You have an Azure subscription that contains an Azure Automation account named Automation1. You need to grant Automation1 access to Azure resources. The solution must meet the following…

Question

Options

• Aa client secret
• Ba system-assigned managed identity
• Ca certificate
• Duser-assigned managed identity

• A
  4% (1)
• B
  80% (20)
• C
  4% (1)
• D
  12% (3)

Explanation

Explanation

A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Automation1 account - when the account is deleted, the identity and all its permissions are automatically removed, satisfying the first requirement. It also requires minimal administrative effort since Azure manages the credential lifecycle automatically, eliminating the need to manually rotate secrets or certificates.

Why the distractors are wrong:

• A (Client secret): Secrets must be manually created, stored, rotated, and cleaned up - this increases administrative effort and doesn't auto-delete when the Automation account is removed.
• C (Certificate): Like client secrets, certificates require manual management, rotation, and cleanup, failing both requirements.
• D (User-assigned managed identity): A user-assigned identity exists independently of any resource it's attached to, meaning its permissions persist even after Automation1 is deleted - directly violating the first requirement.

Memory Tip

Think "system = same lifecycle." A system-assigned identity lives and dies with the resource it belongs to, while a user-assigned identity is a separate object that outlives its assignments. Whenever an exam question mentions auto-cleanup on deletion, always lean toward system-assigned.

No community discussion yet for this question.