Plan and Implement Identities for Applications and Azure Workloads SC-300 Practice Questions (Page 4)

Questions 16–18

1. 16application · medium

   Fabrikam Inc. runs a batch processing job on an Azure VM that needs to read from Azure Blob Storage and write to Azure Queue Storage. The job is currently using a storage account key stored in an environment variable. You need to eliminate the storage account key from the VM configuration. What should you do?

   • AEnable a system-assigned managed identity on the VM and assign the 'Storage Blob Data Reader' and 'Storage Queue Data Contributor' roles to the identity.
   • BStore the storage account key in Azure Key Vault and retrieve it from the VM at runtime.
   • CCreate a user-assigned managed identity, assign it to the VM, and grant it 'Storage Account Key Operator' role on the storage account.
   • DUse a service principal with a client certificate to authenticate to the storage account.
   Reveal Solution Discussion Select an answer first
2. 17application · hard

   A virtual machine scale set runs a workload that must call the Microsoft Graph API to read user profiles. The workload currently uses a client secret stored in the VM image. You need to remove the secret and use a managed identity. What should you do?

   • ACreate a user-assigned managed identity and assign it to the scale set, then grant it the Directory Readers role in Microsoft Entra ID.
   • BEnable a system-assigned managed identity on the scale set and grant the identity the User.Read.All application permission for Microsoft Graph.
   • CRegister an application in Microsoft Entra ID and use the client credentials flow with a certificate.
   • DUse the VM's system-assigned managed identity to request a token for the Azure Resource Manager endpoint.
   Reveal Solution Discussion Select an answer first
3. 18expert · hard

   A company has a policy that all Azure resources must use managed identities. They are deploying a new Azure Kubernetes Service (AKS) cluster that needs to access Azure Container Registry (ACR) and Azure Key Vault. The cluster will be deleted and recreated frequently in a development environment. You need to recommend an identity approach that minimizes the number of role assignments and access policies you must manage. What should you recommend?

   • ACreate a user-assigned managed identity, assign it to the AKS cluster, and grant it the necessary permissions on ACR and Key Vault.
   • BEnable a system-assigned managed identity on the AKS cluster and grant permissions to each cluster.
   • CUse the AKS cluster's built-in service principal.
   • DUse a service principal with a client secret stored in Key Vault.
   Reveal Solution Discussion Select an answer first