AKS Egress Restriction — Azure Firewall with FQDN Tags
You are designing a network security strategy for an Azure Kubernetes Service (AKS) cluster. You need to restrict egress traffic from the cluster to only allow connections to specific Azure services (e.g., Microsoft Container Registry, Azure Key Vault). The solution must minimize administrative overhead. What should you use?
Quick Answer
The answer is to deploy Azure Firewall and use FQDN tags to allow traffic to Azure services. This is correct because Azure Firewall’s FQDN tags provide a managed, label-based way to permit egress traffic to essential Azure services like Microsoft Container Registry and Azure Key Vault, without needing to maintain individual IP addresses or FQDNs—drastically reducing administrative overhead. On the AZ-500 exam, this scenario tests your understanding of AKS egress restriction and the limitations of other controls: network security groups cannot filter by FQDN, AKS network policies lack native Azure service support, and Azure Policy audits but does not enforce traffic flow. A common trap is assuming NSGs or policy can handle this, but Azure Firewall with FQDN tags is the only option that combines granular, service-level allowlisting with minimal maintenance. Memory tip: think “FQDN tags = Firewall’s shortcut for Azure services”—if the destination is an Azure service, let the tag do the work.
⚠ Common exam trap
Many candidates assume Kubernetes network policies can control egress to external services, but they only apply to traffic between pods within the cluster, not to outbound traffic leaving the AKS node's virtual network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.
Azure Firewall with FQDN tags allows you to define outbound network rules based on fully qualified domain names (FQDNs) for Azure services like Microsoft Container Registry and Azure Key Vault. This approach minimizes administrative overhead because FQDN tags are automatically updated as Azure service IP ranges change, eliminating the need for manual IP maintenance. It provides a centralized, managed firewall solution that integrates natively with AKS for egress filtering.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Azure Policy to deny egress to non-approved destinations.
Why it's wrong here
Azure Policy does not enforce network traffic; it enforces compliance.
- ✓
Deploy Azure Firewall and use FQDN tags to allow traffic to Azure services.
Why this is correct
FQDN tags simplify allowing traffic to popular Azure services without managing IPs.
- ✗
Use Kubernetes network policies for egress.
Why it's wrong here
Network policies in AKS are for pod-to-pod traffic, not external egress.
- ✗
Define NSG rules to allow outbound traffic to the service IP ranges.
Why it's wrong here
IP ranges change and require updates; NSGs cannot filter by FQDN.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You have an Azure Kubernetes Service (AKS) cluster that needs to restrict egress traffic to specific Azure services (e.g., Azure Container Registry, Azure Monitor). You want a managed solution that allows you to define FQDN-based rules. Which Azure service should you use?
hard- A.Azure Application Gateway
- B.Azure Front Door
- C.Network Security Groups (NSGs)
- ✓ D.Azure Firewall
Why D: Azure Firewall is the correct choice because it is a managed, cloud-native network security service that provides FQDN-based rules to control outbound (egress) traffic. It allows you to define application rules using fully qualified domain names (FQDNs) to restrict egress traffic to specific Azure services like Azure Container Registry and Azure Monitor, without needing to manage underlying infrastructure.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.