A supported compute resource is frequently replaced, but its workload identity and preprovisioned target permissions must remain stable. Which solution should be recommended?

Choose the single best answer.

A.Use a deployment service principal with a long-lived client secret rather than the available managed-identity lifecycle.
B.Create a system-assigned identity on each replacement and assume its principal stays unchanged.
C.Use a user-assigned managed identity with suitable target permissions.
D.Share one user-assigned identity across every environment without reviewing the resulting combined privileges.

Show the answer and explanation

✓ Correct answer

Use a user-assigned managed identity with suitable target permissions.

User-assigned identity is a separate resource and can retain its principal across compute replacement or exist before compute. System-assigned identities share compute lifecycle. A long-lived secret adds credential management unnecessarily, and unreviewed identity sharing combines effective privileges across workloads. Source: AZ-305 Study Guide.pdf, PDF page(s) 15.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.