A team deploys a Linux VM that must read secrets from Azure Key Vault without storing any usernames, passwords, or client secrets on the VM. What should the administrator enable on the VM?

A storage account access key

A storage account key is unrelated to Key Vault authentication and would require storing a long-lived secret on the VM. It does not solve the requirement to avoid usernames, passwords, or client secrets. It is also broader than necessary and weakens security because the key can be reused outside the VM if exposed.

A service endpoint on the VM subnet

A service endpoint affects network routing and service access control, not identity authentication. It can help a VM reach certain Azure services securely over the Azure backbone, but it does not provide the VM with a credential-free identity. Key Vault access still needs an authentication method such as managed identity.

A user account in Entra ID with a stored password

A user account with a password still requires the VM or application to store a credential, which violates the requirement. It also creates extra operational work for password management and rotation. Managed identities are the Azure-native way to eliminate this problem for a single VM.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A system-assigned managed identity — A system-assigned managed identity is the best choice because it lets the VM authenticate to Azure resources without storing secrets on the machine. Azure creates and manages the identity automatically, and you can grant it permissions to Key Vault using Azure RBAC or access policies. This fits the security requirement and is a common best practice for VM-to-Azure service access. Why others are wrong: A storage key is not an identity and does not apply to Key Vault. A service endpoint changes network access behavior, not authentication. A user account with a password still depends on a stored secret and is less secure. The key distinction is that managed identity removes secret handling entirely.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.