AZ-204 Develop Azure compute solutions Practice Question
You are developing a microservices application deployed on Azure Kubernetes Service (AKS). You need to ensure that service-to-service communication is encrypted using mutual TLS (mTLS) without modifying application code. What should you do?
⚠ Common exam trap
It's easy for candidates to confuse ingress-level mTLS (option B) with internal service-to-service mTLS, or assume that AKS has a built-in pod encryption feature (option C) when it does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy Azure Service Mesh and enable mTLS.
Azure Service Mesh (e.g., Open Service Mesh or Istio-based) provides a transparent infrastructure layer that can automatically inject sidecar proxies into pods and enforce mTLS for all service-to-service communication without requiring any changes to application code. This meets the requirement of encrypting traffic with mutual TLS while keeping the application code untouched.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deploy Azure Service Mesh and enable mTLS.
Why this is correct
Deploying an Azure Service Mesh, such as Open Service Mesh (OSM) or Istio on AKS, provides a robust solution for enabling mutual TLS (mTLS) transparently across microservices. A service mesh injects sidecar proxies alongside each application container, which intercept all network traffic. These proxies then handle certificate issuance, rotation, and the establishment of mTLS connections, ensuring all service-to-service communication is encrypted and authenticated without requiring application code changes.
- ✗
Use Azure Application Gateway Ingress Controller with mTLS.
Why it's wrong here
Azure Application Gateway Ingress Controller is designed to manage external ingress traffic into an AKS cluster, acting as a Layer 7 load balancer and Web Application Firewall (WAF). While Application Gateway can terminate TLS and even enforce client certificate authentication (mTLS) for *incoming* client connections, it is not intended for securing *internal* service-to-service communication within the cluster. Its primary role is at the edge, not for east-west traffic encryption.
- ✗
Enable Azure Kubernetes Service (AKS) pod-to-pod encryption.
Why it's wrong here
Azure Kubernetes Service (AKS) does not offer a native, built-in feature for transparent pod-to-pod encryption or mutual TLS (mTLS) at the application layer. While AKS ensures network isolation through CNI and encrypts data at rest and in transit for control plane components, it does not automatically encrypt the data plane traffic between pods within the cluster without additional tools. Implementing pod-to-pod encryption typically requires a service mesh or custom network overlays.
- ✗
Configure Azure Network Security Groups to enforce encryption.
Why it's wrong here
Azure Network Security Groups (NSGs) operate at the network layer (Layer 3 and 4 of the OSI model), functioning as stateless packet filters based on IP addresses, ports, and protocols. NSGs are designed to control network access by allowing or denying traffic, but they do not provide any encryption capabilities, identity verification, or certificate management required for mutual TLS (mTLS). They cannot inspect application-layer traffic to enforce encryption.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.