AZ-104 Deploy and Manage Azure Compute Practice Question
A Windows Azure VM must download configuration data from Azure Key Vault during first boot. Security policy forbids storing passwords, certificates, or client secrets on the VM. What should the administrator configure?
⚠ Common exam trap
Many candidates think a service principal with a stored secret (Option A) is required for automated access, overlooking that managed identities eliminate the need for any stored credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a system-assigned managed identity on the VM and grant it Key Vault access.
A system-assigned managed identity provides an automatically managed service principal in Entra ID, tied to the VM's lifecycle. Granting this identity the appropriate Key Vault access policy (e.g., Get, List secrets) allows the VM to authenticate to Key Vault without any stored credentials, satisfying the security policy. The VM can then retrieve configuration data during first boot using the Azure Instance Metadata Service (IMDS) endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a service principal and place its secret in the VM's startup script.
Why it's wrong here
A service principal requires a client secret (or certificate) that must be provisioned, stored, and rotated. Putting that secret in the startup script means the same plaintext exposure as option 1, and the secret remains valid for its lifetime, so anyone who obtains it can authenticate as the service principal until expiration. Managed identity eliminates this by providing a token through the Azure Instance Metadata Service.
When this WOULD be correct
If the security policy allowed storing secrets on the VM and the VM needed to authenticate to Azure services using a service principal with a client secret, this would be a valid approach.
- ✓
Enable a system-assigned managed identity on the VM and grant it Key Vault access.
Why this is correct
A system-assigned managed identity gives the VM an automatically managed identity with no stored credentials. The VM can authenticate to Key Vault through Azure AD and receive only the permissions it needs. Because the identity is tied to the VM lifecycle, it is ideal for first-boot configuration tasks that must avoid passwords, certificates, and client secrets.
- ✗
Attach a custom script extension that embeds the Key Vault password in plain text.
Why it's wrong here
This approach places the secret directly in the extension payload, which is written to the VM's OS disk and ARM deployment history. Any admin with disk access or deployment read permissions can retrieve it. The credential is also static, never rotates, and must be updated manually, so it violates the requirement to avoid credential storage entirely.
When this WOULD be correct
If the security policy allowed storing secrets on the VM, and the requirement was to run a script during first boot that uses a hardcoded password (e.g., for a legacy application), then a custom script extension with embedded credentials could be acceptable.
- ✗
Use an Entra ID user account and sign in interactively after deployment.
Why it's wrong here
This fails because a startup script runs in the system context with no user present; interactive authentication would block the process. Even if a session were established, a user account has tenant-wide permissions and is subject to MFA and identity governance, making it unsuited for a machine workload. The VM needs a non-interactive, workload-specific identity.
When this WOULD be correct
If the question required interactive user authentication for a one-time administrative task on a VM, such as troubleshooting or manual configuration, and automation was not needed, then using an Entra ID user account to sign in interactively would be appropriate.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a system-assigned managed identity on the VM and grant it Key Vault access.Correct answer▾
Why this is correct
A system-assigned managed identity gives the VM an automatically managed identity with no stored credentials. The VM can authenticate to Key Vault through Azure AD and receive only the permissions it needs. Because the identity is tied to the VM lifecycle, it is ideal for first-boot configuration tasks that must avoid passwords, certificates, and client secrets.
✗Create a service principal and place its secret in the VM's startup script.Wrong answer — click to see why▾
Why this is wrong here
Storing the service principal's secret in the VM's startup script violates the security policy forbidding passwords, certificates, or client secrets on the VM.
★ When this WOULD be the correct answer
If the security policy allowed storing secrets on the VM and the VM needed to authenticate to Azure services using a service principal with a client secret, this would be a valid approach.
Why candidates choose this
Candidates may think a service principal is required for authentication and overlook the security constraint, or they may not be aware that managed identities eliminate the need for secrets.
✗Attach a custom script extension that embeds the Key Vault password in plain text.Wrong answer — click to see why▾
Why this is wrong here
The custom script extension would embed the Key Vault password in plain text, violating the security policy that forbids storing passwords, certificates, or client secrets on the VM.
★ When this WOULD be the correct answer
If the security policy allowed storing secrets on the VM, and the requirement was to run a script during first boot that uses a hardcoded password (e.g., for a legacy application), then a custom script extension with embedded credentials could be acceptable.
Why candidates choose this
Candidates may think custom script extensions are a standard way to run startup scripts, and they might overlook the security policy restriction against storing secrets on the VM.
✗Use an Entra ID user account and sign in interactively after deployment.Wrong answer — click to see why▾
Why this is wrong here
Interactive sign-in with an Entra ID user account is not automated and requires manual intervention, which violates the requirement for first-boot automation without storing credentials on the VM.
★ When this WOULD be the correct answer
If the question required interactive user authentication for a one-time administrative task on a VM, such as troubleshooting or manual configuration, and automation was not needed, then using an Entra ID user account to sign in interactively would be appropriate.
Why candidates choose this
Candidates may think that using an existing Entra ID user account avoids storing secrets on the VM, but they overlook the need for automated, unattended access during first boot.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Privileged Identity Management (PIM)
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every AZ-104 question from scratch — 1,049 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.