Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

System-assigned identities are tied to a single resource and are not meant to be copied between machines. Access tokens are short-lived and cannot be reused safely or reliably as a shared identity mechanism.

Store one application password locally on each VM and use it instead of Azure-managed identities.

Local passwords reintroduce secret management, rotation, and leakage risks. They also do not satisfy the requirement for an identity that continues to function cleanly when any VM is deleted or recreated.

What does this AZ-104 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Create a user-assigned managed identity that can exist independently of any single VM. — A user-assigned managed identity is the right fit when several VMs need the same Azure identity and the identity must outlive any single VM. You create the identity once, assign it to each VM, and then grant only the needed RBAC role at the target scope. That design survives VM deletion and recreation without changing the identity used by the applications. Why others are wrong: A system-assigned identity is lifecycle-bound to one VM, so it does not meet the shared, durable identity requirement. Local passwords are less secure and harder to maintain. The question is specifically about a reusable identity across multiple compute resources, which is what user-assigned managed identities are built for.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.