Hotspot Question You have an Azure subscription that contains the resources shown in the following table. User1 is a member of Group1. Group1 and User2 are assigned the Key Vault Contributor role…

Question

Exhibits

Answer Area

• Enabled?Yes

Explanation

This question tests understanding of Azure Key Vault access policies, RBAC roles, secret expiration, and how permissions are evaluated for users who belong to groups with separate access policies.

Approach. Azure Key Vault uses two separate permission models: RBAC (for management plane) and Access Policies (for data plane). The Key Vault Contributor RBAC role only grants management plane access (e.g., create/delete the vault itself) but does NOT grant data plane access to secrets, keys, or certificates. Data plane access is controlled exclusively by Access Policies. User1 inherits Group1's access policy (List, Backup, Recover for secrets - NOT Get), so User1 cannot read/retrieve the secret value. User2 has Get, List, and Restore for secrets via their access policy, so User2 CAN retrieve the secret - but only if it has not expired. The secret was created January 1, 2019, and if the exhibit shows an expiration date that has passed, User2 cannot retrieve it either. Group1's policy gives List, Backup, and Recover for secrets but NOT Get, meaning User1 (via Group1) cannot retrieve the secret value. For statements about 'reading' or 'getting' the secret: User1=No (no Get permission), User2=depends on expiration (if expired=No, if not expired=Yes), and Key Vault Contributor role alone does not provide data plane access.

Concept tested. Azure Key Vault dual-permission model: RBAC (management plane) vs. Access Policies (data plane), secret expiration behavior, and permission inheritance through group-based access policies.

Reference. https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault

No community discussion yet for this question.