nerdexam
Microsoft

AZ-305 · Question #214

Hotspot Question You have five .NET Core applications that run on 10 Azure virtual machines in the same subscription. You need to recommend a solution to ensure that the applications can…

The correct answer is To provision the Azure AD identity:: Create a user-assigned Managed Service Identity; To authenticate request a token by using:: An Azure Instance Metadata Service Identity. This question tests knowledge of Azure AD Managed Identities and how to assign them to Azure Virtual Machines so that multiple applications can share the same identity while being restricted to specific VMs.

Submitted by lars.no· Mar 6, 2026Design identity, governance, and monitoring solutions

Question

Hotspot Question You have five .NET Core applications that run on 10 Azure virtual machines in the same subscription. You need to recommend a solution to ensure that the applications can authenticate by using the same Azure Active Directory (Azure AD) identity. The solution must meet the following requirements: - Ensure that the applications can authenticate only when running on the 10 virtual machines. - Minimize administrative effort. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-305 question #214 exhibit

Answer Area

  • To provision the Azure AD identity:Create a user-assigned Managed Service Identity
    Create a system-assigned Managed Service IdentityCreate a user-assigned Managed Service IdentityRegister each application in Azure AD
  • To authenticate request a token by using:An Azure Instance Metadata Service Identity
    An Azure AD v1.0 endpointAn Azure AD v2.0 endpointAn Azure Instance Metadata Service IdentityOAuth2 endpoint

Explanation

This question tests knowledge of Azure AD Managed Identities and how to assign them to Azure Virtual Machines so that multiple applications can share the same identity while being restricted to specific VMs.

Approach. The correct approach is to use a User-Assigned Managed Identity. A User-Assigned Managed Identity is created as a standalone Azure resource and can be assigned to multiple VMs (all 10 in this case), allowing all five .NET Core applications running on those VMs to authenticate using the same Azure AD identity. This satisfies the constraint that applications can only authenticate when running on those specific VMs (since the managed identity token is only accessible from the VM's instance metadata endpoint) and minimizes administrative effort because there are no credentials to manage, rotate, or store. You would: (1) Create one User-Assigned Managed Identity, and (2) Assign that identity to all 10 Virtual Machines - rather than creating 10 separate System-Assigned Managed Identities (one per VM) which would require managing 10 different identities and granting permissions 10 times.

Concept tested. Azure AD Managed Identities - specifically the difference between System-Assigned Managed Identity (tied to a single resource lifecycle) and User-Assigned Managed Identity (a standalone resource that can be shared across multiple Azure resources), and how they enable passwordless authentication for applications running on Azure VMs.

Reference. https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

Topics

#Azure AD authentication#Managed Identities#User-assigned identity#Application security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-305 Practice