- A
Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.
Pod identity provides managed identity; API validates tokens and checks scope.
- B
Store the storage account access keys in the API configuration and validate requests using shared access signatures.
Why wrong: SAS does not provide user authentication or scope validation.
- C
Configure the API to use client certificate authentication instead of tokens.
Why wrong: Client certificates are not token-based and do not support scope claims.
- D
Expose the API through Azure API Management (APIM) and configure APIM to validate tokens and check scope.
Why wrong: APIM can validate tokens but adds unnecessary complexity; the API can do it directly.
Quick Answer
The correct approach is to use Azure AD pod identity in AKS to assign a managed identity to the pod, combined with the Microsoft.Identity.Web library for token validation in the API code. This works because Azure AD pod identity securely maps a managed identity to individual pods, allowing the stateless, horizontally scaling web API to authenticate with Microsoft Entra ID without storing any secrets. The Microsoft.Identity.Web library then handles token validation and scope enforcement—specifically the 'Files.Upload' scope—directly in the ASP.NET Core middleware, which is essential for a microservice that processes user uploads to Blob Storage. On the AZ-204 exam, this scenario tests your understanding of managed identities for AKS workloads versus traditional client secrets or certificates, and it often appears as a trap where you might mistakenly choose an App Registration with a secret. The key memory tip is "Pod Identity + Identity.Web = no secrets, just scopes."
AZ-204 Develop Azure compute solutions Practice Question
This AZ-204 practice question tests your understanding of develop azure compute solutions. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Your company develops a microservices-based application deployed on Azure Kubernetes Service (AKS). One of the microservices is a web API that processes user uploads and stores them in Azure Blob Storage. The API is stateless and scales horizontally. You need to implement authentication and authorization for the API using Microsoft Entra ID. The API should validate tokens issued by Entra ID and allow only users with the 'Files.Upload' scope. You need to configure the API's code and AKS deployment accordingly. Which approach should you use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.
Option A is correct because Azure AD pod identity allows you to assign a managed identity to the pod, which the API can use to authenticate with Microsoft Entra ID. The Microsoft.Identity.Web library simplifies token validation and scope checking in ASP.NET Core applications, enabling the API to validate tokens issued by Entra ID and enforce the 'Files.Upload' scope. This approach aligns with the stateless, horizontally scalable nature of the microservice and avoids managing secrets.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library.
Why this is correct
Pod identity provides managed identity; API validates tokens and checks scope.
Related concept
Read the scenario before looking for a memorised answer.
- ✗
Store the storage account access keys in the API configuration and validate requests using shared access signatures.
Why it's wrong here
SAS does not provide user authentication or scope validation.
- ✗
Configure the API to use client certificate authentication instead of tokens.
Why it's wrong here
Client certificates are not token-based and do not support scope claims.
- ✗
Expose the API through Azure API Management (APIM) and configure APIM to validate tokens and check scope.
Why it's wrong here
APIM can validate tokens but adds unnecessary complexity; the API can do it directly.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may think Azure API Management (APIM) is required for token validation in AKS, but the question explicitly asks for configuring the API's code and AKS deployment, making the pod identity and library approach the correct in-code solution without an extra gateway.
Detailed technical explanation
How to think about this question
Azure AD pod identity works by injecting an Azure AD token into the pod via a mutating admission webhook, which the Microsoft.Identity.Web library can use to validate incoming bearer tokens. The library automatically handles token validation, including issuer, audience, and scope checks, by reading the OpenID Connect metadata from the Entra ID tenant. In a real-world scenario, this setup ensures that only authenticated users with the specific 'Files.Upload' permission can upload files, while the pod identity avoids hardcoding credentials in the deployment.
KKey Concepts to Remember
- Read the scenario before looking for a memorised answer.
- Find the constraint that changes the correct option.
- Eliminate answers that are true in general but not in this case.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A media company stores terabytes of video archives that are accessed once a year for audit purposes. Moving these objects to a cold storage tier (Azure Archive, S3 Glacier, or Google Nearline) costs a fraction of hot storage. Questions like this test whether you understand storage tiers, access frequency tradeoffs, and retrieval latency requirements.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
- →
Develop Azure compute solutions — study guide chapter
Learn the concepts, then practise the questions
- →
Develop Azure compute solutions practice questions
Targeted practice on this topic area only
- →
All AZ-204 questions
997 questions across all exam domains
- →
Microsoft Azure Developer Associate AZ-204 study guide
Full concept coverage aligned to exam objectives
- →
AZ-204 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related AZ-204 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Develop Azure compute solutions practice questions
Practise AZ-204 questions linked to Develop Azure compute solutions.
Develop for Azure storage practice questions
Practise AZ-204 questions linked to Develop for Azure storage.
Implement Azure security practice questions
Practise AZ-204 questions linked to Implement Azure security.
Connect to and consume Azure services and third-party services practice questions
Practise AZ-204 questions linked to Connect to and consume Azure services and third-party services.
Monitor, troubleshoot, and optimize Azure solutions practice questions
Practise AZ-204 questions linked to Monitor, troubleshoot, and optimize Azure solutions.
AZ-204 fundamentals practice questions
Practise AZ-204 questions linked to AZ-204 fundamentals.
AZ-204 scenario practice questions
Practise AZ-204 questions linked to AZ-204 scenario.
AZ-204 troubleshooting practice questions
Practise AZ-204 questions linked to AZ-204 troubleshooting.
Practice this exam
Start a free AZ-204 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this AZ-204 question test?
Develop Azure compute solutions — This question tests Develop Azure compute solutions — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use Azure AD pod identity in AKS to assign a managed identity to the pod, and implement token validation in the API code using the Microsoft.Identity.Web library. — Option A is correct because Azure AD pod identity allows you to assign a managed identity to the pod, which the API can use to authenticate with Microsoft Entra ID. The Microsoft.Identity.Web library simplifies token validation and scope checking in ASP.NET Core applications, enabling the API to validate tokens issued by Entra ID and enforce the 'Files.Upload' scope. This approach aligns with the stateless, horizontally scalable nature of the microservice and avoids managing secrets.
What should I do if I get this AZ-204 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.