AZ-400 Practice Question: Design and implement build and release pipelines
Your organization uses GitHub Actions for CI/CD. You have a workflow that builds and deploys a containerized application to Azure Kubernetes Service (AKS). The workflow uses the 'azure/aks-set-context' action to connect to the AKS cluster. Recently, the workflow started failing with authentication errors. The service principal used has Contributor role on the AKS cluster. What is the most likely cause?
⚠ Common exam trap
Candidates often assume the Contributor role on the AKS resource is sufficient for all operations, but Azure separates Azure RBAC (for managing the AKS resource) from Kubernetes RBAC (for interacting with the cluster), and the 'azure/aks-set-context' action specifically requires the AKS Cluster Admin or User Role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The service principal lacks the 'Azure Kubernetes Service Cluster Admin Role' on the AKS cluster.
The 'azure/aks-set-context' action requires the service principal to have the 'Azure Kubernetes Service Cluster Admin Role' (or 'Azure Kubernetes Service Cluster User Role') on the AKS cluster to authenticate and set the kubectl context. The Contributor role on the AKS cluster resource does not grant the necessary Kubernetes RBAC permissions to interact with the cluster's API server. Without the specific AKS role, the action fails with authentication errors.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The service principal must have 'Owner' role on the resource group containing the AKS cluster.
Why it's wrong here
The Owner role grants broad control over every resource in the resource group, but the specific Azure RBAC action needed to fetch AKS admin credentials is contained in the Azure Kubernetes Service Cluster Admin Role. A missing Owner role would not produce this error, and assigning Owner is unnecessary and over-privileged; the service principal simply lacks the precise cluster admin assignment.
- ✓
The service principal lacks the 'Azure Kubernetes Service Cluster Admin Role' on the AKS cluster.
Why this is correct
The Azure CLI action 'aks get-credentials --admin' requires the service principal to have the 'Azure Kubernetes Service Cluster Admin Role' on the AKS cluster. This role grants the Microsoft.ContainerService/managedClusters/listClusterAdminCredential/action permission, which is mandatory for retrieving the cluster-admin kubeconfig; without it, the workflow fails during the credential download step with an authorization error.
- ✗
The workflow uses an incorrect Kubernetes version.
Why it's wrong here
An incorrect Kubernetes version would cause version mismatch or API unsupported errors when kubectl attempts to communicate with the cluster. Since the failure occurs before kubectl is invoked (during credential retrieval), the Kubernetes version is irrelevant to this specific authentication/authorization failure.
- ✗
The AKS cluster has RBAC disabled, causing authentication failures.
Why it's wrong here
Disabling RBAC on an AKS cluster does not prevent Azure AD authentication or Azure RBAC assignments—it only disables Kubernetes' built-in RBAC for authorization inside the cluster. The service principal still needs the Azure role assignment to obtain admin credentials, so a lack of the Cluster Admin Role would cause the same error regardless of whether Kubernetes RBAC is enabled or disabled.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Anthos
Anthos is a Google Cloud platform that lets you run applications consistently across different computing environments, like on-premises data centers and multiple public clouds.
Key term
GitHub
GitHub is a cloud-based platform for storing, tracking, and collaborating on code using Git version control.
About these practice questions
Courseiva writes every AZ-400 question from scratch — 823 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.