nerdexam
Microsoft

AZ-204 · Question #595

Drag and Drop Question You have an Azure Virtual Machine (VM) named VM1 running Windows Server 2022 and an Azure Key Vault instance named kv1. You are developing a .NET application named App1 that…

The correct answer is Create a system-assigned managed identity for the VM.; Retrieve an access token from Azure Instance Metadata endpoint.; Modify access policy on kv1. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of VM1 - when VM1 is deleted, the identity is automatically deprovisioned, satisfying the key requirement. The access token must be retrieved from the Azure Instance Metadata…

Submitted by fatema_kw· Mar 30, 2026Implement Azure security - specifically implementing managed identities for Azure resources and configuring access to Azure Key Vault using identity-based authentication.

Question

Drag and Drop Question You have an Azure Virtual Machine (VM) named VM1 running Windows Server 2022 and an Azure Key Vault instance named kv1. You are developing a .NET application named App1 that you plan to deploy to VM1. You have the following requirements: - App1 will require access to kv1. - The identity used by App1 to access kv1 must be automatically deprovisioned when VM1 is deleted. You need to identify the procedure that will meet the requirements. Which three actions should you include in the procedure? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Answer:

Exhibit

AZ-204 question #595 exhibit

Answer Area

Drag items

Create a user-assigned managed identity for the VM.Modify access policy on kv1.Retrieve an access token from Azure Instance Metadata endpoint.Create a system-assigned managed identity for the VM.Retrieve an access token from the Microsoft identity platform endpoint.

Correct arrangement

  • Create a system-assigned managed identity for the VM.
  • Retrieve an access token from Azure Instance Metadata endpoint.
  • Modify access policy on kv1.

Explanation

A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of VM1 - when VM1 is deleted, the identity is automatically deprovisioned, satisfying the key requirement. The access token must be retrieved from the Azure Instance Metadata Service (IMDS) endpoint (http://169.254.169.254/metadata/identity/oauth2/token), which is the correct mechanism for managed identities running inside an Azure VM. Finally, the Key Vault access policy on kv1 must be modified to grant the system-assigned managed identity the necessary permissions to access secrets, keys, or certificates.

Topics

#Managed Identity#Azure Key Vault#Azure Virtual Machines#Microsoft Entra ID

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-204 Practice