The canal authority wants the AKS API server projected into the cluster virtual network so hub firewall and custom DNS see that traffic, not only a private-link endpoint in a managed network. Which isolation pattern should the security engineer choose?
Select an answer to reveal the explanation.
Short Explanation
They want the API server living in their VNet so the hub firewall and DNS actually see it—that’s API Server VNet Integration, not just “authorized IPs on a public API.”
Full Explanation
API Server VNet Integration projects or integrates the AKS API server with the cluster virtual network so traffic can be observed and controlled with customer hub firewall and DNS patterns, distinct from merely locking down a public API with authorized IP ranges. Azure CNI versus kubenet is a data-plane networking choice and not a substitute for this isolation pattern. Kubernetes NetworkPolicy and service-mesh recipes are not the AZ-500 control-plane isolation answer here.