Managed identities concept in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

What is the primary benefit of using managed identities in Azure?

Managed identities help Azure services authenticate securely without needing to manage credentials manually. What is the main advantage of this?

A They eliminate the need to store and rotate credentials manually, reducing security risks.

B They allow users to log in to Azure Portal without a password.

C They automatically back up all Azure resources daily.

D They provide unlimited free compute resources for identity management.

💡 Hint

Think about how credentials are handled and the risks involved.

Managed identities remove the need to store credentials in code or configuration, which reduces the chance of leaks and simplifies security management.

❓ Architecture

intermediate

Which Azure service can use a system-assigned managed identity to access Azure Key Vault securely?

You want an Azure service to retrieve secrets from Azure Key Vault without embedding credentials. Which service can use a system-assigned managed identity for this purpose?

A Azure Blob Storage

B Azure Virtual Machine

C Azure CDN

D Azure Traffic Manager

💡 Hint

Consider which services run code and can have identities assigned.

Azure Virtual Machines can have system-assigned managed identities that allow them to authenticate to Azure Key Vault securely without credentials.

❓ security

advanced

What happens if you delete an Azure resource with a system-assigned managed identity?

Consider an Azure resource (like a VM) with a system-assigned managed identity. What is the effect on the managed identity when the resource is deleted?

A The managed identity remains active and can be used by other resources.

B The managed identity is disabled but not deleted.

C The managed identity is converted to a user-assigned managed identity.

D The managed identity is automatically deleted along with the resource.

💡 Hint

Think about the lifecycle of system-assigned identities tied to resources.

System-assigned managed identities are tied to the lifecycle of the resource. When the resource is deleted, the identity is also deleted automatically.

❓ service_behavior

advanced

How does a user-assigned managed identity differ in lifecycle from a system-assigned managed identity?

Compare user-assigned and system-assigned managed identities regarding their lifecycle and reuse.

A User-assigned managed identities cannot be assigned to more than one resource; system-assigned identities can.

B User-assigned managed identities are deleted when the resource is deleted; system-assigned identities persist independently.

C User-assigned managed identities exist independently and can be shared across multiple resources; system-assigned identities are tied to one resource and deleted with it.

D Both user-assigned and system-assigned managed identities are deleted when the resource is deleted.

💡 Hint

Think about identity reuse and independence from resources.

User-assigned managed identities are created as standalone Azure resources and can be assigned to multiple Azure services. They persist beyond the lifecycle of any single resource. System-assigned identities are created for and tied to one resource only.

✅ Best Practice

expert

You want to grant an Azure Function access to an Azure Storage account securely. Which approach follows best practices using managed identities?

Choose the best way to allow an Azure Function to access an Azure Storage account without storing credentials in code.

A Assign a system-assigned managed identity to the Azure Function and grant it the Storage Blob Data Contributor role on the Storage account.

B Create a user-assigned managed identity and embed its client secret in the Azure Function code.

C Store the Storage account key in Azure Function app settings and use it in code.

D Use a shared access signature (SAS) token hardcoded in the Azure Function.

💡 Hint

Consider secure authentication without secrets in code or settings.

Assigning a system-assigned managed identity to the Azure Function and granting it the appropriate role on the Storage account allows secure access without secrets or keys in code or settings.