An Azure App Service app needs to access an Azure Key Vault to retrieve a connection string. The app is deployed in a production environment, and the team wants to avoid storing any credentials in the app's configuration. What should you do?

Enable a system-assigned managed identity on the App Service app and grant it the Key Vault Secrets User role on the vault.

Use the app's outbound IP address to authorize access to Key Vault.

Create a service principal and add its client secret to the app's application settings.

Store the connection string in the App Service application settings and reference it in code.

Which identity type is automatically created when you enable a system-assigned managed identity for an Azure resource?

A service principal in Microsoft Entra ID

A managed service account (gMSA) in Active Directory

A user account in Microsoft Entra ID

An application registration in Microsoft Entra ID

Which Azure portal blade would you use to create a user-assigned managed identity?

Subscriptions > Resource providers

Microsoft Entra ID > App registrations

Microsoft Entra ID > Service principals

An Azure function app has a system-assigned managed identity enabled. The function app needs to read a secret from Azure Key Vault. What must be done to allow the function app to access the secret?

Create a service principal for the function app and use its client secret

Assign the function app's managed identity the 'Reader' role on the Key Vault

Grant the function app's managed identity the 'Key Vault Secrets User' role on the Key Vault

Store the Key Vault URL in the function app's application settings

An Azure Function app uses a system-assigned managed identity to access a storage account. The function app is currently unable to read blobs from the storage account. You have verified that the managed identity is enabled on the function app. What is the most likely cause of the issue?

The managed identity has not been granted the 'Storage Blob Data Reader' role on the storage account.

The function app needs to be restarted after enabling the managed identity.

The function app is using the wrong storage account endpoint.

The storage account is in a different region than the function app.

Microsoft Certified:Identity and Access Administrator Associate

Domain 3Objective 1

Plan and Implement Identities for Applications and Azure Workloads SC-300 Practice Questions (Page 3)

Part of the Plan and implement workload identities domain, which accounts for 20–25% of the SC-300 exam. Microsoft does not publish an official question count, but from its 100-minute exam (~40–65 total, ~8–16 in this domain), expect 2–4 from this objective — we provide 18 practice questions to prepare you well beyond it. (estimate)

18questions here

4free pages

4concepts

20–25%of the exam

Questions 11–15

11application · medium
An Azure App Service app needs to access an Azure Key Vault to retrieve a connection string. The app is deployed in a production environment, and the team wants to avoid storing any credentials in the app's configuration. What should you do?
Select an answer first
12foundation · easy
Which identity type is automatically created when you enable a system-assigned managed identity for an Azure resource?
Select an answer first
13foundation · easy
Which Azure portal blade would you use to create a user-assigned managed identity?
Select an answer first
14foundation · easy
An Azure function app has a system-assigned managed identity enabled. The function app needs to read a secret from Azure Key Vault. What must be done to allow the function app to access the secret?
Select an answer first
15application · medium
An Azure Function app uses a system-assigned managed identity to access a storage account. The function app is currently unable to read blobs from the storage account. You have verified that the managed identity is enabled on the function app. What is the most likely cause of the issue?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-300

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-300” is a trademark of its owner, used for identification only.