Managed Identities

Practice questions

1. Question 1Q-BFEC30

   An Azure Function must read secrets from an Azure Key Vault without storing credentials in application settings. The Key Vault uses Azure role-based access control. Which configuration is most appropriate?

   1. A.Enable a system-assigned managed identity for the Function App and assign it the Key Vault Secrets User role on the vault.
   2. B.Store the Key Vault access key in an application setting and use it from the Function.
   3. C.Create a user-assigned managed identity but do not assign it any role on the Key Vault.
   4. D.Use the Function App's deployment publishing profile credentials to authenticate to the Key Vault.
   See the answer and solution
2. Question 2Q-147616

   A company deploys several App Services and virtual machines that must access the same Azure Storage account. The identity must remain available if one of the application resources is deleted and recreated. Which approach best meets these requirements?

   1. A.Enable a separate system-assigned managed identity on every resource and recreate role assignments after each deployment.
   2. B.Create one user-assigned managed identity, assign it the required Storage Blob Data Contributor role, and attach it to each resource.
   3. C.Use the Azure subscription owner's credentials in each application.
   4. D.Create a system-assigned managed identity on a resource group and attach the resource group's identity to the applications.
   See the answer and solution
3. Question 3Q-CB0728

   An App Service has both a system-assigned managed identity and a user-assigned managed identity attached. The application must use the user-assigned identity to access Blob Storage. Which change explicitly selects that identity when using the Azure .NET SDK?

   1. A.Use new DefaultAzureCredential() without any options, because the SDK always selects the user-assigned identity.
   2. B.Use new DefaultAzureCredential(new DefaultAzureCredentialOptions { ManagedIdentityClientId = userAssignedClientId }) when constructing the BlobServiceClient.
   3. C.Pass the user-assigned identity's client ID as the storage account name when constructing the BlobServiceClient.
   4. D.Set the storage account's access key as the ManagedIdentityClientId value.
   See the answer and solution
4. Question 4Q-927DAF

   An Azure App Service uses a system-assigned managed identity to access an Azure Storage account. What happens to that identity when the App Service is deleted?

   1. A.The managed identity is automatically deleted with the App Service.
   2. B.The identity is converted automatically into a user-assigned managed identity.
   3. C.The identity remains available until an administrator manually deletes it.
   4. D.The identity is transferred automatically to the next App Service deployed in the same resource group.
   See the answer and solution
5. Question 5Q-504F33

   A user-assigned managed identity must read blobs from a storage account. The identity's principal ID is <principal-id>, and the storage account resource ID is <storage-resource-id>. Which Azure CLI command grants the least-privilege data-plane permission?

   1. A.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal --role "Storage Blob Data Reader" --scope <storage-resource-id>
   2. B.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type User --role "Reader" --scope <storage-resource-id>
   3. C.az role assignment create --assignee-object-id <principal-id> --assignee-principal-type ServicePrincipal --role "Storage Blob Data Owner" --scope <storage-resource-id>
   4. D.az role assignment create --assignee <principal-id> --role "Contributor" --scope <storage-resource-id>
   See the answer and solution