Using Dapr to manage secrets and mTLS for AKS microservices

Design solutions for securing applications
Answer Correct answer: C — Dapr provides secrets management and automatic mTLS with lower overhead than a full service mesh like Istio.

You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements: • Manages secrets • Provides encryption • Secures service-to-service communication by using mTLS encryption • Minimizes administrative effort What should you include in the recommendation?

  1. Flux
  2. Envoy
  3. Dapr Correct Answer
  4. Istio
dapr aks microservices mtls service to service secrets management sidecar

Community Votes

C
62%
D
38%

62% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Dapr provides secrets management and automatic mTLS between sidecars with lower operational overhead than Istio; Flux is GitOps and Envoy is a proxy, neither of which bundles these capabilities out of the box.

For AKS microservices that need secrets management, encryption, and mTLS service-to-service communication with minimal administrative effort, use Dapr, whose sidecar provides a secrets building block and automatic mTLS with less overhead than a full service mesh.

Choosing Istio (D) — it provides mTLS as a service mesh but is more complex to operate, conflicting with the 'minimize administrative effort' requirement that Dapr meets.

Community Discussion (6 comments)

RoboCock 👍 1 Selected: D
The best choice to meet all the requirements listed is D. Istio. Here's why: Manages Secrets: Istio can integrate with Kubernetes secrets and ensures secure handling of sensitive information. Provides Encryption: It supports mTLS (mutual TLS) encryption to secure data in transit. Secures Service-to-Service Communication: Istio enables secure service communication with mTLS encryption, ensuring data protection between microservices. Minimizes Administrative Effort: Istio streamlines service mesh management with features such as automatic sidecar injection, centralized configurations, and extensive policy enforcement, reducing the overhead of managing microservices security.
RoboCock 👍 1 Selected: C
according to copilot :-) Both Dapr and Istio are excellent tools, but they serve different purposes and are suited for different scenarios. Here's a comparison to clarify why Dapr might be a better fit for your requirements.
424ede1 👍 2 Selected: C
Dapr https://learn.microsoft.com/en-us/azure/aks/dapr-overview https://learn.microsoft.com/en-us/azure/aks/dapr-settings?tabs=cli
jim85 👍 1 Selected: D
D seems to be the answer, as per https://learn.microsoft.com/en-us/azure/aks/istio-about
Ali96 👍 1 Selected: D
For the requirements of managing secrets, providing encryption, securing service-to-service communication with mTLS, and minimizing administrative effort in Azure Kubernetes Service (AKS), the best solution is Istio
676ae1a 👍 2 Selected: C
Es una malla de servicios que proporciona mTLS, gestión de tráfico y políticas. Aunque potente, Istio puede ser complejo de instalar y gestionar, implicando un mayor esfuerzo administrativo.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Dapr is a distributed-application runtime that, via its sidecar, provides a secrets building block (manages secrets), encryption, and automatic mutual TLS (mTLS) for service-to-service invocation. Compared with a full service mesh, Dapr has lower operational overhead, satisfying the 'minimize administrative effort' requirement.

Why the Other Options Are Wrong

Istio (D) is a service mesh that provides mTLS but is more complex to install and operate, conflicting with the minimal-effort requirement. Flux (A) is a GitOps tool and Envoy (B) is a proxy; neither bundles secrets management and automatic mTLS as a simple building block like Dapr.

Community Comment Notes

The community favored C (63 votes). Comments cite the AKS Dapr overview and note Dapr meets secrets + mTLS + low effort; a minority (D, 38 votes) preferred Istio for its mesh capabilities.

Official Reference

https://learn.microsoft.com/en-us/azure/aks/dapr-overview

Related Analysis

You have a Microsoft Entra tenant that syncs with an Active

A-Grade

You have a Microsoft 365 subscription that contains 1,000 Mi

S-Grade

You have a Microsoft 365 tenant that contains two groups nam

A-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide