AZ-204 Develop Azure compute solutions Practice Question
You are troubleshooting a containerized application running on Azure Kubernetes Service (AKS). The application logs indicate that it cannot connect to an Azure SQL Database using a managed identity. The pod is configured with a user-assigned managed identity. Which step is most likely missing?
⚠ Common exam trap
Candidates often assume assigning a managed identity to a pod is sufficient, but they overlook the requirement for the AKS cluster to have the Azure AD Pod Identity add-on enabled to bridge the pod and the identity for token acquisition.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The AKS cluster does not have the Azure AD Pod Identity add-on enabled
The AKS cluster requires the Azure AD Pod Identity add-on (or the newer Workload Identity) to enable pods to authenticate to Azure resources using managed identities. Without this add-on, the pod's user-assigned managed identity cannot be used to obtain tokens for connecting to Azure SQL Database, even if the identity is correctly assigned to the pod.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure SQL Database firewall is blocking the pod IP
Why it's wrong here
"The Azure SQL Database firewall is blocking the pod IP" is incorrect because managed identities authenticate with Azure SQL Database using Azure Active Directory tokens, not by the source IP address of the pod. When using managed identity authentication, the database firewall typically only needs to allow access from Azure services or specific virtual networks, not individual pod IPs, as the authentication flow relies on Azure AD's identity verification rather than network-level IP filtering for the identity itself.
- ✗
The pod's service account is not linked to the managed identity
Why it's wrong here
"The pod's service account is not linked to the managed identity" is incorrect as the primary root cause. While linking a Kubernetes service account to an Azure managed identity is a necessary configuration step for Azure AD Pod Identity (or Azure Workload Identity), this linking mechanism fundamentally relies on the underlying add-on being enabled and operational within the AKS cluster. Without the add-on, the cluster lacks the controllers and components required to interpret and enforce such a linkage, rendering any configuration ineffective.
- ✗
The managed identity is not in the same Microsoft Entra ID tenant as the AKS cluster
Why it's wrong here
"The managed identity is not in the same Microsoft Entra ID tenant as the AKS cluster" is incorrect because managed identities are inherently tenant-scoped resources within Microsoft Entra ID. For an AKS cluster to successfully assign and leverage a user-assigned managed identity for its pods, that identity must reside within the same Microsoft Entra ID tenant that the AKS cluster is associated with. Cross-tenant identity assignments for this specific purpose are not supported, ensuring a clear security boundary and administrative domain.
- ✓
The AKS cluster does not have the Azure AD Pod Identity add-on enabled
Why this is correct
"The AKS cluster does not have the Azure AD Pod Identity add-on enabled" is the correct answer. This add-on is essential because it deploys the necessary Kubernetes components, specifically the Managed Identity Controller (MIC) and Node Managed Identity (NMI) server, which facilitate the assignment of Azure managed identities to individual pods. Without these components, pods cannot intercept token requests or acquire the required Azure AD tokens from the assigned managed identity to authenticate with Azure resources like Azure SQL Database.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.