Question 359 of 881
AKS Pod Managed Identity Access to Key Vault with Caching and Rotation
You are developing a microservices-based application deployed to Azure Kubernetes Service (AKS). One of the microservices needs to securely retrieve secrets (e.g., database connection strings) from Azure Key Vault. The application uses managed identity for authentication. You need to implement a solution that meets the following requirements: 1) The microservice should retrieve secrets from Key Vault without storing any credentials in the application code or configuration files. 2) The solution must support automatic rotation of secrets without application restart. 3) The solution should minimize latency and avoid direct calls to Key Vault on every request. 4) The application is written in .NET 8 and uses the Azure SDK. What should you do?
Quick Answer
The correct answer is to use Azure.Identity.DefaultAzureCredential with a caching and background refresh pattern. This solution authenticates the AKS pod via its managed identity to Azure Key Vault, retrieves secrets on startup, and stores them in an in-memory cache with a configurable expiration time, while a background service proactively refreshes the cache before it expires. This meets all requirements: no credentials in code, automatic secret rotation without restarting the pod, and minimal latency by avoiding direct Key Vault calls on every request. On the AZ-204 exam, this scenario tests your understanding of combining DefaultAzureCredential, SecretClient caching, and IHostedService for refresh logic—a common trap is choosing the Key Vault configuration provider, which polls but doesn't inherently support rotation without app restart or can cause latency. Remember the mnemonic "Cache, Refresh, No Restart" to recall that caching with a proactive background refresh is the key to zero-downtime secret rotation.
⚠ Common exam trap
Many exam-takers choose Option C because it seems to automatically reload secrets, but they overlook that it does not cache secrets to minimize latency on every request and may still make direct calls to Key Vault on configuration reloads, failing the latency minimization requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure.Identity.DefaultAzureCredential to authenticate to Key Vault and retrieve secrets on application startup, caching them in memory with a configurable expiration time. Use a background service to refresh the cache before expiration.
It uses DefaultAzureCredential to authenticate to Key Vault via managed identity (no credentials stored), caches secrets in memory to minimize latency and avoid direct calls on every request, and uses a background service with configurable expiration to refresh the cache before expiration, supporting automatic secret rotation without application restart.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the connection string in an environment variable in the AKS pod spec and update the variable when the secret rotates.
Why it's wrong here
Environment variables are not secure and require pod restart to pick up changes.
- ✗
Generate a client certificate in Key Vault and mount it as a volume in the AKS pod. Use the certificate to authenticate to Key Vault and retrieve secrets on each request.
Why it's wrong here
Client certificate authentication adds complexity for certificate rotation and management, and retrieving on each request increases latency.
- ✗
Use the Azure Key Vault Secrets provider for the .NET Configuration API and set reloadOnChange to true to automatically reload secrets.
Why it's wrong here
The Key Vault configuration provider polls at intervals but does not support push-based rotation; it also may cause high latency.
- ✓
Use Azure.Identity.DefaultAzureCredential to authenticate to Key Vault and retrieve secrets on application startup, caching them in memory with a configurable expiration time. Use a background service to refresh the cache before expiration.
Why this is correct
This approach uses managed identity, caches secrets, and refreshes them periodically without restarting the application.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-204
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?
easy- A.Service principal with certificate stored in the pod
- B.User-assigned managed identity on the node resource group
- C.System-assigned managed identity on AKS cluster
- ✓ D.Microsoft Entra Workload ID (formerly Azure AD Pod Identity)
Why D: Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.
Last reviewed: Jul 4, 2026
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.