SC-100 Certification Practice Question #162

Question

You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1.

You need to restrict internet access to the public endpoint of AKS1. The solution must ensure that AKS1 can be accessed only from the public IP addresses associated with the on-premises datacenter.

What should you use?

Accepted Answer

The scenario keeps AKS1's public endpoint but limits which source IPs can reach it — exactly what API server authorized IP ranges does. MS Learn states the feature restricts the otherwise publicly accessible AKS control plane/API server to a known list of IP addresses and CIDRs, blocking all other source IPs; the recommended ranges explicitly include "networks that you'll administer the cluster from," i.e., the on-premises datacenter's public IPs. A private endpoint would remove public reachability altogether (contradicting "restrict internet access to the public endpoint"), a service endpoint governs VNet-to-PaaS egress rather than inbound API access, and an NSG operates at the VNet/subnet layer and isn't applied to the AKS-managed public API server — Ramye's reply notes there's no VNet referenced. Suggested Answer, the 15-vote community consensus, and MS Learn all converge on D.

More SC-100 practice questions