AZ-204 Implement Azure security Practice Question
Your application runs on Azure Kubernetes Service (AKS). It needs to access Azure Key Vault secrets. You want to avoid using a service principal. Which solution should you implement?
⚠ Common exam trap
Test-takers frequently confuse Helm charts or ConfigMaps as valid secret injection methods, overlooking that they lack native secure integration with Azure Key Vault and still require explicit authentication credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy the Secrets Store CSI Driver with workload identity
The Secrets Store CSI Driver with workload identity allows your AKS pods to securely access Azure Key Vault secrets without managing a separate service principal. Workload identity uses Azure AD pod-managed identities or federated identity credentials to authenticate directly to Key Vault, eliminating the need for explicit service principal credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Mount secrets as a ConfigMap from Key Vault
Why it's wrong here
ConfigMaps are designed for non-confidential configuration data and store values as unencrypted key-value pairs within Kubernetes. They offer no inherent encryption at rest or direct integration mechanism to securely retrieve secrets from Azure Key Vault, making them unsuitable for sensitive information like database credentials or API keys. Attempting to store Key Vault secrets in a ConfigMap would require manual retrieval and injection, compromising the security posture.
- ✗
Create a service principal and assign it to the AKS cluster
Why it's wrong here
Creating a service principal and assigning it to the AKS cluster introduces a new secret management burden, as the service principal itself relies on a client secret (password or certificate) for authentication. This approach merely shifts the problem of managing sensitive credentials from application secrets to the service principal's credentials, which still require secure storage, rotation, and lifecycle management. It does not eliminate the need for managing secrets but rather displaces it to a different layer.
- ✓
Deploy the Secrets Store CSI Driver with workload identity
Why this is correct
Deploying the Secrets Store CSI Driver with Azure Workload Identity is the recommended and most secure approach for AKS pods to access secrets stored in Azure Key Vault. This solution allows pods to authenticate to Azure Key Vault using an Azure Active Directory managed identity, eliminating the need for any Kubernetes Secrets or service principal credentials. The driver then projects the secrets directly into the pod's filesystem as a mounted volume, ensuring they are never exposed as environment variables or stored insecurely within Kubernetes.
- ✗
Use a Helm chart to inject secrets
Why it's wrong here
While Helm charts are excellent for packaging and deploying Kubernetes applications, they are not designed to securely retrieve or manage secrets from external stores like Azure Key Vault. A Helm chart can deploy a Kubernetes Secret resource, but it would require the secret's value to be provided during deployment, either directly in the chart or via `values.yaml`, which is insecure for sensitive data. This method does not establish a dynamic, secure connection to Key Vault for on-demand secret access or rotation.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.