AZ-104 Practice Question 51: Managed Identity Shared Key Vault
Microsoft Azure Administrator Associate (AZ-104) · Test 6 · question 1 of 10
Twenty Azure VMs, deployed from the same template, each run a service that reads secrets from one Azure Key Vault. The operations team rebuilds these VMs regularly and does not want to repeat the access setup on the vault every time a VM is recreated. They also want no credentials stored on the VMs.
What should the administrator do?
Show answer and explanation
Answer:
A user-assigned managed identity is a standalone Azure resource with its own lifecycle. It can be attached to many VMs, and its access to Key Vault is granted once. When a VM is deleted and recreated from the template, attaching the same identity restores access with no change on the vault, and no credential is ever stored on the machine because Azure issues the tokens.
Option B works but does not meet the goal. A system-assigned identity is tied to one VM and is deleted with it, so every rebuild creates a new identity that needs a fresh access grant, and the vault ends up with twenty separate assignments to maintain.
Option C stores a secret on every VM, which the requirements rule out. The secret also has to be rotated before it expires, which adds the operational work that managed identities remove.
Option D uses a user account for a non-interactive service. It needs a password on each VM, is subject to MFA and password policies, and is the pattern managed identities are designed to replace.