Examkin

Question

Difficulty: MediumConfigure Virtual Machine Scale Sets (VMSS)

You have an Azure Virtual Machine Scale Set named vmss-prod that has a manual upgrade policy. You need to configure the scale set to retrieve a secret from an Azure Key Vault named kv-prod. The configuration must use the principle of least privilege. Which sequence of actions should you perform? To answer, drag the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  1. 1Enable a system-assigned managed identity on vmss-prod.
  2. 2Assign the Key Vault Secrets User role to the managed identity of vmss-prod on kv-prod.
  3. 3Add the Key Vault virtual machine extension to the vmss-prod scale set model.
  4. 4Upgrade the existing instances of vmss-prod to apply the latest model.

Answer

First, enable a system-assigned managed identity on the scale set. Second, assign the Key Vault Secrets User role to the scale set's managed identity on the Key Vault. Third, add the Key Vault virtual machine extension to the scale set model. Finally, upgrade the existing instances of the scale set to apply the updated configuration.
The correct sequence starts with enabling the system-assigned managed identity on the Virtual Machine Scale Set to create the security principal. Next, permissions are granted by assigning the Key Vault Secrets User role to this identity on the Key Vault. Then, the Key Vault virtual machine extension is added to the scale set model to retrieve the secret. Finally, because the scale set uses a manual upgrade policy, the existing instances must be upgraded to apply the updated model containing the identity and extension.

Step-by-Step Solution

1
Enable the system-assigned managed identity on the Virtual Machine Scale Set.
An identity principal is created in Microsoft Entra ID representing the scale set.
You cannot assign RBAC roles to an identity until the system-assigned managed identity is enabled and registered in Entra ID.
2
Assign the Key Vault Secrets User role to the managed identity on the Key Vault.
The identity principal is authorized to retrieve secrets from the Key Vault.
This grants the minimum required permission (least privilege) for the VM instances to retrieve the secret.
3
Add the Key Vault virtual machine extension to the scale set configuration model.
The model template is updated to include the extension, referencing the Key Vault.
The extension orchestrates the retrieval and management of the secret on the virtual machines.
4
Select the existing VMSS instances and trigger an upgrade.
The instances are updated to the latest model configuration.
Because the scale set's upgrade policy is set to Manual, existing instances do not automatically pull model changes. An explicit upgrade action is required.

Key Concept

Configuring Virtual Machine Scale Sets with Managed Identities, Extensions, and Manual Upgrade Policies.
Estimated Time:2m 0s
Rate this question

Topics

Configure Virtual Machine Scale Sets (VMSS)

More questions from this topic