A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Copy the storage account access key into a configuration file on the VM.

An access key is a long-lived secret and violates the requirement not to store credentials on the VM. It also creates unnecessary exposure if the VM is compromised.

Assign the Reader role at the resource group scope to the VM identity.

Reader only permits viewing Azure resources in the management plane. It does not allow the VM to upload blob data to the storage account.

Create a shared access signature that never expires and place it on the VM.

A never-expiring SAS token is effectively a stored secret and does not meet the security requirement. SAS should be time-limited and tightly scoped.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Enable a system-assigned managed identity on the VM. — A system-assigned managed identity lets the VM authenticate without embedding secrets, keys, or passwords. To make that identity useful for blob uploads, you must also grant a data-plane role such as Storage Blob Data Contributor on the storage account or container. Together, these two steps let the VM write blobs securely while avoiding long-lived credentials on the guest operating system. Why others are wrong: The storage account key and a never-expiring SAS both violate the no-secrets requirement. Reader is only for viewing Azure resources and cannot write blob data. These distractors are common mistakes because they mix management-plane access with data-plane access, but blob uploads require the correct storage data role.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.