A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?

A storage account access key stored in Key Vault

This still depends on a secret and adds rotation overhead that the team wants to avoid.

A shared access signature embedded in the application settings

A SAS token is still a secret and must be protected and renewed before it expires.

A service endpoint on the App Service integration subnet

A service endpoint changes network access paths, but it does not provide authentication to storage.

What does this AZ-104 question test?

CIDR notation defines the prefix length.

What is the correct answer to this question?

The correct answer is: A system-assigned managed identity — A system-assigned managed identity is the best answer because it gives the App Service an identity in Microsoft Entra ID without needing stored secrets. After enabling it, you can grant the identity an appropriate storage role, such as Storage Blob Data Contributor, at the required scope. This approach removes password and key management from the application and aligns with least-credential operational practice. Why others are wrong: Storing an access key in Key Vault still leaves you with a secret to manage and rotate. A SAS token is also a secret and expires, so it creates ongoing administration. A service endpoint only helps network routing to the storage service; it does not authenticate the app or replace credentials.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.