Case study

Northwind Health — regulated container platform

Northwind Health runs a patient-facing intake application and several internal batch jobs on Azure Kubernetes Service, with images stored in Azure Container Registry.

A recent audit produced three findings. First, deployments reference image tags such as api:latest, and the audit could not prove which build was running in production during an incident. Second, several pods read a database password from a Kubernetes Secret that was committed to the deployment repository. Third, container images are pulled over the public internet, and the auditor requires that registry traffic never traverse it.

The intake workload is bursty: near zero overnight, then a sharp spike each morning. The batch jobs are interruptible and cost is a concern. The platform team also needs each workload to hold only the Azure permissions it actually needs, and must be able to prove which identity performed a given action.

Requirements

Provably immutable, verifiable image references in production
No long-lived secrets in the cluster or in source control
Registry traffic must not traverse the public internet
Scale to near zero overnight, absorb a morning spike
Reduce cost for interruptible batch workloads
Per-workload Azure identity with least privilege and an audit trail

Q45 AKS Domain 1 · 20–25% of exam Priority · Real Exam Choose 2

Which TWO changes remove the committed database password from the cluster while satisfying least privilege?

A Enable Workload Identity so each pod federates to its own user-assigned managed identity (correct answer)
B Mount the secret with the Secrets Store CSI Driver from Key Vault (correct answer)
C Base64-encode the password before committing it
D Grant the kubelet identity Key Vault Secrets User for all workloads
E Move the password into a ConfigMap instead

Shortcut: Workload Identity gives each pod a distinct Azure identity, so permissions are scoped per workload rather than shared. The CSI driver then delivers the secret from Key Vault at mount time, so nothing is stored in the repository. Base64 is encoding, not encryption; the kubelet identity is shared by every pod on the node and breaks least privilege; ConfigMaps are plain text.

Which TWO changes remove the committed database password from the cluster while satisfying least privilege?

More AKS questions