Code on a VM must call Key Vault without storing any credential in code, config, or environment variables. What should be enabled?
A.A service principal with a stored client secret
Service principals still need secrets — the credential-storage problem persists.
B.A managed identity on the VM, granted Key Vault access
Managed identity = credential-free auth. Correct.
C.The VM's public IP allowlisted on Key Vault
IP allowlisting is network filtering, not authentication.
D.A SAS token for the vault
SAS tokens are a storage-access mechanism — not Key Vault auth.
Why this answer
Managed identities give Azure resources an automatically-managed Entra identity — tokens issued via the IMDS endpoint, zero credentials to store or rotate. System-assigned (tied to the VM lifecycle) or user-assigned (reusable across resources).
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Compute Deployment practice session.
Practice Compute Deployment