A Windows VM runs an application that uploads files to a blob container every hour. Security forbids storing storage account keys or long-lived SAS tokens on the VM. The application must be able to write only to that container and nothing else. What should the administrator configure?

Store the storage account key in an environment variable on the VM

This still exposes a long-lived secret on the VM and gives access far broader than the single container.

Create a service SAS with write permission on the storage account

A SAS is still a shared secret, and using the account scope is broader than the single container requirement.

Assign Contributor on the storage account to the VM's system-assigned identity

Contributor is an Azure Resource Manager role, not a data-plane blob access role, so it does not grant the needed container upload permissions.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: Assign Storage Blob Data Contributor to the VM's managed identity at the container scope — The best solution is to use the VM's managed identity with a data-plane RBAC role scoped to the specific container. That removes the need for keys or SAS tokens and enforces least privilege. Storage Blob Data Contributor allows the application to upload and overwrite blobs in that container without granting access to other containers or management-plane actions on the account. This is the most secure and operationally durable option for recurring uploads. Why others are wrong: An environment variable or SAS token still places a long-lived credential on the VM, which violates the security requirement. Assigning Contributor at the storage account scope is wrong because it is an ARM role and does not grant blob data access. It would also be broader than necessary. The correct pattern is identity-based access at the narrowest possible scope.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.