SC-300 Question 81

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 2

  Guys, A system assigned identity is bound to a specific resource and cant be manually assigned to something else. Don't get fooled by the scope. it's - no > Explained by others correctly - no > (like i said you cannot assign a SAMI to something else, only a UAMI, that's the whole point of a SAMI) - yes > explained by others correctly

• 4

  1: Automation1 has Identity1 assigned to it. Identity1 has the Key Vault Secrets User role at the RG2 scope. Vault1 is in RG1, not RG2. Since Identity1 has access to secrets in RG2, but Vault1 is in RG1, Automation1 cannot access the secrets in Vault1. Answer: ❌ No 2: Identity2 is a system-assigned managed identity for Automation2. Identity2 has the Key Vault Secrets User role at the Subscription (Sub1) level. Sub1 includes RG1, where Vault1 is located. Since Identity2 has permission at the subscription level, which includes RG1, it already has access to Vault1. Answer: ✅ Yes 3: VM1 has Identity3 assigned to it. Identity3 has the Key Vault Secrets User role at the RG1 scope. Vault1 is in RG1. Since Identity3 has permissions for RG1, and Vault1 is in RG1, VM1 can access the secrets in Vault1. Answer: ✅ Yes

• 3

  1. No. The scope of Identity1 isn’t RG1 (Vault1) 2. Yes. Indeed it’s assigned, and i’ts scope is all the Subscription Sub1 3. Yes. Identity3 is assigned to VM1 and it’s scope is RG1, where it’s Vault1