You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1. You need to restrict internet access to the public endpoint of AKS1. The solution must ensure that AKS1…

Question

Options

• Aa private endpoint
• Ba network security group (NSG)
• Ca service endpoint
• Dan authorized IP range

• A
  4% (1)
• B
  4% (1)
• C
  7% (2)
• D
  86% (24)

Explanation

AKS authorized IP ranges is the feature specifically designed to restrict access to the Kubernetes API server's public endpoint to a defined set of IP address ranges. By configuring the on-premises datacenter's public IP addresses in the authorized IP range, all other internet traffic to the AKS API server is denied while the cluster remains reachable from the datacenter. Option A (private endpoint) would make the API server accessible only via a private IP inside a VNet, removing the public endpoint entirely-this doesn't match the requirement of keeping the public endpoint accessible from specific IPs. Option B (NSG) operates on VNet subnets and NICs to filter traffic within Azure's network; it cannot filter inbound connections to a managed AKS public endpoint from the internet. Option C (service endpoint) restricts outbound traffic from a VNet to Azure PaaS services, not inbound access to AKS from external IPs.

No community discussion yet for this question.