A scale set of application VMs uploads JSON files to one blob container. The identity must not use secrets, must keep working if an instance is reimaged or replaced, and the same identity should be reusable across all instances. What should the administrator configure?

A system-assigned managed identity on each VM instance, with account-wide storage permissions.

System-assigned identities are tied to each resource lifecycle and do not provide one reusable identity that survives instance replacement.

A shared access signature stored in the VM image and renewed annually.

A SAS token is still a secret, and storing it in the image violates the requirement to avoid secrets and to keep access resilient through replacements.

The storage account access key, because it allows the most reliable upload path.

Access keys are long-lived secrets, provide broader access than needed, and are not appropriate when the requirement explicitly forbids secrets.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity, attached to the scale set, with Storage Blob Data Contributor scoped to the container. — A user-assigned managed identity is the best fit when multiple VMs or scale set instances need the same identity and the identity must survive instance replacement. Because it is independent of any single VM, it continues to work when an instance is reimaged or recreated. Assigning Storage Blob Data Contributor at the container scope keeps the permission narrow and aligned with least privilege, while avoiding secrets entirely. Why others are wrong: System-assigned identities are lifecycle-bound to the individual resource, so they do not satisfy the requirement for one reusable identity across instances. SAS tokens and access keys are both secrets and are explicitly disallowed. The question is testing persistence and scoping together, so the correct answer must address both identity durability and least privilege.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.