AZ-104 Manage Azure Identities and Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  A system-assigned managed identity on each VM

  Why it's wrong here

  A system-assigned managed identity is tied directly to a single virtual machine; each VM receives its own unique identity, and it is deleted when the VM is deleted. If both VMs run the same script, they would need separate role assignments in Key Vault, and the script would not use a common identity. This makes it unsuitable for a scenario requiring a shared identity across multiple VMs, and it creates additional management overhead.

  When this WOULD be correct

  A system-assigned managed identity would be correct if the question required each VM to have its own unique identity and the script only needed access from that specific VM, with no requirement for identity sharing or persistence across redeployments.

• ✓

  A user-assigned managed identity attached to both VMs

  Why this is correct

  A user-assigned managed identity is created as an independent Azure AD identity and can be assigned to multiple Azure resources, including both virtual machines. Because its lifecycle is decoupled from the VMs, it survives VM deletion or redeployment, and both VMs can share the same identity to authenticate to Azure Key Vault without storing credentials. This allows the automation script to use the same identity for role-based access control, making it the correct and most secure choice.

• ✗

  A service principal stored in a configuration file on the VMs

  Why it's wrong here

  While a service principal could theoretically be shared, storing its client secret or certificate in a configuration file on each VM exposes credentials to the host, increasing the risk of theft or accidental exposure. This approach also requires manual secret rotation and management, and the script must handle the secret securely at runtime. Managed identities eliminate these secrets entirely, so this option is less secure and not the recommended pattern for Azure resources.

  When this WOULD be correct

  If the question required using a specific Azure AD application identity for external integrations (e.g., with a third-party SaaS) and the VMs were not in Azure (e.g., on-premises), a service principal with certificate stored in a configuration file would be appropriate.

• ✗

  A storage account access key stored in the script

  Why it's wrong here

  A storage account access key is a long-lived secret that grants full access to the storage account, not to Azure Key Vault. The script would need separate authentication to Key Vault, such as a client secret or managed identity, to retrieve secrets. Storing the access key directly in the script is a security anti-pattern: it exposes the key in source code, logs, or configuration, and it does not solve the identity requirement.

  When this WOULD be correct

  This option would be correct if the question asked for a simple, low-security method to allow a script running on a single VM to access a storage account without using Azure AD or managed identities, and the script is not shared across VMs.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question