Application registration is for enabling the applications to authenticate users via Azure AD, it has nothing to do with AKS cluster. So the first one should be creating the cluster.

Step 1: Create an AKS cluster -

Step 2: a system-assigned managed identity

To create an RBAC binding, you first need to get the Azure AD Object ID.

1. Sign in to the Azure portal.

2. In the search field at the top of the page, enter Azure Active Directory.

3. Click Enter.

4. In the Manage menu, select Users.

5. In the name field, search for your account.

6. In the Name column, select the link to your account.

7. In the Identity section, copy the Object ID.

Step 3: a RBAC binding -

Reference:

https://docs.microsoft.com/en-us/azure/developer/ansible/aks-configure-rbac

Box 1: ARM

ARM: In DevOps > Project Settings > Service connections, click New service connection. The list is your possible "Service connection types". If you select the one containing "Team Foundation Server", the next page requires a PAT, which does not fulfil one of the requirements.

Box 2: Managed Service Identity Authentication

The managed identities for Azure resources feature in Azure Active Directory (Azure AD) provides Azure services with an automatically managed identity in Azure

AD. You can use the identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without any credentials in your code.

Reference:

https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-key-vault

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

BE: An app deployed to Azure can take advantage of Managed identities for Azure resources, which allows the app to authenticate with Azure Key Vault using

Azure AD authentication without credentials (Application ID and Password/Client Secret) stored in the app.

C:

1. Select Add Access Policy.

2. Open Secret permissions and provide the app with Get and List permissions.

3. Select Select principal and select the registered app by name. Select the Select button.

4. Select OK.

5. Select Save.

6. Deploy the app.

Reference:

https://docs.microsoft.com/en-us/aspnet/core/security/key-vault-configuration

Box 1: Microsoft Visual Studio App Center distribution Groups

Distribution Groups are used to control access to releases. A Distribution Group represents a set of users that can be managed jointly and can have common access to releases. Example of Distribution Groups can be teams of users, like the QA Team or External Beta Testers or can represent stages or rings of releases, such as Staging.

Box 2: Shared -

Shared distribution groups are private or public distribution groups that are shared across multiple apps in a single organization. Shared distribution groups eliminate the need to replicate distribution groups across multiple apps.

Note: With the Deploy with App Center Task in Visual Studio Team Services, you can deploy your apps from Azure DevOps (formerly known as VSTS) to App

Center. By deploying to App Center, you will be able to distribute your builds to your users.

Reference:

https://docs.microsoft.com/en-us/appcenter/distribution/groups

For this scenario you don't need an access policy. you can use a service connection to you azure subscription.

https://docs.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&tabs=yaml#link-secrets-from-an-azure-key-vault

You can make use of Conditional access in Azure AD. You would first ensure the devices are joined to Azure AD. Then in Conditional access , you can set the policy to only allow access if the device is joined to Azure AD.

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

The policy is not going to apply to the existing resources, unless you run a remediation task to force the policy to all the existing resourcesThis is the reason why the correct answer is B: "During evaluation of existing resources, resources that match a deny policy definition are marked as non-compliant"

https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#deny

Because in a variable group you can link a key vault. Then you can make the group available to everyone. This way you can ensure that every pipeline can use the variables. Better useability then using tasks in every pipeline.

https://docs.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&tabs=yaml#link-secrets-from-an-azure-key-vault