Using Dapr to manage secrets and mTLS for AKS microservices

SC-100 By islever Editorial Last updated

Design solutions for securing applications

Short answer

C Dapr provides secrets management and automatic mTLS with lower overhead than a full service mesh like Istio.

Question

You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements: • Manages secrets • Provides encryption • Secures service-to-service communication by using mTLS encryption • Minimizes administrative effort What should you include in the recommendation?
  1. Flux
  2. Envoy
  3. Dapr Correct Answer
  4. Istio

Key Takeaways

Dapr provides secrets management and automatic mTLS between sidecars with lower operational overhead than Istio; Flux is GitOps and Envoy is a proxy, neither of which bundles these capabilities out of the box.

For AKS microservices that need secrets management, encryption, and mTLS service-to-service communication with minimal administrative effort, use Dapr, whose sidecar provides a secrets building block and automatic mTLS with less overhead than a full service mesh.

Common mistake: Choosing Istio (D) — it provides mTLS as a service mesh but is more complex to operate, conflicting with the 'minimize administrative effort' requirement that Dapr meets.

Expert Analysis

Why the Answer Is Correct

Dapr is a distributed-application runtime that, via its sidecar, provides a secrets building block (manages secrets), encryption, and automatic mutual TLS (mTLS) for service-to-service invocation. Compared with a full service mesh, Dapr has lower operational overhead, satisfying the 'minimize administrative effort' requirement.

Why the Other Options Are Wrong

Istio (D) is a service mesh that provides mTLS but is more complex to install and operate, conflicting with the minimal-effort requirement. Flux (A) is a GitOps tool and Envoy (B) is a proxy; neither bundles secrets management and automatic mTLS as a simple building block like Dapr.

Community Comment Notes

The community favored C (63 votes). Comments cite the AKS Dapr overview and note Dapr meets secrets + mTLS + low effort; a minority (D, 38 votes) preferred Istio for its mesh capabilities.

Official Reference

https://learn.microsoft.com/en-us/azure/aks/dapr-overview

This link opens the official vendor documentation in a new tab.

Community Votes

C
62%
D
38%

62% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 6 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 6

  1. 676ae1a 👍 2 Answered C
    Es una malla de servicios que proporciona mTLS, gestión de tráfico y políticas. Aunque potente, Istio puede ser complejo de instalar y gestionar, implicando un mayor esfuerzo administrativo.
  2. 424ede1 👍 2 Answered C
    Dapr https://learn.microsoft.com/en-us/azure/aks/dapr-overview https://learn.microsoft.com/en-us/azure/aks/dapr-settings?tabs=cli
  3. RoboCock 👍 1 Answered D
    The best choice to meet all the requirements listed is D. Istio. Here's why: Manages Secrets: Istio can integrate with Kubernetes secrets and ensures secure handling of sensitive information. Provides Encryption: It supports mTLS (mutual TLS) encryption to secure data in transit. Secures Service-to-Service Communication: Istio enables secure service communication with mTLS encryption, ensuring data protection between microservices. Minimizes Administrative Effort: Istio streamlines service mesh management with features such as automatic sidecar injection, centralized configurations, and extensive policy enforcement, reducing the overhead of managing microservices security.
  4. RoboCock 👍 1 Answered C
    according to copilot :-) Both Dapr and Istio are excellent tools, but they serve different purposes and are suited for different scenarios. Here's a comparison to clarify why Dapr might be a better fit for your requirements.
  5. Ali96 👍 1 Answered D
    For the requirements of managing secrets, providing encryption, securing service-to-service communication with mTLS, and minimizing administrative effort in Azure Kubernetes Service (AKS), the best solution is Istio
Show 1 more comment
  1. jim85 👍 1 Answered D
    D seems to be the answer, as per https://learn.microsoft.com/en-us/azure/aks/istio-about

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide