mediumMultiple SelectObjective-mapped
AKS Security: Azure AD Integration and Pod Identity
Which TWO actions should you take to secure an Azure Kubernetes Service (AKS) cluster?
Quick Answer
The answer is to use pod identity to access Azure resources and integrate Azure AD with AKS for Kubernetes RBAC. This is correct because Azure AD integration allows you to map Azure AD identities—such as users, groups, or service principals—directly to Kubernetes roles, eliminating static secrets and centralizing identity management. Pod identity then extends this by assigning an Azure AD managed identity to each pod, enabling secure, granular access to Azure resources like Key Vault or storage without embedding credentials. On the Microsoft Cybersecurity Architect exam, this pairing tests your understanding of zero-trust principles in containerized environments; a common trap is confusing pod identity with simple service principal secrets, which lack the per-pod isolation and automatic rotation that pod identity provides. Remember the mnemonic: "AD for the cluster, pod for the pod"—Azure AD secures the cluster’s control plane, while pod identity secures each workload’s resource access.
⚠ Common exam trap
Candidates often confuse optional security features (like disabling HTTP routing or enabling Azure Firewall) with mandatory actions, or they mistakenly believe that storing service principal secrets in Kubernetes secrets is acceptable, when Azure AD integration provides a far more secure and manageable approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure AD integration for Kubernetes RBAC.
Integrating Azure AD with AKS enables Kubernetes RBAC to use Azure AD identities for authentication and authorization. This allows you to grant granular permissions to users, groups, or service principals based on their Azure AD roles, eliminating the need for static Kubernetes secrets and providing centralized identity management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Azure AD integration for Kubernetes RBAC.
Why this is correct
Provides identity-based access control.
- ✗
Disable HTTP application routing.
Why it's wrong here
Not a security best practice; the feature can be secured.
- ✓
Use pod identity to access Azure resources.
Why this is correct
Provides secure access without managing keys.
- ✗
Enable Azure Firewall to restrict outbound traffic.
Why it's wrong here
Not a mandatory action; it depends on requirements.
- ✗
Use a service principal for AKS cluster authentication and store the secret in a Kubernetes secret.
Why it's wrong here
Storing secrets in Kubernetes secrets is insecure.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SC-100 question from scratch — 208 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SC-100
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Kubernetes Service (AKS) with Azure Active Directory (Azure AD) integration. They want to restrict developers to only be able to create and manage pods and services, but not modify cluster-level resources like nodes or namespaces. What should they configure?
hard- A.Assign the cluster-admin ClusterRole to the developers
- ✓ B.Create a custom ClusterRole with rules for pods and services, then bind it to the developer group with a ClusterRoleBinding
- C.Create a RoleBinding in each namespace for developers
- D.Use Azure RBAC to grant Contributor role on the AKS cluster
Why B: Kubernetes RBAC allows fine-grained authorization. A custom ClusterRole can define rules for pods and services (core API group resources), and a ClusterRoleBinding binds it to the developer group across all namespaces. This grants the required permissions without allowing modifications to cluster-level resources like nodes or namespaces, which are not included in the custom role's rules.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.