AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a way to implement role-based access control for Kubernetes cluster resources?
⚠ Common exam trap
A common mix-up: candidates confuse Azure RBAC (which controls Azure resource management) with Kubernetes RBAC (which controls Kubernetes API permissions), and assume subscription-level RBAC can manage Kubernetes cluster resources directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AKS with Azure AD integration and Kubernetes RBAC
B is correct because Azure Kubernetes Service (AKS) integrates with Azure Active Directory (Azure AD) to provide identity and authentication, and then uses Kubernetes RBAC (Role-Based Access Control) to authorize actions on cluster resources. This combination allows you to define fine-grained permissions for users, groups, or service principals against Kubernetes objects like pods, namespaces, and deployments, using standard Kubernetes Role and ClusterRole objects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure RBAC at the subscription level
Why it's wrong here
Azure RBAC at the subscription level governs control-plane operations such as creating or deleting AKS clusters, scaling node pools, and retrieving cluster credentials via the Azure management API. It does not extend to in-cluster Kubernetes API calls, so a user with Contributor at the subscription scope cannot view pods or create deployments unless Kubernetes RBAC separately grants that. This is wrong because it addresses cluster management, not identity-based authorization inside the cluster.
- ✓
AKS with Azure AD integration and Kubernetes RBAC
Why this is correct
This is correct because integrating AKS with Azure AD lets you authenticate Kubernetes users with their directory identities and then pair that with Kubernetes RBAC to authorize actions in the cluster. For example, you can bind an Azure AD group to a RoleBinding or ClusterRoleBinding, granting members specific verbs on resources like pods or deployments. This gives developers a unified and granular way to manage Kubernetes resources based on their Azure AD roles, which is exactly what the scenario requires.
- ✗
Azure Policy for Kubernetes
Why it's wrong here
Azure Policy for Kubernetes works with admission controllers like Gatekeeper/OPA to enforce cluster governance rules, such as requiring pod resource limits, denying privileged containers, or restricting image repositories. These policies are evaluated at admission time and block non-compliant resources from being created or updated, but they do not map users or groups to API permissions. This is wrong because it is a compliance/guardrail system, not an identity-based authorization model for RBAC.
- ✗
Network Security Groups on AKS node pools
Why it's wrong here
Network Security Groups on AKS node pools filter inbound and outbound traffic to the underlying node VMs, controlling which network sources can reach ports like 443 on the API server or node communication. They are a network-layer control and have no awareness of Azure AD users, groups, or Kubernetes role bindings. As a result, NSGs cannot determine whether a specific user is allowed to perform Kubernetes actions such as deleting services or editing ConfigMaps, so they are an orthogonal mechanism.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
AKS
Azure Kubernetes Service (AKS) is a managed container orchestration service on Microsoft Azure that simplifies deploying, managing, and scaling containerized applications using Kubernetes.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.