Examkin

Question

Difficulty: MediumConfigure Virtual Machine Scale Sets (VMSS)

A logistics company runs a batch delivery processing application on an Azure Virtual Machine Scale Set named `vmss-logistics` that is configured with a manual upgrade policy. You need to configure the scale set to execute a setup script stored in a secured Azure Storage blob container. The script must be downloaded and executed securely using a system-assigned managed identity. Which sequence of actions should you perform to configure the scale set and apply the script to the instances?

  1. 1Enable the system-assigned managed identity on the `vmss-logistics` scale set.
  2. 2Assign the Storage Blob Data Reader role to the scale set's managed identity on the storage account containing the script.
  3. 3Add the Custom Script Extension to the scale set model, referencing the script blob URI and the managed identity configuration.
  4. 4Manually upgrade the existing instances of `vmss-logistics` to the latest model.

Answer

First, enable the system-assigned managed identity on the scale set. Second, assign the Storage Blob Data Reader role to the scale set's identity. Third, add the Custom Script Extension to the scale set configuration. Finally, manually upgrade the existing instances to apply the updated model.
The correct sequence establishes the identity first, grants the required access permissions, adds the extension configuration to the scale set model, and then forces an upgrade on the existing instances to pull the model update.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the scale set.
A service principal is created in Microsoft Entra ID for the scale set.
You must establish the identity principal before assigning Azure role-based access control (RBAC) permissions to it.
2
Assign the Storage Blob Data Reader role to the scale set's managed identity.
The identity principal is granted read access to the storage account blob data.
Without this role, the scale set instances will not have permission to download the script from the secured storage account.
3
Add the Custom Script Extension to the scale set model.
The scale set's configuration model is updated with instructions to run the script.
The extension configuration must be saved in the model and configured to use the managed identity client ID for authentication.
4
Manually upgrade the scale set instances.
The existing virtual machines are updated to the latest scale set model and execute the script.
Because the upgrade policy is set to manual, the instances will continue to run the old configuration until they are explicitly upgraded.

Key Concept

Configuring Virtual Machine Scale Set extensions and managed identities under a manual upgrade policy.
Rate this question

Topics

Configure Virtual Machine Scale Sets (VMSS)

More questions from this topic