Task 3.1: Plan and implement identities for applications and Azure workloads

• AA standalone managed service account installed on the first of the servers

  Incorrect

  A standalone managed service account can be used on only one server.

• BA Microsoft Entra service principal with a certificate credential

  Incorrect

  SQL Server's Windows authentication on premises needs an Active Directory account, and the certificate still has to be managed.

• CA domain user account whose password is set never to expire, stored in the service settings

  Incorrect

  A user account's password has to be stored and rotated by people, which the requirement rules out.

• DA group managed service account that the farm's servers may use

  Correct

  Windows manages the password and the same account works across a server farm.

A group managed service account extends managed service account functionality over multiple servers: Windows manages its password and every instance in a farm uses the same principal. A standalone managed service account is limited to a single server, and a regular user account leaves password storage and rotation to administrators.

• AA system-assigned managed identity enabled on the function app

  Correct

  Its service principal is tied to the resource's lifecycle and is deleted with it.

• BA user-assigned managed identity created in the app's resource group

  Incorrect

  Its lifecycle isn't tied to the function app, so it would remain after the app is deleted.

• CAn app registration with a client secret stored in the app settings

  Incorrect

  That stores a credential and leaves an app registration behind after the app is gone.

• DA service principal with a federated identity credential that trusts the function app

  Incorrect

  Federated credentials need an external token issuer; a function app gets a managed identity instead.

A system-assigned managed identity creates a service principal tied to the lifecycle of the Azure resource: when the resource is deleted, Azure deletes the service principal. A user-assigned managed identity has its own lifecycle and remains until someone deletes it.

• AAssign the managed identity the Contributor role on the storage account

  Incorrect

  Contributor manages the account resource; like Reader, it doesn't grant access to blob data through Microsoft Entra ID.

• BSwitch the VM to a user-assigned managed identity with the same Reader role

  Incorrect

  The identity type doesn't matter; the role still covers only the management plane.

• CAssign the identity Storage Blob Data Reader on the account or container

  Correct

  Blob data access through Microsoft Entra ID needs a data role; Reader covers only management resources.

• DStore the account's access key in an environment variable on the VM

  Incorrect

  Shared keys bring back the stored credential that managed identities remove.

Azure Storage's built-in data roles, such as Storage Blob Data Reader, grant access to blob data. Azure Resource Manager roles such as Reader grant permissions on the storage account resource only, so a managed identity needs a data role to read blobs.

• AManaged Identity Operator

  Correct

  It reads and assigns user-assigned identities without managing them.

• BManaged Identity Contributor

  Incorrect

  This role also creates, updates and deletes user-assigned identities.

• COwner

  Incorrect

  Owner grants full control of the identities, far more than assigning them.

• DReader

  Incorrect

  Reader can see the identities but can't assign them to resources.

Managed Identity Contributor can create, read, update and delete user-assigned identities, while Managed Identity Operator can read and assign them. Assigning an identity to a VM also needs write access to the VM, which Virtual Machine Contributor gives.

• A5

  Incorrect

  The limit is higher.

• B100

  Incorrect

  The limit is lower.

• C20

  Correct

  A maximum of 20 federated identity credentials can be added to an application or user-assigned managed identity.

• DThere's no limit

  Incorrect

  Federated identity credentials are limited per identity.

A maximum of 20 federated identity credentials can be added to an application or a user-assigned managed identity, so many similar trust relationships may need several identities or a different design.

• AA standalone managed service account

  Incorrect

  sMSAs date from Windows Server 2008 R2 and don't supersede an existing account.

• BA group managed service account

  Incorrect

  gMSAs don't supersede a standard service account or block its old password.

• CA Microsoft Entra managed identity

  Incorrect

  Managed identities serve Azure resources, not Active Directory service accounts.

• DA delegated managed service account

  Correct

  dMSA supersedes a standard service account, blocking its password and linking authentication to device identity.

Windows Server 2025 introduces the delegated managed service account (dMSA), which can replace an existing standard service account: authentication with the old password is blocked and requests go to the dMSA, whose keys are managed and tied to mapped machine identities, which helps against kerberoasting.

• AThe name you type when you enable the identity

  Incorrect

  System-assigned identities take their name automatically.

• BA random GUID that you rename later

  Incorrect

  The name isn't random.

• CThe name of the VM's resource group

  Incorrect

  The name comes from the resource itself.

• Dapp-vm-01, the same name as the VM

  Correct

  A system-assigned identity's service principal always has the resource's name.

When you enable a system-assigned managed identity, a special service principal is created whose name is always the same as the Azure resource's name (for a deployment slot, <app-name>/slots/<slot-name>).