Microsoft Certified: Azure Security Engineer AssociateSecure data and applicationsMedium
A company uses Azure Kubernetes Service (AKS) to host several microservices. To comply with internal security policies, all network traffic between pods within the same namespace must be restricted to specific services, and traffic between different namespaces must be blocked by default. Which AKS networking feature should be implemented to enforce these rules?
- AService Mesh (e.g., Istio)
- BKubernetes Network Policies
- CAzure Network Security Groups (NSGs)
- DAzure Firewall
Show answer & explanationAnswer & explanation
Correct answer: B. Kubernetes Network Policies
Kubernetes Network Policies allow you to specify how groups of pods are allowed to communicate with each other and other network endpoints. They are ideal for enforcing granular, namespace-level network segmentation and traffic control within an AKS cluster, directly addressing the requirement to restrict traffic between pods and namespaces.
Why the other options are wrong
- A. While a Service Mesh can provide advanced traffic management and security features, Network Policies are the native Kubernetes mechanism for enforcing basic network segmentation rules between pods and namespaces and are simpler for this specific requirement.
- C. Azure Network Security Groups (NSGs) operate at the subnet level and are too broad to enforce granular, pod-to-pod or namespace-to-namespace traffic within an AKS cluster.
- D. Azure Firewall operates at the virtual network perimeter and is not designed for granular traffic control *within* an AKS cluster between pods.
Kubernetes Network Policies
Kubernetes resources that define rules for how pods communicate with each other and other network endpoints, enabling network segmentation.
- Operate at Layer 3/4 of the OSI model.
- Enforce ingress and egress rules for pods.
- Can be scoped to namespaces or specific pod labels.
Memory trick: Network Policies are the internal traffic cops for your pods.