nerdexam
Microsoft

AZ-400 · Question #203

Drag and Drop Question Your company has an Azure subscription named Subscription1. Subscription1 is associated to an Azure Active Directory tenant named contoso.com. You need to provision an Azure Kub

The correct answer is a cluster; a system-assigned managed identity; an RBAC binding. The correct sequence is: first create the AKS cluster, which automatically provisions a system-assigned managed identity associated with the cluster, and then create an RBAC binding that links that managed identity (or Azure AD identities from contoso.com) to Kubernetes RBAC role

Submitted by kevin_r· Mar 6, 2026Configure and manage Kubernetes infrastructure security - specifically AKS cluster identity, Azure AD integration, and role-based access control (RBAC) bindings, typically tested under the 'Secure Azure solutions' or 'Manage identity and access' domain of AZ-104 or AZ-500 certifications.

Question

Drag and Drop Question Your company has an Azure subscription named Subscription1. Subscription1 is associated to an Azure Active Directory tenant named contoso.com. You need to provision an Azure Kubernetes Services (AKS) cluster in Subscription1 and set the permissions for the cluster by using RBAC roles that reference the identities in contoso.com. Which three objects should you create in sequence? To answer, move the appropriate objects from the list of objects to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-400 question #203 exhibit

Answer Area

Drag items

a system-assigned managed identitya clusteran application registration in contoso.coman RBAC binding

Correct arrangement

  • a cluster
  • a system-assigned managed identity
  • an RBAC binding

Explanation

The correct sequence is: first create the AKS cluster, which automatically provisions a system-assigned managed identity associated with the cluster, and then create an RBAC binding that links that managed identity (or Azure AD identities from contoso.com) to Kubernetes RBAC roles. Creating the cluster first is necessary because the managed identity is generated as part of the cluster provisioning process, and the RBAC binding must come last as it depends on both the cluster and the identity existing. This approach uses Azure AD-integrated AKS with RBAC, allowing role bindings to reference identities directly from contoso.com without needing a separate app registration.

Topics

#Azure Kubernetes Service#RBAC#Managed Identity#Azure Active Directory Integration

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-400 Practice