BenchMark Quizzes by MDFT Pro

Configure Azure Kubernetes Service

You work as a Cloud Infrastructure Specialist for MDFT Pro, a well-known training agency that delivers Azure certification courses to students worldwide. MDFT Pro operates a student portal application that needs to be deployed to an Azure Kubernetes Service (AKS) cluster.

Mark, the senior DevOps engineer, has specified that this application must only be accessible from within the VNet that includes the AKS cluster, ensuring that internal administrative tools remain secure and aren’t exposed to the public internet. The application will be used by trainers to manage course materials and student progress, so it’s critical that it remains accessible only to internal systems within the training agency’s private network.

How should you complete the deployment YAML to ensure the service is only accessible within the VNet?

apiVersion: v1
kind: Service
metadata:
  name: student-portal
  annotations:
    service.beta.kubernetes.io/_________: "true"

spec:
  type: LoadBalancer
  ports:
  - port: 80
  selector:
    app: student-portal

Choose the correct answer from the options below.

Explanations for each answer:

service is incorrect. This value is too generic and doesn't correspond to any valid Azure Kubernetes Service annotation. The annotation needs to specify the complete path including the Azure-specific load balancer configuration.
vnet-access is incorrect. While this suggests network access control, it's not a valid Azure Kubernetes Service annotation. VNet access is controlled through the load balancer type configuration, not through a vnet-access annotation.
load-balancer is incorrect. This annotation is incomplete and doesn't follow the Azure Kubernetes Service naming convention. Azure-specific annotations require the full path with the azure prefix to properly configure load balancer behavior.
azure-load-balancer is incorrect. This annotation is missing the critical '-internal' suffix that specifies the load balancer should be internal. Without this suffix, the annotation won't properly configure the service for internal-only access.
azure-load-balancer-internal is correct. This annotation configures the Kubernetes service to create an internal Azure Load Balancer that's only accessible within the VNet. When set to 'true', it ensures the service receives a private IP address instead of a public one, meeting the requirement for VNet-only access.
azure-load-balancer-private is incorrect. While 'private' suggests internal access, this is not the correct annotation name used by Azure Kubernetes Service. The proper annotation uses 'internal' rather than 'private' to configure load balancer visibility.

Learn more about Internal Load Balancers in AKS:

Internal Load Balancers

Practice Exam

Configure Azure Kubernetes Service

Discuss this question on social media: