Exam Preparation Quiz

Explanations for each answer:

• Role-based access control (RBAC) permissions is incorrect. While RBAC can be used to grant permissions to Azure Key Vault, it would require granting permissions to each web server individually, which doesn't minimize the number of permission grants required.
• A user-assigned managed identity is correct. User-assigned managed identities can be created once and shared across multiple resources, making them ideal for VM scale sets. By assigning a single identity to all 100 VMs, you only need to grant the key vault permission once to that identity, minimizing the number of permission grants while maintaining the principle of least privilege.
• A service principal is incorrect. Service principals require secret management and regular credential rotation, which adds administrative overhead. For VM scale sets with 100 servers, this would be more complex to manage than managed identities and doesn't align with minimizing permission grants.
• A system-assigned managed identity is incorrect. System-assigned managed identities are tied to specific resources and cannot be shared across multiple VMs. This would require creating 100 separate permission grants in Key Vault (one for each VM), which doesn't meet the requirement to minimize the number of permission grants.