AZ-700 Question 105
Select 2You manage a multi-tier application running on Azure Virtual Machines that uses Azure Key Vault to store sensitive connection strings. The VMs are domain-joined and must periodically retrieve these secrets. However, your organization's security policy prohibits storing any form of credentials or certificates on the VMs to keep them stateless and secure. Which two authentication methods can you implement to allow the VMs to securely access the secrets in Azure Key Vault without storing credentials locally?
- A
Assign a system-assigned managed identity to each VM
- B
Configure a user-assigned managed identity and link it to the VMs
- C
Use an Azure AD service principal that stores a client secret on the VM
- D
Use a shared key placed in a secure folder on each VM
Show answer and explanation
Correct answers: A, B
Explanation
Managed identities (system-assigned or user-assigned) are the recommended methods for Azure resources, including Azure Virtual Machines, to securely access Azure Key Vault without locally storing credentials. Both types of managed identities eliminate the need to manage and rotate secrets or certificates manually. For more details, see the official Azure Key Vault documentation on using managed identities: https://learn.microsoft.com/azure/key-vault/general/managed-identity.
- A. Correct.
Correct. A system-assigned managed identity is automatically created, managed, and rotated by Azure, so the VM can authenticate to Key Vault without storing credentials. This approach meets the requirement of not placing credentials on the VM.
- B. Correct.
Correct. A user-assigned managed identity is created independently of a specific VM but can be assigned to multiple resources. It also avoids credential storage on the VM since Azure manages rotations and lifecycle.
- C. Incorrect.
Incorrect. While using an Azure AD service principal is a valid authentication method, storing a client secret on the VM violates the requirement that no credentials be stored on the VM.
- D. Incorrect.
Incorrect. Shared keys stored on the VM create a security concern, as they would be considered static credentials. This goes against the organization� requirement to avoid local credential storage.