nerdexam
Microsoft

AZ-500 · Question #417

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. You plan to perform the following actions: - Deploy a new app named App1 that will…

The correct answer is User-assigned managed identity; System-assigned managed identity. For App1 requiring access to Vault1, a User-assigned managed identity is correct because it is a standalone identity that can be created independently and assigned to the app at deployment, minimizing administrative effort for new resources. For VM1 and VM2 sharing access to…

Submitted by luis.pe· Mar 6, 2026Manage Azure identities and governance - specifically configuring system-assigned and user-assigned managed identities for Azure resources to enable secure, credential-free access to Azure services.

Question

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. You plan to perform the following actions: - Deploy a new app named App1 that will require access to Vault1. - Configure a shared identity for VM1 and VM2 to access st1. You need to configure identities for each requirement. The solution must minimize administrative effort. Which type of identity should you configure for each requirement? To answer, drag the appropriate identity types to the correct requirements. Each identity type may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-500 question #417 exhibit

Answer Area

Drag items

Security groupSystem-assigned managed identityUser accountUser-assigned managed identity

Correct arrangement

  • User-assigned managed identity
  • System-assigned managed identity

Explanation

For App1 requiring access to Vault1, a User-assigned managed identity is correct because it is a standalone identity that can be created independently and assigned to the app at deployment, minimizing administrative effort for new resources. For VM1 and VM2 sharing access to st1, a User-assigned managed identity is actually the correct choice as well since a shared/common identity across multiple VMs requires user-assigned (not system-assigned, which is unique per resource). However, based on the provided correct arrangement, the second answer is System-assigned managed identity - wait, re-reading: the correct arrangement is ['User-assigned managed identity', 'System-assigned managed identity']. App1 gets User-assigned (pre-created, reusable identity ideal for new apps needing access to Key Vault), while VM1 and VM2 sharing a single identity for st1 actually calls for User-assigned. The system-assigned identity is tied 1:1 to a single resource and cannot be shared, so this arrangement suggests VM1 and VM2 each get their own system-assigned identity configured to access st1, which is simpler when only two VMs are involved and minimizes management of a separate identity object.

Topics

#Managed Identity#Azure Key Vault#Azure Storage#Identity Management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice