You have an Azure subscription that contains two virtual machines named VM1 and VM2 and an Azure SQL managed instance named SQL1. You need to ensure that VM1 and VM2 can retrieve data from SQL1. The…

Question

Options

• Aa certificate
• Ba shared access signature (SAS) token
• Ca managed identity
• Da Microsoft Entra user account

• A
  4% (1)
• B
  17% (4)
• C
  74% (17)
• D
  4% (1)

Explanation

Explanation

A managed identity is the right choice because it allows VM1 and VM2 to authenticate to SQL1 without storing or managing credentials - Azure handles the identity lifecycle automatically, which directly minimizes administrative effort. You would create the managed identity first, then grant it the appropriate permissions on SQL1, enabling seamless, secure access between the resources.

Why the distractors are wrong:

• A (Certificate): Certificates require manual creation, distribution, rotation, and renewal - significantly more administrative overhead than a managed identity.
• B (SAS token): SAS tokens are designed for Azure Storage access, not for SQL Managed Instance authentication, making this irrelevant to the scenario.
• D (Microsoft Entra user account): While Entra user accounts can authenticate to SQL, they require manual credential management and are better suited for human users, not service-to-service communication between Azure resources.

Memory Tip

Think of managed identities as "service accounts on autopilot" - whenever an exam question involves an Azure resource (like a VM) needing to securely access another Azure resource with minimal admin effort, managed identity is almost always the answer. The keyword "minimize administrative effort" is your trigger to choose managed identity over certificates or user accounts.

No community discussion yet for this question.