SC-100 Design security solutions for infrastructure Practice Question
A company wants to secure its Azure Kubernetes Service (AKS) cluster. They need to ensure that pods cannot communicate with each other unless explicitly allowed, and that secrets are encrypted at rest. Which TWO security controls should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Key Vault with Secrets Store CSI driver for secret management.
Correct answers: A and C. Network policies in Kubernetes can restrict pod-to-pod communication, and Azure Key Vault with CSI driver allows secrets to be encrypted and stored externally. Option B is incorrect: Azure Policy can enforce image source restrictions, but that does not address pod communication or secret encryption. Option D is incorrect: Container insights is for monitoring, not for network restrictions or encryption. Option E is incorrect: Azure AD integration is for authentication, not for network or encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use Azure Key Vault with Secrets Store CSI driver for secret management.
Why this is correct
Azure Key Vault with the Secrets Store CSI driver securely injects secrets as mounted volumes, using the Kubernetes CSI interface. It stores secret material in Azure Key Vault—encrypted at rest with managed keys—while pods access it via managed identities or workload identity, eliminating the need to bake secrets into images, etcd, or environment variables. This provides robust secret management, including rotation and audit logging.
- ✗
Apply Azure Policy to restrict container image sources.
Why it's wrong here
Applying Azure Policy to restrict container image sources enforces supply-chain governance by only allowing deployments from authorized registries. However, this control operates at admission time and does not affect runtime data-plane security: it neither filters pod-to-pod traffic nor manages sensitive configuration data such as keys and connection strings. Therefore, it cannot address the secret-management gap that the question targets.
- ✓
Define Kubernetes network policies to restrict pod-to-pod traffic.
Why this is correct
Kubernetes network policies (backed by Azure NPM or Calico) define allow/deny rules based on pod labels, namespaces, and ports, enabling micro-segmentation within an AKS cluster. This restricts east-west traffic so compromised workloads are contained and cannot propagate laterally to other services. It is a fundamental security control for cluster-wide isolation, though it focuses on the network layer, not secret storage.
- ✗
Enable Container insights for monitoring.
Why it's wrong here
Enabling Container Insights on an AKS cluster provides comprehensive telemetry—CPU, memory, disk, and container logs—through Azure Monitor. While this is essential for detecting anomalies and investigating security incidents, it is purely observational: it does not block malicious traffic, encrypt data, or enforce access controls. Thus, it improves visibility but does not directly secure the cluster or its secrets.
- ✗
Enable Azure AD integration for the AKS cluster.
Why it's wrong here
Azure AD integration authenticates users and groups into the AKS control plane, enabling Kubernetes RBAC for authorization to manage cluster resources. This is a critical identity-control for administrators and developers, but it has no bearing on application-level secrets: it neither encrypts secrets at rest or in transit, nor does it provide a mechanism for workloads to safely retrieve credentials. It only authenticates humans or principals, not pod-to-pod security or secret storage.
Go deeper
Related to this question
About these practice questions
One of 208 original SC-100 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.