A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Store the storage account access key in an environment variable on the VM.

An access key is a long-lived secret, and storing it on the VM violates the requirement to avoid credentials. It also grants broad access to the storage account rather than only the needed container. This is less secure than using managed identity and RBAC.

Generate a service SAS and copy it into the application configuration.

A SAS token is still a secret, even if it can be time-limited and scoped. The requirement explicitly says the app must not store a SAS token on the VM. Managed identity is preferred because it removes the need to manage shared secrets in the workload.

Assign the Contributor role on the resource group to the managed identity.

Contributor is a management-plane role and does not grant blob data access by itself. It would also give far more permission than needed for a single container upload. The app needs a data role such as Storage Blob Data Contributor, not broad resource control.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable a system-assigned managed identity on the VM. — Managed identity plus a storage data role is the standard Azure approach when an app must access Blob Storage without secrets. The VM identity can obtain tokens from Microsoft Entra ID, and the Storage Blob Data Contributor role grants only the required blob write permissions. This design avoids keys and SAS tokens while keeping access narrow and auditable. Why others are wrong: Access keys and SAS tokens are secrets, so they conflict with the requirement. Contributor on the resource group is the wrong layer because it controls resource management, not blob data operations. The key point is to separate authentication from authorization: use managed identity for authentication and RBAC data roles for authorization.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.