Exam AZ-400 topic 4 question 68 discussion

Correct answer is C, not B since you need to minimize the number of permission grants required (you would only need to assign permissions once).

Since 3 web servers: User-assigned If it was one server I'd have chosen system-assigned

I would go with C to minimise the number of permission grants.

C. User-assigned managed identity.

I think I'll go by C for this reason Since the managed identity is specific to each server and cannot be shared between different servers, this would not meet the requirement of minimizing the number of permission grants required, since you would have to grant access permissions to each managed identity individually.

The question asks about web app deployed to simple web servers. Not Azure Web Application. How are you going to assign User- or System managed identity to this Web App ?? It should be Service Principle + RBAC on KV.

Agree with answer. As there are 3 web servers, user assigned managed identity is simler

Because it’s for “three” web servers, answer is (user assigned) “C” If it was for one app/server, it would’ve been system assigned.

B. a system-assigned managed identity Azure Managed Identities provide an identity for applications to use without the need to manage the credentials. When you use a system-assigned managed identity, Azure creates an identity for the application instance in Azure AD. By granting the managed identity access to the Key Vault, you can ensure that the application can retrieve the secret without needing to store any credentials. This approach minimizes the number of permission grants required and follows the principle of least privilege because you can precisely control the access level of the managed identity in Azure Key Vault.