Plan and Implement Identities for Applications and Azure Workloads SC-300 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which identity type is best suited for an Azure virtual machine that needs to access Azure Key Vault without storing any credentials in code or configuration files?

   • AA user-assigned managed identity
   • BA group managed service account (gMSA)
   • CA Microsoft Entra user account
   • DA service principal created from an application registration
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company runs multiple Azure Functions that need to access the same Azure SQL Database. The functions are deployed in the same region and share the same lifecycle. You need to configure an identity that minimizes administrative overhead and allows all functions to share a single identity. What should you do?

   • ACreate a service principal and configure each function app to use its client secret.
   • BCreate a user-assigned managed identity and assign it to each function app.
   • CEnable a system-assigned managed identity on each function app.
   • DUse a single Azure AD user account and configure the functions to run under that account.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A legacy application runs on an Azure VM and needs to access Azure Key Vault. The application does not support managed identities, but the team wants to avoid storing a password in the VM. What should you do?

   • ACreate a service principal with a certificate and install the certificate on the VM.
   • BUse the VM's local administrator account to access Key Vault.
   • CStore the service principal password in the VM's environment variables.
   • DEnable a system-assigned managed identity on the VM and update the application to use it.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   You need to assign a user-assigned managed identity to an Azure App Service. Which step is required to complete the assignment?

   • ASelect the user-assigned managed identity in the App Service's 'Identity' blade
   • BCreate a new application registration in Microsoft Entra ID
   • CGrant the App Service the 'Managed Identity Operator' role on itself
   • DEnable the system-assigned identity first
   Reveal Solution Discussion Select an answer first
6. 10application · hard

   A company is planning to migrate a legacy application to Azure. The application currently runs under a group managed service account (gMSA) in the on-premises Active Directory. The application will run on an Azure VM and needs to access on-premises resources. You need to recommend an identity strategy. What should you recommend?

   • AReplace the gMSA with a user-assigned managed identity and use it for both Azure and on-premises access.
   • BStore the gMSA password in Azure Key Vault and have the VM retrieve it.
   • CUse a system-assigned managed identity for the Azure VM and keep the gMSA for on-premises access.
   • DUse a service principal with a client secret for all authentication.
   Reveal Solution Discussion Select an answer first