An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?

A local administrator password

A local administrator password only authenticates to the operating system and does not authorize Azure resource creation. It also requires secret storage and does not meet the requirement to avoid credentials on the VM. It is not an Azure management authentication method.

A network security group rule

A network security group rule only controls traffic flow. It does not authenticate Azure CLI sessions or grant rights to create resources. Network access and Azure authorization are separate concerns.

An Azure region paired with the VM

A region or paired region affects resource placement and disaster recovery options, not authentication. It does not give a VM permission to create Azure resources and does not replace identity-based access.

What does this AZ-104 question test?

Authentication checks who the user is.

What is the correct answer to this question?

The correct answer is: The VM's managed identity — The VM’s managed identity is the correct authentication mechanism because it allows Azure CLI or PowerShell to access Azure resources without storing secrets. Once the identity is enabled and assigned permissions, the script can authenticate securely from inside the VM. This is the preferred way to automate Azure operations from compute resources. Why others are wrong: A local admin password is only for OS login and would still require secret handling. An NSG rule controls networking, not Azure authorization. A region is a location choice, not an identity. The scenario is about secure automation from a VM, so managed identity is the right answer.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.