update Kubernetes RBAC bindings (RoleBindings or ClusterRoleBindings). These bindings map Azure AD groups or users to Kubernetes roles, ensuring users receive appropriate permissions (e.g., developers in a read-only group, cluster admins in a cluster-admin group).