AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store a service principal secret in a protected file and use it at startup.

  Why it's wrong here

  Storing a service principal secret (a password or client secret) in a protected file on the VM still places a credential in the VM's filesystem. Even if the file is encrypted or has restrictive permissions, the secret must be readable at startup and is exposed to anyone with root access or access to the underlying disk. This directly violates the explicit requirement of not storing secrets on the VM and is riskier than using a managed identity.

  When this WOULD be correct

  This option would be correct if the security policy allowed storing secrets on the VM and the application needed to authenticate using a service principal with a client secret, for example, when running on-premises or on a VM that cannot use managed identities.

• ✓

  Enable a system-assigned managed identity on the VM.

  Why this is correct

  Enabling a system-assigned managed identity on the VM creates an Azure AD identity that is tied directly to the VM's lifecycle. The application can request an access token for Azure Key Vault using the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254, which requires no hardcoded credentials. Azure automatically rotates and manages the identity's principal, so the VM never stores a secret on disk, fully satisfying the security requirement.

• ✗

  Create a user-assigned managed identity and avoid assigning it to the VM.

  Why it's wrong here

  A user-assigned managed identity is a standalone Azure AD identity that must be explicitly assigned to a compute resource, such as a VM, in order for it to be usable. If the identity is created but not assigned to the VM, the VM has no token endpoint for that identity, and the application cannot obtain a token for it. The identity would simply exist unused and provide no authentication path to Key Vault, making this option ineffective.

  When this WOULD be correct

  If the question asked for a managed identity that can be pre-created and assigned to multiple VMs, or if the scenario required separating identity lifecycle from VM lifecycle (e.g., identity created by security team and later assigned to VMs), then creating a user-assigned managed identity would be correct.

• ✗

  Use an SSH certificate to authenticate the app to Key Vault.

  Why it's wrong here

  SSH certificates are designed to authenticate users or hosts to SSH services, not to authorize API calls to Azure Key Vault. Key Vault authentication requires an Azure AD access token, typically obtained via the OAuth 2.0 client credentials flow or a managed identity. An SSH certificate does not map to an Azure AD identity and cannot be used to obtain a Key Vault token, so this approach would fail at runtime.

  When this WOULD be correct

  If the question required secure SSH access to the Linux VM without passwords, and the security policy allowed certificate-based authentication, enabling SSH certificate authentication would be correct. For example: 'An administrator needs to connect to a Linux VM securely without using passwords. What should be configured?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question