AZ-204 Implement Azure security Practice Question
You have multiple Azure virtual machines that need to access the same Azure Key Vault to retrieve certificates. You want to minimize administrative overhead while ensuring each VM can authenticate without managing credentials. Which identity type should you use?
⚠ Common exam trap
Many exam-takers choose system-assigned managed identities (Option A) because they seem simpler per-VM, but they overlook the administrative overhead of managing separate access policies for each VM when multiple VMs require identical access to the same Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User-assigned managed identity assigned to each VM
A user-assigned managed identity can be created once and then assigned to multiple Azure VMs, allowing all of them to authenticate to the same Key Vault without storing any credentials. This minimizes administrative overhead compared to managing separate system-assigned identities or service principals, as the identity is independent of any single VM's lifecycle and can be reused across resources.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
System-assigned managed identity on each VM
Why it's wrong here
A system-assigned managed identity is intrinsically tied to a specific Azure resource, like a single VM, and is automatically created and deleted with that resource. When applied to multiple VMs, each VM receives its own unique identity. This necessitates granting individual access permissions to the target resource, such as Azure Key Vault, for every single VM's identity, leading to significant administrative overhead for managing permissions at scale.
- ✓
User-assigned managed identity assigned to each VM
Why this is correct
A user-assigned managed identity is a standalone Azure resource that can be created once and then assigned to multiple Azure VMs. This approach centralizes identity management, as you only need to grant access permissions to the target resource, such as Azure Key Vault, to this single user-assigned identity. All assigned VMs can then leverage this identity, drastically reducing administrative overhead and simplifying permission management across your fleet of virtual machines.
- ✗
Service principal with client secret stored in each VM
Why it's wrong here
Using a service principal with a client secret requires securely storing and managing the secret on each virtual machine. This introduces significant security risks, as the secret could be compromised if the VM is breached, and mandates a robust secret rotation strategy. Unlike managed identities, service principals do not benefit from Azure's automatic credential management, placing the burden of lifecycle management and secure handling entirely on the developer.
- ✗
Storage account key
Why it's wrong here
A storage account key is a credential used exclusively for authenticating requests to an Azure Storage account, granting full access to the data within that specific storage account. It is entirely unrelated to Azure Key Vault and cannot be used as an authentication mechanism to access secrets, keys, or certificates stored within a Key Vault instance. Attempting to use a storage account key for Key Vault access would simply result in an authentication failure.
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.