A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.

Store the storage account access key in the app configuration.

An access key is a shared secret, which the requirement specifically says to avoid.

Generate a SAS token and embed it in the application code.

A SAS token is still a secret and would need protection and rotation, which this scenario avoids.

Move the VM into a different subnet.

Subnet placement does not grant storage authorization or remove the need for identity-based access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Enable a system-assigned managed identity on the VM. — The secure way for a VM app to access blob data is to use Microsoft Entra ID authentication through a managed identity. A system-assigned managed identity is built into the VM and does not require stored credentials. The identity must then be granted the appropriate Azure role on the storage account, such as Storage Blob Data Reader for read-only access. Together, these steps provide credential-free access and least privilege. Why others are wrong: Access keys and SAS tokens are both secrets that must be protected and rotated, so they do not meet the requirement to avoid stored credentials. Changing the subnet does not authorize access to storage. The correct pattern is identity plus RBAC, not shared secrets or network location alone.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.