Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

A system-assigned managed identity on each virtual machine.

This creates a separate identity per VM and the identity lifecycle follows each machine individually.

A service principal with a certificate file copied to each VM.

This still introduces certificate management and is not as clean as a reusable Azure-managed identity.

A shared access signature for each storage account and Key Vault access policy.

SAS tokens and ad hoc access policies do not provide one reusable identity for both services and multiple VMs.

What does this AZ-104 question test?

Static NAT maps one inside address to one outside address.

What is the correct answer to this question?

The correct answer is: A user-assigned managed identity attached to all three virtual machines. — A user-assigned managed identity is ideal when the same Azure identity must be attached to multiple resources and survive VM rebuilds. Because it is created separately from the virtual machines, it can be reused across the three VMs and kept even if one machine is reimaged or replaced. This provides a cleaner, centrally managed authentication model than secrets or per-VM identities. Why others are wrong: Option A binds an identity to each VM, which does not meet the requirement for reuse across machines. Option B still depends on certificate distribution and lifecycle management. Option D is not an identity strategy and would not provide a single reusable principal for both Storage and Key Vault access.

What should I do if I get this AZ-104 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.