AZ-204 Implement Azure security Practice Question
You are deploying a sensitive application on Azure Kubernetes Service (AKS). You need to ensure that secrets, such as database connection strings, are encrypted at rest and in transit, and that the cluster has no static credentials. Which feature should you enable?
⚠ Common exam trap
A common mix-up: candidates confuse encryption at rest (e.g., etcd encryption or disk encryption) with the broader requirement of eliminating static credentials and securing secrets in transit, leading them to pick A or B instead of the integrated solution D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault Provider for Secrets Store CSI Driver
The Azure Key Vault Provider for Secrets Store CSI Driver integrates with AKS to securely fetch secrets from Azure Key Vault, encrypting them at rest (Key Vault uses AES-256) and in transit (TLS 1.2+). It eliminates static credentials by using a managed identity or service principal to authenticate to Key Vault, ensuring no secrets are stored on disk or in etcd.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable etcd encryption at rest
Why it's wrong here
While enabling etcd encryption at rest protects the Kubernetes key-value store where cluster state and secrets are stored, it does not prevent the secrets from being present within the etcd database itself. The primary goal for sensitive applications is to avoid storing secrets directly in the cluster's etcd, even if encrypted, to minimize the attack surface. This method encrypts the storage medium but does not eliminate the secret's presence in the cluster's control plane.
- ✗
Enable Azure Disk Encryption on the node pools
Why it's wrong here
Enabling Azure Disk Encryption (ADE) on node pools encrypts the OS and data disks attached to the virtual machines that comprise the AKS worker nodes. This is a vital security measure for data at rest on the nodes, protecting against unauthorized physical access to the underlying disks. However, ADE does not address the fundamental issue of secrets being stored within the cluster's etcd or as Kubernetes Secret objects, which remain accessible to authorized cluster components and users, even if the underlying disk is encrypted.
- ✗
Assign a managed identity to the AKS cluster
Why it's wrong here
Assigning a managed identity to the AKS cluster provides an identity for the cluster to authenticate to other Azure services, such as Azure Key Vault or Azure Container Registry, without needing to manage credentials directly. While essential for secure service-to-service communication and a prerequisite for the correct solution, a managed identity itself is an authentication mechanism. It does not provide a solution for securely storing application secrets or preventing them from being present within the Kubernetes cluster's etcd database.
- ✓
Use Azure Key Vault Provider for Secrets Store CSI Driver
Why this is correct
The Azure Key Vault Provider for Secrets Store CSI Driver allows Kubernetes pods to retrieve secrets, keys, and certificates directly from Azure Key Vault and mount them as a volume within the pod's filesystem. This approach ensures that sensitive data is never persisted within the AKS cluster's etcd or as native Kubernetes Secret objects. Instead, secrets are fetched on demand and presented to the application through a secure, ephemeral file system, significantly reducing the risk of secret exposure within the cluster and enhancing overall security posture.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.