AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create a user-assigned managed identity that can exist independently of any single VM.

  Why this is correct

  A user-assigned managed identity has its own lifecycle and is not deleted when a VM is removed. That makes it the correct choice when multiple VMs need the same identity and the identity must survive VM recreation.

• ✓

  Attach the same user-assigned managed identity to each of the three VMs.

  Why this is correct

  Attaching the same user-assigned managed identity to each of the three VMs leverages Azure's support for a single identity being assigned to multiple resources. Because user-assigned identities exist as top-level Azure resources, they can be associated with any number of VMs, and those VMs will all present the same principal ID when authenticating to Azure AD. This avoids creating separate credentials per machine and ensures that if any VM is recreated, the identity remains available for reassignment without orphaned or duplicated secrets.

• ✓

  Grant the user-assigned identity the minimum required RBAC role on the target configuration endpoint.

  Why this is correct

  The identity still needs authorization to read the endpoint, so RBAC must be assigned at the appropriate scope. Least privilege keeps the permission set narrow while allowing all VMs that use the shared identity to succeed.

• ✗

  Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

  Why it's wrong here

  A system-assigned managed identity is intrinsically bound to a single VM and is deleted when that VM is deleted, so using it on only one VM and copying its access token to the other two is not a viable shared identity. Access tokens are short-lived (typically under 24 hours) and must be continuously refreshed, which would force the other VMs to depend on the one source VM remaining alive. Furthermore, extracting and replaying tokens outside the intended resource violates Azure's token-handling model and creates a security risk, because the token is not scoped to the other VMs' identities and cannot be renewed without accessing the original VM's identity endpoint.

  When this WOULD be correct

  If the question required a single VM to access a resource without managing credentials, and the identity could be recreated automatically when the VM is recreated, a system-assigned managed identity would be correct.

• ✗

  Store one application password locally on each VM and use it instead of Azure-managed identities.

  Why it's wrong here

  Storing an application password locally on each VM reintroduces the exact credential-management burden that managed identities eliminate. Passwords must be securely stored, rotated, and protected on every VM, and a leaked or stale password becomes a shared secret that an attacker can reuse across all three systems. Azure-managed identities, by contrast, are backed by Azure Active Directory and require no static secrets on the VM, so this option fundamentally fails the requirement to rely on an Azure identity that persists independently of VM lifecycle.

  When this WOULD be correct

  This option would be correct in a scenario where the application requires a client secret for authentication to an external service that does not support managed identities, and the VMs are in a stable environment where secrets can be securely stored and rotated.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”