An organization is implementing a Zero Trust architecture for their AI platform on Azure. An application uses a chain of AI services where each service calls the next. The security team needs to ensure each service-to-service hop is authenticated. What is the correct approach?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Zero Trust principle of 'verify explicitly' for service-to-service communication is implemented by assigning each service a managed identity and granting that identity the minimum required RBAC role on the next service in the chain. This provides cryptographically verifiable identity at each hop without secrets management overhead.
Full explanation below image
Full Explanation
B is correct because the Zero Trust principle of 'verify explicitly' for service-to-service communication is implemented by assigning each service a managed identity and granting that identity the minimum required RBAC role on the next service in the chain. This provides cryptographically verifiable identity at each hop without secrets management overhead. A is incorrect because API keys are shared secrets that cannot be attributed to a specific calling identity and violate Zero Trust principles. C is incorrect because a shared secret used across all services does not provide identity verification and creates a single point of credential compromise. D is incorrect because mutual TLS provides transport-layer authentication but does not provide application-layer identity claims or integrate with Azure RBAC for fine-grained authorization.