Exam AZ-204 topic 4 question 83 discussion

1. Create a system-assigned managed identity This ensures the identity is tied to the VM and deleted with it. 2. Modify access policy on kv1 Before App1 can read or write secrets, you must add an Access Policy to kv1, assigning the VM principal the permissions (e.g. get, list). https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal 3. Retrieve access token via IMDS App1 makes an HTTP call to the local metadata endpoint (http://169.254.169.254/metadata/identity/oauth2/token?resource=https://{vault-name}.vault.azure.net&api-version=...) to get an access token for the Key Vault resource. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-to-use-vm-token

I think the anwser is: Create a system-assigned managed identity for the VM. Modify the access policy on kv1. Retrieve an access token from the Azure Instance Metadata Service (IMDS) endpoint.

the given answer is correct.