A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?

A system-assigned managed identity on one of the VMs

System-assigned identities are bound to one specific VM and are removed with that VM.

A service principal with a client secret stored on each VM

Client secrets create operational risk and fail the requirement to avoid stored credentials.

A certificate uploaded to each VM and used for Azure sign-in

Certificates still require lifecycle management and are not the cleanest shared identity approach here.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity attached to both VMs — A user-assigned managed identity is the best choice because it is a standalone identity resource that can be attached to multiple Azure VMs. If either VM is deleted, the identity still exists and can be reattached to a replacement VM without changing permissions. This design also avoids embedded passwords, secrets, or certificates, which keeps the automation simple and more secure. Why others are wrong: A system-assigned identity is tied to one VM and disappears when that VM is deleted, so it does not meet the persistence requirement. A service principal with a secret violates the no-secrets constraint and adds rotation overhead. A certificate-based approach avoids a password, but it still requires manual lifecycle management and does not provide the same shared, reusable Azure-native identity behavior.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.