AZ-500 Secure networking Practice Question
You are securing an Azure Kubernetes Service (AKS) cluster. You need to restrict network traffic between pods and to external services using Azure network policies. Which three of the following options are valid considerations or steps? (Choose three.)
⚠ Common exam trap
It's easy for candidates to confuse NSGs with Kubernetes network policies, thinking NSGs can filter pod-to-pod traffic, but NSGs operate at the subnet level and cannot see pod IPs, making them ineffective for pod-level segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Azure Network Policy Manager (Azure NPM) when creating the AKS cluster.
Azure Network Policy Manager (Azure NPM) is a required add-on for enforcing Kubernetes NetworkPolicy objects in an AKS cluster. It translates Kubernetes network policies into Azure-specific configurations to filter pod-to-pod traffic. Without enabling Azure NPM (or an alternative like Calico), standard Kubernetes NetworkPolicy objects will not be enforced by Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Azure Network Policy Manager (Azure NPM) when creating the AKS cluster.
Why this is correct
Azure Network Policy Manager (Azure NPM) is a Linux-based iptables/ipset enforcement engine for Kubernetes NetworkPolicy objects. It must be enabled at cluster creation time because it requires the Azure CNI networking configuration and specific AKS API flags that cannot be added to an existing cluster. Once enabled, it enforces your NetworkPolicy rules at the pod IP level, providing integrated, first-party traffic filtering within the AKS cluster without relying on a third-party component.
- ✓
Define Kubernetes NetworkPolicy objects that use selectors to allow or deny traffic between pods.
Why this is correct
Defining Kubernetes NetworkPolicy objects is the core, cluster-native mechanism for segmenting pod-to-pod traffic. These objects use pod selectors, namespace selectors, and IP blocks to allow or deny ingress and egress traffic, and they are enforced by a policy engine such as Azure NPM or Calico. This selector-based approach enables zero-trust, micro-segmentation policies that automatically follow pod labels, making it the standard and most scalable way to control east-west traffic in AKS.
- ✓
Use Azure Firewall to enforce egress traffic rules for the AKS cluster.
Why this is correct
Azure Firewall is a managed, cloud-native firewall that you can deploy in a hub VNet to inspect and control outbound traffic from an AKS cluster. By configuring user-defined routes (UDRs) that direct pod egress traffic to Azure Firewall, you can enforce L3/L4 network rules and FQDN-based application rules, blocking malicious destinations and data exfiltration. This is the appropriate tool for north-south egress filtering, as it operates at the network edge and is distinct from in-cluster pod-to-pod policy enforcement.
- ✗
Configure an NSG directly on the AKS node subnet to filter pod-to-pod traffic.
Why it's wrong here
An NSG applied directly to the AKS node subnet filters traffic at the VM NIC and subnet level, not at the ephemeral pod IP level. Pods in AKS are allocated IP addresses from the subnet, but NSG rules cannot distinguish individual pod IPs or pod labels—they only see the node's IP. Consequently, NSGs cannot enforce layer-7-aware or label-based pod-to-pod security policies, and arbitrary NSG rules can also interfere with Azure's essential platform traffic, making NetworkPolicy the only valid approach for pod-level filtering.
- ✗
Set the AKS cluster to use Calico network policies instead of Azure NPM for better performance.
Why it's wrong here
Calico is a legitimate alternative for enforcing Kubernetes NetworkPolicy, but the claim that it offers better performance than Azure NPM is not universally true. Azure NPM is specifically optimized for the Azure CNI plugin and leverages ipset to handle large-scale rule sets efficiently; Calico's performance depends on its mode (e.g., iptables vs. eBPF) and may introduce additional operational overhead as a third-party component. The choice between NPM and Calico should be based on feature requirements (like policy-spec extensions) and operational support, not a blanket performance advantage.
- ✗
Assign public IP addresses to each pod for direct internet access without a load balancer.
Why it's wrong here
Assigning a public IP address to each pod is not feasible or secure because pod IPs are ephemeral and scale dynamically with replicas and node churn, creating massive public IP demand and exposure. AKS pods communicate over private IPs by default; external inbound traffic is handled through a Service with a LoadBalancer or an Ingress controller, while egress is achieved via SNAT (node NAT) or Azure Firewall. Giving each pod a public IP also bypasses centralized network security controls like NAT rules and DDoS protection, directly exposing container workloads to the internet.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.