Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
You are deploying a microservice that needs to read secrets (e.g., connection strings) from Azure Key Vault. The service runs on Azure Kubernetes Service (AKS). You want to minimize code changes and automatically rotate secrets. Which approach should you use?
⚠ Common exam trap
A common mix-up: candidates choose Option A (SDK) because it's a common pattern, but the question specifically asks to minimize code changes and automatically rotate secrets, which the CSI driver achieves without any code modifications.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Azure Key Vault Provider for Secrets Store CSI Driver on AKS.
The Azure Key Vault Provider for Secrets Store CSI Driver mounts secrets as volumes or environment variables in AKS pods without requiring application code changes. It automatically rotates secrets by syncing with Key Vault at a configurable polling interval, minimizing code changes and enabling seamless secret rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use the Azure Key Vault SDK in the application code to fetch secrets.
Why it's wrong here
Using the Azure Key Vault SDK directly in application code requires adding specific library dependencies and writing boilerplate code for authentication, retrieval, and error handling. This approach tightly couples the application to Key Vault, making it less portable and harder to manage in a Kubernetes-native environment. Furthermore, developers must implement custom logic to periodically refresh secrets, increasing complexity and the risk of using stale credentials if not handled meticulously.
- ✗
Store secrets as environment variables in the container image.
Why it's wrong here
Storing secrets as environment variables directly within the container image is a significant security vulnerability because these values become immutable parts of the image layer and can be easily extracted through image inspection. This method also completely lacks any mechanism for automatic secret rotation or dynamic updates, necessitating a full image rebuild and redeployment for every secret change, which is operationally inefficient and error-prone.
- ✓
Use the Azure Key Vault Provider for Secrets Store CSI Driver on AKS.
Why this is correct
The Azure Key Vault Provider for Secrets Store CSI Driver on AKS offers a secure and Kubernetes-native method to access secrets by mounting them directly into pods as files within a volume or injecting them as environment variables. This solution leverages Managed Identities for secure access to Key Vault and supports automatic secret rotation and refreshing without requiring any application code changes or pod restarts. It effectively decouples secret management from the application, enhancing security and operational agility.
- ✗
Use Azure App Configuration with Key Vault references.
Why it's wrong here
While Azure App Configuration can store references to Key Vault secrets, its primary function is managing application configuration settings, not directly serving as a secure secret injection mechanism for microservices. Utilizing this approach still typically requires an SDK within the application to resolve these references, meaning the application code must explicitly fetch the underlying secret from Key Vault, which doesn't fully abstract secret management from the application layer.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.