You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements: - Manages secrets - Provides encryption - Secures service-to-service communication by using mTLS encryption - Minimizes administrative effort What should you include in the recommendation?

Microsoft

SC-100 · Question #253

You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following…

The correct answer is D. Istio. Istio is the correct choice because it is a full-featured service mesh for Kubernetes that natively addresses all stated requirements with minimal administrative effort when deployed as an AKS add-on. Istio provides automatic mutual TLS (mTLS) between services (zero-trust…

Design security solutions for applications and data

Question

You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements:

Manages secrets
Provides encryption
Secures service-to-service communication by using mTLS encryption
Minimizes administrative effort

What should you include in the recommendation?

Options

AFlux
BEnvoy
CDapr
DIstio

How the community answered

(20 responses)

A
5% (1)
B
10% (2)
C
5% (1)
D
80% (16)

Explanation

Istio is the correct choice because it is a full-featured service mesh for Kubernetes that natively addresses all stated requirements with minimal administrative effort when deployed as an AKS add-on. Istio provides automatic mutual TLS (mTLS) between services (zero-trust service-to-service encryption and authentication), integrates with external secrets managers, and enforces traffic encryption transparently via sidecar proxies - without requiring code changes in the microservices themselves. Flux (A) is a GitOps continuous delivery tool with no security/encryption features. Envoy (B) is the underlying proxy used by service meshes, but it is not a complete solution - it requires significant manual configuration for mTLS and secrets management. Dapr (C) provides some security primitives and secrets management but does not natively provide automatic mTLS service mesh capabilities at the level Istio does.

Topics

#Service Mesh#mTLS#Microservices Security#AKS Security

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice