SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

By Microsoft · Question Mode

QuestionQ3

Secure compute

You have an Azure subscription named Sub1 that contains an Azure Kubernetes Service (AKS) cluster named cluster1 and an Azure container registry named ACR1. Microsoft Defender for Containers is enabled for Sub1, and runtime protection is active on cluster1.

Your company’s developers deploy pods with elevated privileges, and those deployments are created in cluster1.

You need to prevent pods with elevated privileges from being accepted by cluster1.

What should you do?

Explanation

Azure Policy for Kubernetes can enforce admission controls in AKS. Its built-in policy, Kubernetes cluster should not allow privileged containers, prevents creation of privileged containers, whereas Defender runtime protection detects activity after deployment and image vulnerability assessment evaluates image vulnerabilities.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!