A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

A storage account access key

An access key works, but it is a shared secret that must be stored and protected somewhere.

A shared access signature (SAS) token

A SAS token can limit access, but it is still a secret that must be issued, stored, and eventually rotated.

A local administrator account on the VM

A local admin account controls access to the operating system, not Azure Storage authorization.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A system-assigned managed identity — A system-assigned managed identity is the best choice when one VM needs to access Azure resources without embedded secrets. The identity is created and managed by Azure, so the application can obtain tokens directly instead of using passwords, keys, or connection strings. Because it is bound to that VM, it is a clean fit for a single server scenario and reduces secret management overhead and exposure. Why others are wrong: A storage account key and a SAS token both rely on shared secrets, which the question explicitly wants to avoid. A local administrator account is only for operating system access and does not authorize access to Azure Storage. The managed identity is the only option that gives Azure-native authentication without keeping credentials in application settings.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.