AI-102 Plan and manage an Azure AI solution Practice Question
You are planning to deploy an Azure AI Services multi-service resource. You need to ensure that the resource can be used by applications running in an Azure Kubernetes Service (AKS) cluster without embedding keys in the application code. What should you do?
⚠ Common exam trap
The trap here is assuming that enabling a managed identity on the AKS cluster is enough, when in fact you must configure workload identity to make that identity available to the pods.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Microsoft Entra ID Pod Identity or Workload Identity for the AKS cluster and assign the Cognitive Services User role to the identity on the Azure AI Services resource.
To enable keyless authentication for applications in AKS, you should use Microsoft Entra ID Workload Identity (or Pod Identity) to associate a managed identity with the pods. That identity must be granted the Cognitive Services User role on the Azure AI Services resource. The application can then use DefaultAzureCredential to obtain a token and call the service without any keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the Azure AI Services key in a Kubernetes secret and mount it as an environment variable in the application pods.
Why it's wrong here
Storing the key in a Kubernetes secret still embeds the key in the cluster and exposes it to the application. The requirement is to avoid embedding keys in application code, but using a secret does not eliminate key usage. It also introduces secret management overhead and does not provide keyless authentication.
- ✓
Configure Microsoft Entra ID Pod Identity or Workload Identity for the AKS cluster and assign the Cognitive Services User role to the identity on the Azure AI Services resource.
Why this is correct
Workload Identity (or the older Pod Identity) allows Kubernetes pods to use a managed identity to authenticate to Azure services. By assigning the Cognitive Services User role to that identity on the Azure AI Services resource, the application can obtain a token from Microsoft Entra ID and call the service without any keys. This meets the keyless requirement.
- ✗
Enable a system-assigned managed identity on the AKS cluster and assign the Cognitive Services User role to it on the Azure AI Services resource.
Why it's wrong here
Enabling a managed identity on the AKS cluster itself does not automatically make it available to pods. You would need to configure workload identity or pod identity to associate the identity with the application. Simply enabling it on the cluster and assigning a role is insufficient for the pods to authenticate without keys.
- ✗
Use Azure Key Vault to store the Azure AI Services key and retrieve it at runtime by using the AKS cluster's managed identity.
Why it's wrong here
This approach still relies on an API key to call Azure AI Services, which means the key is used in the application. The requirement is to avoid embedding keys in code, but retrieving a key from Key Vault and using it still involves key-based authentication. It does not achieve keyless authentication.
Go deeper
Related to this question
About these practice questions
One of 761 original AI-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.