AZ-104 Manage Azure Identities and Governance Practice Question
A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.
⚠ Common exam trap
Test-takers frequently think moving the VM to a different subnet (Option E) solves the authentication problem, but subnet changes only affect network access control, not credentialless authentication; the correct approach relies on Azure AD and RBAC via managed identities.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the VM.
A system-assigned managed identity on the VM allows Azure to automatically manage a service principal for the VM, eliminating the need for any stored credentials. By assigning the Storage Blob Data Reader role to that identity on the storage account, the VM can authenticate to Azure Storage using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint, without ever storing a shared key, SAS token, or password.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable a system-assigned managed identity on the VM.
Why this is correct
Enabling a system-assigned managed identity on the VM creates an Azure AD-backed identity directly tied to the VM's lifecycle, allowing the application to authenticate to Azure Storage without embedding or storing any credentials. This identity is automatically managed by Azure, eliminating the need for secret rotation or protection within the application code. Once enabled, the VM can acquire tokens for Azure AD to securely access storage blobs.
- ✓
Assign the Storage Blob Data Reader role to that identity on the storage account.
Why this is correct
Assigning the Storage Blob Data Reader role to that managed identity grants the identity least-privilege read access to the storage account's blob containers, which is the specific authorization needed for the app to read blobs. This RBAC role scopes the identity's permissions to blob data, preventing it from accessing other storage services like queues or tables. Without this role assignment, the identity would be authenticated but lack the necessary authorization to perform any read operations.
- ✗
Store the storage account access key in the app configuration.
Why it's wrong here
Storing the storage account access key in the app configuration is a critical security risk because access keys are shared secrets that provide full administrative access to the entire storage account, including all blob data, and they cannot be scoped to read-only permissions. This directly violates the requirement to avoid secrets in the app, as the key would be accessible to anyone with access to the configuration source. Unlike managed identity, access keys require strict rotation and protection, making them unsuitable for this scenario.
When this WOULD be correct
This option would be correct in a scenario where the question does not prohibit storing secrets, and the app needs to access storage with full account-level permissions (e.g., read/write/delete all blobs) using a simple configuration approach, without requiring managed identities or role assignments.
- ✗
Generate a SAS token and embed it in the application code.
Why it's wrong here
Generating a SAS token and embedding it in the application code reintroduces a secret that must be protected, rotated, and managed, directly contradicting the requirement to avoid secrets in the app. A SAS token grants time-limited, delegated access but can be leaked or abused if embedded in code or configuration files. This approach also ties the app to the token's expiry, requiring manual refreshes and creating operational overhead.
When this WOULD be correct
Option D would be correct if the question required granting time-limited, scoped access to a specific blob or container without using a managed identity, and the application could securely retrieve the SAS token from a key vault or generate it at runtime without hardcoding.
- ✗
Move the VM into a different subnet.
Why it's wrong here
Moving the VM into a different subnet only changes its network topology and isolation boundaries; it has no effect on identity, authentication, or authorization for Azure Storage. Subnet placement does not grant the VM any permissions to read blobs, nor does it eliminate the need for credentials or an identity-based access mechanism. The scenario requires a security principal and role assignment, which subnet placement cannot provide.
When this WOULD be correct
This option would be correct in a question about isolating VM network traffic, such as 'You need to ensure that a VM cannot communicate with the internet but can communicate with a database VM. Which step should you take?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a system-assigned managed identity on the VM.Correct answer▾
Why this is correct
Enabling a system-assigned managed identity on the VM creates an Azure AD-backed identity directly tied to the VM's lifecycle, allowing the application to authenticate to Azure Storage without embedding or storing any credentials. This identity is automatically managed by Azure, eliminating the need for secret rotation or protection within the application code. Once enabled, the VM can acquire tokens for Azure AD to securely access storage blobs.
✗Store the storage account access key in the app configuration.Wrong answer — click to see why▾
Why this is wrong here
Option C stores the storage account access key in the app configuration, which violates the requirement to avoid storing a shared key, SAS token, or password. The question explicitly requires a solution without storing such secrets.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the question does not prohibit storing secrets, and the app needs to access storage with full account-level permissions (e.g., read/write/delete all blobs) using a simple configuration approach, without requiring managed identities or role assignments.
Why candidates choose this
Candidates may be familiar with using access keys for storage access and think storing them in app configuration is a standard practice, overlooking the security requirement to avoid storing secrets in code or config.
✗Generate a SAS token and embed it in the application code.Wrong answer — click to see why▾
Why this is wrong here
Option D is wrong because embedding a SAS token in application code violates the requirement to avoid storing a shared key, SAS token, or password. The question explicitly prohibits using any such credentials.
★ When this WOULD be the correct answer
Option D would be correct if the question required granting time-limited, scoped access to a specific blob or container without using a managed identity, and the application could securely retrieve the SAS token from a key vault or generate it at runtime without hardcoding.
Why candidates choose this
Candidates may think a SAS token is a secure, temporary solution that avoids storing a shared key, but they overlook the requirement to avoid storing any token or password in the code.
✗Move the VM into a different subnet.Wrong answer — click to see why▾
Why this is wrong here
Moving the VM into a different subnet does not provide any mechanism for the app to authenticate to Azure Storage without credentials. It only changes network isolation, not identity or access control.
★ When this WOULD be the correct answer
This option would be correct in a question about isolating VM network traffic, such as 'You need to ensure that a VM cannot communicate with the internet but can communicate with a database VM. Which step should you take?'
Why candidates choose this
Candidates may confuse network segmentation with security controls for data access, thinking that moving to a different subnet somehow secures the storage access or replaces the need for authentication.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
Key term
SAS
SAS (Serial Attached SCSI) is a high-speed data transfer technology used to connect hard drives and SSDs in servers and enterprise storage systems.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.