A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

A system-assigned managed identity on each VM.

System-assigned identities are tied to a single VM and disappear when that VM is deleted.

A service principal with a client secret stored in each VM.

This works technically, but it introduces secret management overhead and does not meet the goal of using Azure-managed identity patterns.

A shared access signature stored in the VM registry.

A SAS is for scoped storage access, not for general Azure resource authentication across multiple VMs.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity attached to the VMs. — A user-assigned managed identity is the right fit when multiple Azure resources need to share one stable identity. It is created independently of any single VM, so deleting or recreating one machine does not remove the identity itself. That makes it ideal for automation that must continue using the same permissions across multiple VMs while avoiding password or secret storage on the machines. Why others are wrong: A system-assigned managed identity is bound to one VM, so it is lost when that VM is deleted. A service principal with a secret can work, but it requires secret storage and rotation, which is less secure and less convenient than managed identity. A shared access signature is limited to storage access and does not provide the broad Azure authentication model needed here.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.