An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?

A service principal with a client secret stored in App Service configuration.

This requires secret storage and manual rotation, which conflicts with the stated security requirement.

A user-assigned managed identity shared by all applications.

Shared identities can be useful, but they do not disappear automatically with one specific app.

A shared access signature stored in Key Vault.

A SAS token is still a secret and does not provide the same identity-based authentication model.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A system-assigned managed identity on the App Service. — A system-assigned managed identity is the most secure fit for an Azure-hosted application that needs to authenticate to Key Vault without storing secrets. Azure creates and manages the identity for the App Service, and it is automatically removed when the app is deleted. After enabling it, the administrator can grant the identity permission to read the required secrets in Key Vault and eliminate manual credential handling. Why others are wrong: Option A reintroduces the exact secret-management problem the team wants to avoid. Option C is persistent and reusable, but it is not automatically removed with the app. Option D still depends on secret distribution and does not provide identity-based authentication or lifecycle coupling to the application.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.