AZ-204 Develop Azure compute solutions Practice Question
Your AKS cluster runs a microservices application. You need to expose an internal service only within the cluster virtual network. Which Service type should you use?
⚠ Common exam trap
Candidates often confuse ClusterIP with internal-only access, but ClusterIP is limited to within the cluster itself, whereas an Internal LoadBalancer extends accessibility to the entire virtual network, which is the requirement in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Internal LoadBalancer (with annotation)
An Internal LoadBalancer with the `service.beta.kubernetes.io/azure-load-balancer-internal: "true"` annotation creates a load balancer with a private IP address from the cluster's virtual network, making the service accessible only within that VNet. This is the correct choice for exposing an internal service exclusively within the AKS cluster virtual network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
NodePort
Why it's wrong here
The NodePort service type exposes a service on a static port on each node's IP address within the AKS cluster. While it makes the service accessible from outside the cluster if network security groups permit, it requires direct access to a specific node's IP and port. This approach is not designed for secure, internal VNet access and lacks the load balancing capabilities and private IP assignment of an internal load balancer, making it unsuitable for the requirement.
- ✓
Internal LoadBalancer (with annotation)
Why this is correct
The Internal LoadBalancer service type, specifically configured with the `service.beta.kubernetes.io/azure-load-balancer-internal: "true"` annotation, is the correct solution. This configuration provisions an Azure Internal Load Balancer with a private IP address within the AKS Virtual Network. Consequently, the microservice becomes securely accessible only to other resources residing within that VNet or peered VNets, without any public exposure.
- ✗
LoadBalancer
Why it's wrong here
The LoadBalancer service type, when used without specific annotations for internal access, defaults to provisioning an Azure Public Load Balancer. This results in the service being exposed to the internet via a public IP address, which contradicts the requirement for VNet-only access. While it can be modified with annotations to be internal, simply specifying LoadBalancer alone does not fulfill the need for an internal, VNet-accessible endpoint.
- ✗
ClusterIP
Why it's wrong here
The ClusterIP service type exposes a service on an internal IP address that is only reachable from within the Kubernetes cluster itself. This means that other pods and services running inside the AKS cluster can access it, but resources located directly within the same Azure Virtual Network, but outside the cluster, cannot. Therefore, it does not provide the necessary VNet-level accessibility required for the microservices application.
Go deeper
Related to this question
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.