AZ-204 Develop Azure compute solutions Practice Question
Your company develops a multi-tenant SaaS application hosted on Azure Kubernetes Service (AKS). Each tenant has isolated compute resources. You need to ensure that no single tenant can consume all cluster resources and affect others. You also want to optimize resource utilization by packing pods efficiently. You evaluate the following approaches: A) Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing. B) Deploy each tenant to a separate AKS cluster. C) Use Azure Policy to enforce pod resource limits. D) Use a service mesh to control traffic between tenants. Which approach should you recommend?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Policy (which enforces pod-level limits) with namespace-level resource quotas, missing that quotas are the correct mechanism for tenant-level aggregate resource isolation in a shared cluster.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing.
Namespace resource quotas per tenant provide hard limits on compute resources (CPU, memory) and object counts, preventing any single tenant from exhausting cluster resources. The Kubernetes scheduler then efficiently packs pods within those quotas, optimizing utilization without manual intervention. This approach balances isolation and resource efficiency in a multi-tenant AKS environment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use namespace resource quotas per tenant and let the Kubernetes scheduler handle packing.
Why this is correct
Using namespace resource quotas per tenant is the most effective and efficient strategy for multi-tenant SaaS applications on Kubernetes. By assigning each tenant a dedicated namespace with a ResourceQuota, you define the maximum aggregate CPU, memory, and storage resources that all pods within that tenant's namespace can consume. The Kubernetes scheduler then intelligently places pods across available nodes, optimizing resource utilization and ensuring fair sharing while preventing any single tenant from monopolizing cluster resources. This approach provides strong logical isolation and cost efficiency.
- ✗
Use a service mesh to control traffic between tenants.
Why it's wrong here
A service mesh, such as Istio or Linkerd, primarily focuses on managing and securing network traffic between services at the application layer (L7). While it can enforce fine-grained access policies and provide observability for inter-tenant communication, it does not provide fundamental resource isolation for CPU, memory, or storage. A service mesh operates above the resource allocation layer, meaning it cannot prevent a tenant's services from consuming excessive underlying compute resources, which is crucial for multi-tenancy.
- ✗
Use Azure Policy to enforce pod resource limits.
Why it's wrong here
Azure Policy can enforce standards and compliance across Azure resources, including defining requirements for Kubernetes cluster configurations or ensuring pods have resource requests and limits set. However, Azure Policy operates at a higher control plane level and cannot directly enforce aggregate resource consumption limits per tenant within a running Kubernetes cluster. While it can mandate that individual pods specify limits, it lacks the capability to sum up resource usage across all pods in a tenant's namespace and prevent new pods from scheduling if the tenant's total quota is exceeded, which is a core function of Kubernetes ResourceQuota.
- ✗
Deploy each tenant to a separate AKS cluster.
Why it's wrong here
Deploying each tenant to a separate AKS cluster provides the highest level of isolation but is an extremely expensive and operationally complex solution for a multi-tenant SaaS application. Managing numerous independent clusters significantly increases infrastructure costs, maintenance overhead, and deployment complexity. This approach negates the primary benefits of Kubernetes, such as efficient resource sharing and simplified management across a shared control plane, making it impractical for scaling a typical SaaS offering.
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.