Designing Microsoft Azure Infrastructure Solutions (AZ-305)

An application running on an Azure VM must call Azure Key Vault and Azure Storage without any credentials stored in code or configuration. What should the architect design?

1. AA shared access key embedded in app settings
2. BA service principal with a client secret in code
3. CA managed identity for the VM granted access to Key Vault and StorageCorrect
4. DA local administrator account on the VM

Why: A managed identity lets the VM authenticate to Entra ID-integrated services with no stored secrets, and you grant it least-privilege access via RBAC. Embedded keys or a client secret in code store credentials that can leak, and a local admin account does not authenticate to Azure services.

A workload requires near-full SQL Server compatibility, including SQL Agent and cross-database queries, for a lift-and-shift migration. Which Azure service best fits?

1. AAzure SQL Database single database
2. BAzure SQL Managed InstanceCorrect
3. CAzure Cosmos DB
4. DAzure Table storage

Why: SQL Managed Instance provides near-100% SQL Server engine compatibility, including SQL Agent and cross-database queries, making it ideal for lift-and-shift. A single database lacks some instance-level features, and Cosmos DB and Table storage are non-relational.