AZ-802 Manage Windows Server in a Hybrid Environment Practice Question
Exhibit
Error Log: [2023-10-10 10:00:00] [Error] Failed to acquire token for managed identity. Error: '403 Forbidden'.
Refer to the exhibit. An Arc-enabled server is reporting a 403 Forbidden error when trying to access an Azure key vault. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The server's system-assigned identity lacks access to the Key Vault
A 403 Forbidden error indicates that the identity being used by the Arc-enabled server is authenticated but lacks the necessary permissions to access the specific resource. In this case, the server's managed identity has not been granted the required access policy or RBAC role on the target Key Vault. This is a common permission configuration error in hybrid environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Azure Connected Machine agent is corrupted
Why it's wrong here
Corruption would typically result in service crashes or communication errors, not an explicit 403 Forbidden error. A 403 error is an authorized response from the service, confirming that the client reached the service but was refused access due to insufficient privileges on the target resource.
- ✓
The server's system-assigned identity lacks access to the Key Vault
Why this is correct
Managed identities for Azure Arc-enabled servers must be explicitly granted access to specific resources like Key Vault. If the identity exists but has no assigned access policy in the Key Vault, any request it makes will be rejected with a 403 Forbidden status, regardless of the agent's health.
- ✗
The network firewall is blocking the connection
Why it's wrong here
Firewall blocks generally manifest as connectivity timeouts or 'connection reset' errors. Because the service successfully returned a '403 Forbidden' response, we know the request traveled across the network and reached the Azure service endpoint. Therefore, the network connectivity is functional, and the issue is strictly authorization-related.
- ✗
The subscription has reached its resource limit
Why it's wrong here
Exceeding subscription limits would typically result in a 429 Too Many Requests or 403 error specifically related to capacity quotas, not access. Authorization issues regarding specific Key Vault contents are distinct from general resource limits and should be investigated via identity and access controls (IAM).
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
About these practice questions
Courseiva writes every AZ-802 question from scratch — 116 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-802 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-802 exam.