Exam AZ-104 topic 2 question 2 discussion

Answer is correct B Cluster administrators can configure Kubernetes role-based access control (Kubernetes RBAC) based on a user's identity or directory group membership. Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol https://docs.microsoft.com/en-us/azure/aks/managed-aad

as of late 2023 / early 2024 Azure Kubernetes Service is NO LONGER part of the exam. This question is defunct. Please review the MS provided documentation regarding the AZ104 exam: https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104

When an administrator is unable to grant access to an AKS cluster for users in an Azure Active Directory (Azure AD) tenant, it typically indicates that the AKS cluster was not configured with Azure AD integration when it was initially created. Azure AD integration must be enabled when the AKS cluster is created in order to manage access and authentication through Azure AD. If this integration was not enabled during the cluster's creation, users in the Azure AD tenant (in this case, contoso.com) cannot be assigned access. The only way to enable Azure AD integration after creation is to recreate the AKS cluster with the proper configuration.

C. When an administrator is unable to grant access to an AKS cluster for users in an Azure Active Directory (Azure AD) tenant, it typically indicates that the AKS cluster was not configured with Azure AD integration when it was initially created. Azure AD integration must be enabled when the AKS cluster is created in order to manage access and authentication through Azure AD. If this integration was not enabled during the cluster's creation, users in the Azure AD tenant (in this case, contoso.com) cannot be assigned access. The only way to enable Azure AD integration after creation is to recreate the AKS cluster with the proper configuration.

Correct Answer is C To ensure that access to the Azure Kubernetes Service (AKS) cluster can be granted to the users in your Azure Active Directory (Azure AD) tenant (contoso.com), you should first: C. Recreate AKS1. This is because, when you create an AKS cluster, you can specify the Azure AD integration settings. If it was not configured correctly to allow access to users from the contoso.com tenant during the initial setup, recreating the cluster with the correct Azure AD integration settings is necessary to resolve the access issue. Other options do not directly address the need for Azure AD integration with AKS.

You need to integrate Azure AD with AKS. This often requires modifying the organization relationships settings in Azure AD

Option A is the correct choice. By modifying the Organization relationships settings in the Azure AD tenant (contoso.com), you can establish the required connection between the Azure AD tenant and the AKS cluster. This configuration allows users in contoso.com to access and manage AKS resources. Here's a high-level overview of the steps involved in this process: Sign in to the Azure portal using an account with appropriate permissions in the contoso.com Azure AD tenant. Navigate to the Azure AD tenant (contoso.com) settings. Locate the Organization relationships settings and configure the necessary settings to establish the connection between Azure AD and AKS. Follow any additional prompts or steps provided during the configuration process. Once the Organization relationships settings are properly configured, the administrator should be able to grant access to AKS1 for the users in the contoso.com Azure AD tenant.

This one had me confused between B and C, asking the Bing AI resulted in the following: The question does leave out some important details that would help determine the most appropriate answer. For instance, it doesn’t specify whether Azure RBAC is enabled on the AKS cluster. If Azure RBAC is not enabled, then the cluster would need to be recreated with Azure RBAC enabled (Option C). However, if Azure RBAC is already enabled and the cluster is integrated with Azure AD, then creating an OAuth 2.0 authorization endpoint could be a valid first step (Option B). The question also doesn’t specify whether the users are part of the same Azure AD tenant as the AKS cluster or if they are external users. If they are external users, additional steps might be needed to grant them access to the AKS cluster.

B is correct

A. This is because Azure Active Directory needs to be properly configured to grant access to AKS1. Modifying the organization relationships settings can help resolve issues related to user access.

To ensure that access to AKS1 can be granted to the users in the contoso.com Azure AD tenant, you should first: A. From contoso.com, modify the Organization relationships settings. Explanation: By modifying the Organization relationships settings in the contoso.com Azure AD tenant, you can establish the necessary trust relationships and permissions required for users in the tenant to access and manage resources, such as the AKS1 cluster. This step is essential for enabling user access and control over AKS1 within the Azure environment. Once the Organization relationships settings are appropriately configured, users in the contoso.com Azure AD tenant will be able to grant access to AKS1 effectively.

To ensure that access to AKS1 can be granted to the users in contoso.com, you should first select option A: From contoso.com, modify the Organization relationships settings. This action will allow you to establish the necessary connections and permissions between the Azure AD tenant (contoso.com) and the AKS cluster (AKS1), enabling users in contoso.com to access and manage AKS1 effectively.

B is correct as per https://learn.microsoft.com/en-us/azure/aks/concepts-identity

D. From AKS1, create a namespace. To manage access to Azure Kubernetes Service (AKS) clusters effectively, namespaces are used within Kubernetes to segment resources and provide a scope for access policies. By creating a namespace in AKS1, you can define Role-Based Access Control (RBAC) policies specifically for that namespace, which can then be used to grant appropriate permissions to users from the contoso.com Azure AD tenant. This is the first operational step in ensuring users can be granted access to specific parts of the AKS cluster without recreating the cluster or modifying authentication systems.

ChatGPT says D: D. From AKS1, create a namespace. To grant access to the users in the contoso.com Azure AD tenant, you need to integrate AKS with Azure AD for authentication and authorization. One of the steps involved in this process is to create a Kubernetes namespace. Once the namespace is created, you can configure RBAC (Role-Based Access Control) to grant appropriate permissions to users and groups from the Azure AD tenant. Options A and B are not relevant to granting access to AKS. Option C, recreating AKS1, is not necessary as the existing AKS cluster can be configured to integrate with Azure AD for user access control. Therefore, option D is the correct first step to enable access for contoso.com users.

Still confuse between A and B. Can someone provide more reasons to go for A or B whatever you feel the correct answer ?

B is right