A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

A system-assigned managed identity on each newly deployed VM.

This identity is tied to a specific VM lifecycle and would change when the VM is replaced.

A shared storage account key placed in the VM custom script.

This introduces credential exposure and does not meet the requirement for secretless access.

A policy exemption for the Key Vault access policy.

Policy exemptions do not provide authentication, and Key Vault access still requires a valid identity.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity associated with the workload. — A user-assigned managed identity is the right choice when the identity must survive VM replacement, reimaging, or name changes. Because it is not tied to the lifecycle of one specific VM, the application keeps the same Azure identity even when the underlying compute resource changes. That stability is important for secretless access to Key Vault and reduces operational overhead because permissions are managed once on the identity rather than re-created with every deployment. Why others are wrong: A system-assigned identity is recreated with the VM, so it does not survive replacement events. A shared key is a credential, not an identity, and it creates exactly the kind of secret management problem the scenario wants to avoid. Policy exemptions have nothing to do with authentication. The essential requirement is identity persistence across redeployments, which makes user-assigned managed identity the correct answer.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.