An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Store a service principal secret in a protected file and use it at startup.

This still stores a credential on the VM, which conflicts with the security requirement.

Create a user-assigned managed identity and avoid assigning it to the VM.

An identity that is not assigned to the VM cannot be used by the application at runtime.

Use an SSH certificate to authenticate the app to Key Vault.

SSH certificates are for SSH access, not for application authentication to Azure Key Vault.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Enable a system-assigned managed identity on the VM. — A system-assigned managed identity is the best choice because it is created for that VM and removed with it, which fits a single-server workload. The application can request Azure tokens from the platform without embedding passwords, certificates, or secrets in files or environment variables. That removes secret-management overhead and aligns with the requirement to avoid storing credentials on the machine. Why others are wrong: Option A violates the stated security policy because it still places a secret on the VM. Option C does not help because an unassigned identity cannot authenticate the workload. Option D is unrelated to Key Vault authentication for an application and does not solve the credential-storage problem.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.