AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.

  Why this is correct

  A system-assigned managed identity is tied directly to the VM and removes the need to store secrets on disk. It is the simplest credential-free option when a script runs inside a single virtual machine and must access Azure resources programmatically.

• ✓

  Assign Contributor on the target resource group to the VM identity so the script can create the required resources.

  Why this is correct

  Assigning Contributor to the VM identity at the target resource-group scope grants the precise set of RBAC write actions needed to create and manage resources within that resource group, while leaving the identity without access elsewhere in the subscription. The managed identity principal appears as an object in Azure AD, and this role assignment is what turns the authenticated identity into an authorized identity. Because the role is scoped to only the target resource group, it enforces least privilege and does not permit unrelated subscription-level changes or resource deletions outside that group.

• ✓

  Use az login --identity in the script before running the Azure CLI deployment commands.

  Why this is correct

  az login --identity tells Azure CLI to use the VM's managed identity instead of an interactive account or saved secret. This is the expected authentication flow for running Azure CLI commands from within an Azure VM with managed identity enabled.

• ✗

  Create a service principal and store its client secret in a file on the VM for the script to read.

  Why it's wrong here

  While a service principal with a client secret can technically perform the same deployment actions, storing that secret in a file on the VM leaves a long-lived credential at rest on the disk. If the VM or its disk is compromised, an attacker can exfiltrate the secret and use it from anywhere until it is manually rotated; plus the secret must be protected and periodically updated in the script's storage location. This directly contradicts the requirement to avoid embedded credentials, and it introduces rotation, monitoring, and leakage risks that a system-assigned managed identity eliminates by using automatically rotated certificates.

  When this WOULD be correct

  In a scenario where the script must authenticate from an external system (e.g., a CI/CD pipeline) that cannot use managed identities, and the use of a client secret is allowed, creating a service principal and storing its secret securely would be correct.

• ✗

  Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

  Why it's wrong here

  The Reader role only permits read operations such as listing resources and viewing properties; it contains no actions like Microsoft.Resources/deployments/write, Microsoft.Compute/virtualMachines/write, or other resource-provider write operations. When an Azure CLI command attempts to create, update, or deploy anything in the resource group, Azure RBAC evaluates the caller's permissions and returns an AuthorizationFailed (or Forbidden) error because the Reader role has no write or action-permitting data actions. Therefore, granting Reader is fundamentally insufficient for a script whose purpose is to create Azure resources; the identity needs Contributor (or a custom role with the required write actions) at the appropriate scope.

  When this WOULD be correct

  In a scenario where the requirement is only to monitor or audit resources in a resource group (e.g., list VMs or check tags), and the script uses read-only commands, Reader would be sufficient.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question