You have an Azure subscription that contains an Azure SQL database named db1. You deploy an Azure App Service web app named App1 that provides product information to users that connect to App1…

Question

Options

• Aa system-assigned managed identity
• Ban Azure Active Directory (Azure AD) user account
• Ca SQL Server account
• Da user-assigned managed identity

• A
  79% (15)
• B
  5% (1)
• C
  16% (3)

Explanation

Explanation

A system-assigned managed identity is the ideal solution because it is automatically created and exclusively tied to App1's lifecycle - when App1 is deleted, the identity is deleted too, ensuring credentials are available only to App1 with no manual credential management required. This directly satisfies both requirements: exclusivity and minimized administrative effort, since Azure handles the identity automatically without you needing to create, rotate, or store any secrets.

Why the distractors are wrong:

• B (Azure AD user account): A user account can be shared across multiple applications or users, violating the "credentials only available to App1" requirement, and requires manual management.
• C (SQL Server account): SQL Server accounts use username/password credentials that must be manually created, stored, and rotated - increasing administrative effort and security risk.
• D (User-assigned managed identity): While still a managed identity, a user-assigned identity is created independently and can be shared across multiple resources, which violates the exclusivity requirement.

Memory Tip

Think of it this way: System-assigned = born with the app, dies with the app (exclusive + automatic), while User-assigned = a shared ID card that multiple apps can carry. When the question demands exclusivity + minimal effort, always lean toward system-assigned.

No community discussion yet for this question.