AZ-204 Develop Azure compute solutions Practice Question
Your company develops a microservices application deployed to Azure Kubernetes Service (AKS). You need to enable secure communication between services using managed identities. Which Azure service should you use to manage the identities and access control for the pods?
⚠ Common exam trap
Candidates often confuse Azure Key Vault (a secret store) with identity management, but Key Vault cannot authenticate pods—it requires an identity service like Workload ID to grant access to its secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Workload ID
Microsoft Entra Workload ID (formerly Azure AD Workload Identity) is the correct choice because it integrates with Kubernetes to automatically project an Microsoft Entra ID-managed identity into each pod. This allows pods to authenticate to Azure resources (e.g., Key Vault, Storage) without managing secrets, using federated identity credentials that map a Kubernetes service account to an Microsoft Entra ID application or user-assigned managed identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Service Bus
Why it's wrong here
Azure Service Bus is a fully managed enterprise integration message broker, designed for reliable, asynchronous messaging between decoupled applications and microservices. It provides queues and topics for message delivery, enabling complex communication patterns like publish/subscribe. However, Service Bus does not provide mechanisms to assign or manage identities for workloads, such as AKS pods, to securely authenticate to other Azure resources.
- ✓
Microsoft Entra Workload ID
Why this is correct
Microsoft Entra Workload ID for Kubernetes enables Kubernetes pods to authenticate to Azure resources using a Microsoft Entra ID application and service principal, without needing to manage secrets. It leverages Kubernetes service accounts and federated identity credentials to allow pods to obtain tokens directly from Microsoft Entra ID. This facilitates secure, fine-grained access control for microservices within an AKS cluster, eliminating the need for manual secret rotation and enhancing the security posture.
- ✗
Azure Key Vault
Why it's wrong here
Azure Key Vault is a cloud service for securely storing and managing sensitive information such as API keys, database connection strings, cryptographic keys, and X.509 certificates. While applications can retrieve secrets from Key Vault, Key Vault itself does not assign identities to application components like AKS pods. Its primary function is secure secret storage and management, not identity provisioning or authentication for workloads.
- ✗
Azure Policy
Why it's wrong here
Azure Policy is a service used to create, assign, and manage policies that enforce rules and effects on your Azure resources, ensuring compliance with corporate standards and service level agreements. It can, for example, audit resource configurations or restrict resource deployments based on defined criteria. However, Azure Policy's role is governance and compliance enforcement across your Azure environment, not the provisioning or management of runtime identities for application workloads such as assigning managed identities to AKS pods.
Go deeper
Related to this question
Learn chapter
Service Bus Dead-Letter Queues
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Microsoft Entra ID authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 883-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.