AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your company is building a microservices application on Azure Kubernetes Service (AKS). The application must securely access Azure Key Vault to retrieve secrets. Which identity type should you use for the pods?
⚠ Common exam trap
Test-takers frequently confuse the cluster-level managed identity (system-assigned or user-assigned) with pod-level identity, assuming that a managed identity on the AKS cluster or its nodes can be directly used by pods, when in fact Microsoft Entra Workload ID is the correct mechanism for pod-level identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Microsoft Entra Workload ID (formerly Azure AD Pod Identity)
Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended identity type for pods in AKS because it directly maps an Azure managed identity to a pod, allowing the pod to authenticate to Azure Key Vault without storing any credentials. It integrates with the Kubernetes native service account token projection and uses federated identity credentials, eliminating the need for manual secret management or node-level configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Service principal with certificate stored in the pod
Why it's wrong here
Storing a certificate inside the pod violates the zero-trust principle of AKS by embedding long-lived credentials in the container image or volume, whereas the scenario demands a managed identity that rotates credentials automatically and requires no secret management in the pod. This option is tempting because a service principal with a certificate is a traditional, widely understood method for authenticating an application to Azure services, and it would be correct for a non-Kubernetes workload running on a virtual machine where you can securely store the certificate outside the pod.
- ✗
User-assigned managed identity on the node resource group
Why it's wrong here
Assigning a user-assigned managed identity to the node resource group provides identity at the resource group level, not directly to individual pods running within the AKS cluster. Pods require a more granular mechanism to assume an identity for secure access to Azure services, as identities at the resource group level are too broad and not designed for pod-level authentication. This approach would not enable specific application pods to authenticate independently.
- ✗
System-assigned managed identity on AKS cluster
Why it's wrong here
A system-assigned managed identity is intrinsically tied to the lifecycle of the AKS cluster's control plane itself, not to the application pods deployed within it. While the cluster can leverage this identity for internal operations like managing infrastructure, it does not provide a mechanism for individual application pods to acquire their own distinct identity for accessing external Azure services. Pods need a dedicated identity solution for fine-grained access control.
- ✓
Microsoft Entra Workload ID (formerly Azure AD Pod Identity)
Why this is correct
Microsoft Entra Workload ID (formerly Azure AD Pod Identity) is the recommended and most secure approach for enabling applications running in AKS pods to authenticate to Azure services. It allows a Kubernetes service account to be federated with a managed identity in Microsoft Entra ID, enabling pods to securely obtain Azure AD tokens without managing any secrets. This provides fine-grained, pod-level identity for accessing Azure resources, adhering to the principle of least privilege.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.