SC-100 Azure Policy for AKS Practice Question
A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.
It leverages Azure Policy to enforce encryption and network policies at the cluster level, while Azure SQL Database's TDE and Always Encrypted provide encryption at rest and in transit. This combination meets PCI DSS requirements for data encryption and network segmentation in AKS. Option A is wrong because App Service Environment is not used for AKS; the question specifies AKS. Option B is wrong because Service Endpoints do not encrypt traffic and provide limited segmentation compared to private endpoints. Option C is wrong because Azure Firewall is a network firewall and does not enforce encryption or network policies within the AKS cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.
Why it's wrong here
Deploying in an ASE with a private endpoint provides network isolation but does not enforce encryption policies within AKS. SQL Server encryption is not specific to Azure SQL Database's TDE and Always Encrypted, and this option does not ensure data in transit encryption for all traffic.
- ✗
Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.
Why it's wrong here
Using Azure Service Endpoints does not encrypt in-transit traffic application-level and does not provide network segmentation within AKS. TDE alone encrypts data at rest but not in transit or in use, and does not enforce policies.
- ✗
Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.
Why it's wrong here
Deploying Azure Firewall at the AKS perimeter provides network-level filtering and DDoS protection, but it operates outside the cluster and cannot enforce Kubernetes NetworkPolicy for pod-to-pod microsegmentation; Azure Policy for AKS is required to audit and enforce those in-cluster controls. Additionally, terminating SSL/TLS at the firewall creates a decrypted chokepoint, so data travels in plaintext between the firewall and the AKS ingress unless re-encrypted, which fails to guarantee end-to-end in-transit encryption for the full data path. This option also omits any encryption of data at rest; Azure SQL Database needs TDE and Always Encrypted to satisfy PCI DSS, not just a firewall. Thus, while a firewall is a useful security component, by itself it does not meet the stated encryption and policy requirements.
- ✓
Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.
Why this is correct
Azure Policy enforces encryption and network policies in AKS, ensuring data encryption and network segmentation. Enabling TDE and Always Encrypted on Azure SQL Database encrypts data at rest and in use, meeting PCI DSS requirements comprehensively.
Go deeper
Related to this question
About these practice questions
This SC-100 question is part of Courseiva's 208-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-100 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-100 exam.