An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?

Assign a system-assigned managed identity to the utility VM

A system-assigned identity is removed if the VM is deleted and cannot be shared elsewhere.

Create a service principal and store its secret in the VM configuration

A stored secret violates the requirement to avoid passwords and client credentials on the VM.

Use a shared access signature to sign the Azure CLI session

SAS tokens are for specific storage operations, not general Azure resource deployment authorization.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: Create a user-assigned managed identity and attach it to the utility VM — The best design is a user-assigned managed identity attached to the utility VM. That identity remains available even if the VM is redeployed, which is important when the compute host is frequently recreated. The script can authenticate to Azure with the VM identity and then use role assignments on the target subscription or resource group, eliminating the need to store secrets on the machine. Why others are wrong: A system-assigned identity is too tightly coupled to the VM lifecycle and is less reusable after redeployment. A service principal with a secret fails the no-secrets requirement and adds rotation overhead. SAS tokens do not grant general ARM deployment permissions, so they are the wrong control for creating and tagging Azure resources.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.