You downloaded an Azure Resource Manager template based on an existing VM to deploy 100 VMs. You must modify the template so the admin password is referenced without storing it in plain text. What should you create to securely store the password?

Azure Key Vault is the correct choice because it is designed to securely store secrets, such as passwords, connection strings, and certificates. By creating an access policy within Key Vault, you can control which identities (users, applications, or services) have permission to retrieve these secrets. This ensures the password for your VM deployment is not stored in plain text within the ARM template, enhancing security. An Azure Storage account is for storing data objects like blobs, files, and tables, not for secure secret management. A Recovery Services vault is used for backup and disaster recovery, not for storing operational secrets. Azure AD Identity Protection and an Azure policy are for managing user identities and enforcing compliance rules, respectively, not for storing application secrets.