AZ-204 Develop Azure compute solutions Practice Question
Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). One of the microservices is a web API that processes user uploads and stores them in Azure Blob Storage. The API is stateless and scales horizontally. You need to implement authentication and authorization for the API using Microsoft Entra ID. The API should validate tokens issued by Entra ID and allow only users with the 'Files.Upload' scope. You need to configure the API's code and AKS deployment accordingly. Which approach should you use?
⚠ Common exam trap
Watch out — candidates often think Azure API Management (APIM) is required for token validation in AKS, but the question explicitly asks for configuring the API's code and AKS deployment, making the pod identity and library approach the correct in-code solution without an extra gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.
Azure AD pod identity allows you to assign a managed identity to the pod, which the API can use to authenticate with Microsoft Entra ID. The Microsoft.Identity.Web library simplifies token validation and scope checking in ASP.NET Core applications, enabling the API to validate tokens issued by Entra ID and enforce the 'Files.Upload' scope. This approach aligns with the stateless, horizontally scalable nature of the microservice and avoids managing secrets.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.
Why this is correct
Azure AD pod identity in AKS securely assigns a managed identity to a Kubernetes pod, eliminating the need for hardcoded credentials when the microservice needs to access other Azure resources. For incoming API requests, the Microsoft.Identity.Web library provides a robust framework within the API code to validate JSON Web Tokens (JWTs), ensuring their authenticity, integrity, and crucially, checking the 'scope' claims to enforce fine-grained authorization based on the caller's permissions. This approach aligns with modern secure development practices by leveraging managed identities and explicit token-based authorization.
- ✗
Store the storage account access keys in the API configuration and validate requests using shared access signatures.
Why it's wrong here
Storing storage account access keys directly in API configuration is a significant security vulnerability, as it grants full control over the storage account if compromised. While shared access signatures (SAS) provide delegated, time-limited access to specific storage resources, they are designed for resource access, not for authenticating users or validating general API requests based on user identity and scope claims. SAS tokens do not carry user identity information or authorization scopes relevant to the API's business logic, making them unsuitable for robust API authentication and authorization.
- ✗
Configure the API to use client certificate authentication instead of tokens.
Why it's wrong here
Configuring the API to use client certificate authentication provides mutual TLS, establishing trust between the client and the API by verifying their respective certificates. However, client certificates are primarily an authentication mechanism for the client application itself and are not designed to carry granular authorization information like 'scope' claims, which are essential for modern, fine-grained access control in microservices. Managing client certificates at scale for individual user identities or dynamic authorization requirements becomes complex and less flexible compared to token-based systems.
- ✗
Expose the API through Azure API Management (APIM) and configure APIM to validate tokens and check scope.
Why it's wrong here
While Azure API Management (APIM) is capable of validating tokens and checking scopes as a gateway, relying solely on APIM for this core security function introduces an unnecessary layer of dependency and complexity for the microservice itself. A microservice should ideally be self-sufficient in validating its own incoming requests, including authorization, to maintain its autonomy and resilience within a microservices architecture. Offloading all authorization logic to APIM can lead to a 'thin API' that implicitly trusts its gateway, potentially weakening the overall security posture and making the microservice less portable or robust if deployed outside of APIM.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.