AZ-204 Implement Azure security Practice Question
You are deploying an Azure Kubernetes Service (AKS) cluster. You need to ensure that pods can access Azure resources (e.g., Azure Storage) using a managed identity without storing credentials. What should you configure?
⚠ Common exam trap
A common mix-up: candidates confuse cluster-level managed identity (used for AKS infrastructure operations) with pod-level managed identity (used for pod-to-Azure resource access), leading them to select Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.
Azure AD Workload Identity (or the older aad-pod-identity) allows you to assign an Azure managed identity to a pod. The pod can then authenticate to Azure resources (e.g., Azure Storage) without storing any credentials, as the identity is projected into the pod via token exchange with the Azure Instance Metadata Service (IMDS). This directly meets the requirement of using a managed identity without credential storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure AD Workload Identity for Kubernetes (or aad-pod-identity) to assign managed identities to pods.
Why this is correct
Azure AD Workload Identity for Kubernetes leverages Kubernetes service accounts and OpenID Connect (OIDC) federation. It allows pods to authenticate to Azure services using a user-assigned managed identity without embedding any secrets or connection strings directly into the pod configuration. This method significantly enhances security by eliminating the need for manual secret rotation and reducing the risk of credential exposure, aligning with the principle of least privilege.
- ✗
Configure Azure AD integration on the AKS cluster for user authentication.
Why it's wrong here
Configuring Azure AD integration on an AKS cluster is primarily designed for user authentication and authorization to the Kubernetes API server. This enables Azure AD users and groups to manage the cluster using `kubectl` based on their Azure AD roles and Kubernetes RBAC. It does not, however, provide an identity for the *pods* running within the cluster to authenticate to *Azure services* like Key Vault or Storage Accounts.
- ✗
Create a service principal and distribute its secret to pods as a Kubernetes secret.
Why it's wrong here
Creating a service principal and distributing its secret as a Kubernetes secret introduces significant security and operational overhead. This approach requires manual secret rotation, secure storage, and careful management of the secret's lifecycle, increasing the risk of credential compromise if not handled perfectly. Managed identities are specifically designed to abstract away this secret management complexity, making this method less secure and more cumbersome for workload authentication.
- ✗
Enable managed identity on the AKS cluster and use cluster-level identity.
Why it's wrong here
Enabling managed identity on the AKS cluster provides an identity for the cluster's control plane components, such as the Kubelet and cloud controller manager, to interact with Azure APIs for cluster operations like provisioning load balancers or managing virtual machine scale sets. This cluster-level identity is not intended for individual pods to access Azure resources, as it would grant all pods the same broad permissions as the cluster itself. This violates the principle of least privilege by providing an overly permissive identity to workloads that only require specific, granular access.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.