Azure Key Vault · AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security
An Azure App Service uses a system-assigned managed identity to read secret values from an Azure Key Vault. The identity must not create, update, or…
Practice question from Azure Key Vault (AZ-204: Developing Solutions for Microsoft Azure Implement Azure Security), with the correct answer and a step-by-step solution.
easy · MCQ · Q-669D60
An Azure App Service uses a system-assigned managed identity to read secret values from an Azure Key Vault. The identity must not create, update, or delete secrets. Which Azure RBAC role should be assigned at the Key Vault scope?
- A.Reader
- B.Key Vault Secrets UserCorrect answer
- C.Key Vault Secrets Officer
- D.Contributor
Solution
The Key Vault Secrets User role allows an identity to read secret contents without granting permission to manage secrets. Reader provides only control-plane metadata access, while Secrets Officer and Contributor grant broader permissions than required.
More from Azure Key Vault
- An ASP.NET Core application runs in Azure App Service and must read a database password from Azure Key Vault without storing credentials in…
- An application stores a database connection string in an Azure Key Vault secret named DbConnection. The operations team rotates the value b…
- A company requires that deleted secrets in a production Key Vault remain recoverable for 90 days and cannot be permanently purged early, ev…
- A .NET application must digitally sign data with an RSA key stored in Azure Key Vault. The private key must remain non-exportable and must…
Practise more Implement Azure Security
Sign up free for adaptive practice on this chapter, with instant feedback and hints on every question.
Start practising freeFree to start · No credit card needed