Managed identity integration in Azure - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

What happens when an Azure VM uses a system-assigned managed identity to access Azure Key Vault?

An Azure Virtual Machine (VM) is configured with a system-assigned managed identity. The VM tries to retrieve a secret from an Azure Key Vault. What is the expected behavior if the VM's managed identity has been granted the correct access policy in the Key Vault?

A The VM can access the Key Vault only if a user-assigned managed identity is attached instead.

B The VM must provide a client secret or certificate to authenticate before accessing the Key Vault.

C The VM can successfully authenticate using its managed identity and retrieve the secret from the Key Vault.

D The VM cannot access the Key Vault because system-assigned managed identities are not supported for Key Vault access.

💡 Hint

Think about how system-assigned managed identities simplify authentication without credentials.

System-assigned managed identities allow Azure resources like VMs to authenticate to services such as Key Vault without needing credentials. If the VM's managed identity has the correct access policy, it can retrieve secrets securely.

❓ Architecture

intermediate

Which managed identity type should you use to share the same identity across multiple Azure resources?

You want multiple Azure resources (like VMs and App Services) to authenticate to Azure SQL Database using the same managed identity. Which managed identity type supports this scenario?

A User-assigned managed identity, because it can be assigned to multiple resources.

B No managed identity can be shared; each resource must have its own system-assigned identity.

C System-assigned managed identity, because it is automatically created for each resource.

D Use a service principal instead of managed identities for sharing identities.

💡 Hint

Consider which identity type is reusable across resources.

User-assigned managed identities are created independently and can be assigned to multiple Azure resources, allowing them to share the same identity for authentication.

❓ security

advanced

What is the security benefit of using managed identities over storing credentials in application code?

Why is using managed identities considered more secure than embedding credentials like passwords or keys directly in application code or configuration files?

A Managed identities require developers to encrypt credentials manually before storing them in code.

B Managed identities eliminate the need to store or rotate credentials manually, reducing the risk of credential leakage.

C Managed identities allow credentials to be stored in environment variables, which are more secure than code files.

D Managed identities automatically generate long, complex passwords that must be updated monthly.

💡 Hint

Think about how credentials are handled and risks of exposure.

Managed identities provide tokens dynamically and do not require storing credentials anywhere, which reduces the risk of accidental exposure or theft of secrets.

❓ Configuration

advanced

Which Azure CLI command assigns a user-assigned managed identity to an Azure VM?

You have created a user-assigned managed identity named myIdentity in resource group myRG. Which Azure CLI command correctly assigns this identity to an existing VM named myVM in the same resource group?

A az vm identity assign --resource-group myRG --name myVM --identities /subscriptions/{subId}/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myIdentity

B az vm identity assign --resource-group myRG --name myVM --identities myIdentity

C az vm identity assign --resource-group myRG --name myVM --identity myIdentity

D az vm assign-identity --resource-group myRG --name myVM --user-identity myIdentity

💡 Hint

Check the required format for the --identities parameter.

The --identities parameter requires the full resource ID of the user-assigned managed identity when assigning it to a VM.

🧠 Conceptual

expert

What is the main difference in token lifecycle between system-assigned and user-assigned managed identities?

Consider how tokens are issued and managed for system-assigned versus user-assigned managed identities. What is the key difference in their lifecycle and management?

A User-assigned managed identities automatically renew tokens every 5 minutes; system-assigned identities require manual token renewal.

B User-assigned managed identities are only valid for 24 hours; system-assigned identities last indefinitely.

C System-assigned managed identities require manual rotation of credentials; user-assigned identities do not issue tokens.

D System-assigned managed identities are tied to the lifecycle of the resource and are deleted when the resource is deleted; user-assigned identities exist independently and can be shared.

💡 Hint

Think about how the identity's existence relates to the resource it is assigned to.

System-assigned managed identities are created and deleted with the resource, while user-assigned identities are independent resources that can be assigned to multiple resources and persist beyond any single resource's lifecycle.