Exam AZ-204 topic 4 question 20 discussion

Correct Answer: Yes Using the Invoke-WebRequest cmdlet, make a request to the local managed identity for Azure resources endpoint to get an access token for Azure Resource Manager. I believe we can you Invoke-RestMethod too. https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm

This does make sense since a web-request can be a rest call! In the link below, it explains how web-request supports HTML content while Rest-Method supports JSON and XML content. The link provided for the solution is correct as well. https://superuser.com/questions/1235349/what-is-the-difference-between-invoke-webrequest-and-invoke-restmethod

Yes, the solution does meet the goal. The Invoke-RestMethod cmdlet can be used to make a request to the local managed identity for Azure resources endpoint (http://169.254.169.254/metadata/identity/oauth2/token). This endpoint can provide an Azure Resource Manager access token when called from an Azure VM with a managed identity enabled. This token can then be used to authenticate to the Azure Resource Manager API.

Got this in the exam today ! Nov 25, 2022

Answer: Yes

Absolutely the corrct answer is A

Answer A - The 2 most upvoted comments say this is correct and they are right.

Answer is Yes

Need to use Invoke-WebRequest cmdlet not Invoke-RestMethod Correct Answer: B Get an access token using the VM's system-assigned managed identity and use it to call Azure Resource Manager You will need to use PowerShell in this portion. 1. In the portal, navigate to Virtual Machines and go to your Windows virtual machine and in the Overview, click Connect. 2. Enter in your Username and Password for which you added when you created the Windows VM. 3. Now that you have created a Remote Desktop Connection with the virtual machine, open PowerShell in the remote session. 4. Using the Invoke-WebRequest cmdlet, make a request to the local managed identity for Azure resources endpoint to get an access token for Azure Resource Manager. Example: $response = Invoke-WebRequest -Uri 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https:// management.azure.com/' -Method GET -Headers @{Metadata="true"} Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm

The answer is Yes correct Invoke-WebRequest or Invoke-RestMethod will do the same job but the response in RestMethod will be much simpler.

The answer is no Invoke-RestMethod: Grant your VM access to a secret stored in a Key Vault https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-nonaad Invoke-WebRequest: Grant your VM access to a Resource Group in Azure Resource Manager https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm

Answer is YES, you can make use of the PowerShell commands to make a request to managed identity service of the virtual machine. The Invoke-RestMethod is a generic call that is available in PowerShell for making a call to a web service.

In order to grant VM access to ARM you need to: - assign VM user/system managed identity - configure permission to ARM for that identity - and then you can access token by Invoke-WebRequest cmdlet and use to to authenticate in ARM. There is nothing in the question which indicates that those 2 previous steps are already done, so I would say it is not a correct answer.

A. Yes

A. Yes Invoke-RestMethod is merely a rapper commandlet around Invoke-WebRequest.

I code in powershell regularly and Invoke-RestMethod is the correct one to fetch these tokens.

Where does it say the code is running on the VM itself?