AZ-104 Implement and Manage Storage Practice Question
A VM-based application needs to read from Azure Storage without storing a password, access key, or other secret in code or configuration. The identity should also be removed automatically if the VM is deleted. What should you enable?
⚠ Common exam trap
Candidates often confuse user-assigned managed identities with system-assigned ones, overlooking the key requirement that the identity must be automatically removed when the VM is deleted, which only system-assigned identities guarantee.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A system-assigned managed identity
A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM: when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any secrets in code or configuration, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A system-assigned managed identity
Why this is correct
A system-assigned managed identity is created directly on the VM and has the same lifetime as the VM, so it is automatically cleaned up when the VM is deleted. It is an Azure AD identity that can be granted only the necessary RBAC role (e.g., Storage Blob Data Reader) on the storage account, enabling truly secretless access. The platform automatically rotates its credentials, and the SDK can obtain tokens via the Azure Instance Metadata Service without any secrets stored in code or configuration.
- ✗
A user-assigned managed identity
Why it's wrong here
A user-assigned managed identity is a standalone Azure AD identity that can be assigned to multiple Azure resources, including the VM. While it also enables secretless access and works well when you need the same identity across several resources, it is not automatically removed when a single VM is deleted—its lifecycle is independent. For a single VM that needs to read storage without credentials, a system-assigned identity is a better fit because it avoids leaving orphaned identities behind.
- ✗
A storage account access key
Why it's wrong here
A storage account access key is a shared secret that grants full administrative access to the entire storage account. It must be stored somewhere (in code, config, or Key Vault), manually rotated, and protected as a high-privilege credential. Using it violates the goal of secretless access, since any leak can compromise all data in the account, and it lacks fine-grained, per-application RBAC scoping.
- ✗
A shared access signature
Why it's wrong here
A shared access signature (SAS) is a delegated URI that grants time-limited and permission-scoped access to specific storage resources. Although it avoids exposing the account key, a SAS token is still a credential that must be generated, securely distributed, and managed—including expiration and revocation. For a VM-based application that should read storage without handling secrets, a SAS introduces unnecessary token lifecycle management and does not provide an automatic, identity-based authentication mechanism.
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Access key
An access key is a unique identifier and secret code pair used to authenticate requests to cloud storage services, ensuring only authorized users or applications can access data.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.