Your company has created an Azure key vault named "vault". They want to delegate administrative access to the key vault. The access has to follow the below requirements for a set of users. You have…

Question

Exhibits

Options

• AKey vault access policy
• BRole Based access control
• CManaged Identities
• DAzure policies

• A
  5% (2)
• B
  84% (32)
• C
  3% (1)
• D
  8% (3)

Explanation

Role-Based Access Control (RBAC) for Key Vault Delegation

Option B (RBAC) is correct because Azure RBAC allows granular delegation of administrative access to Key Vault by assigning specific built-in roles (such as Key Vault Administrator, Key Vault Reader, or Key Vault Secrets Officer) to individual users, perfectly supporting the principle of least privilege by granting only the permissions needed for each user's role.

Option A (Key Vault Access Policy) is incorrect because while access policies can control data-plane operations (secrets, keys, certificates), they are not the recommended method for delegating administrative access and offer less granular control compared to RBAC - Microsoft actually recommends RBAC over access policies for modern implementations.

Option C (Managed Identities) is wrong because Managed Identities are designed for applications and Azure services to authenticate to Key Vault without credentials, not for delegating access to human users.

Option D (Azure Policies) is incorrect because Azure Policy enforces organizational compliance rules and governance standards (e.g., "Key Vaults must have soft delete enabled") - it does not grant or manage user access permissions.

Memory Tip: Think "RBAC = Right people, Right access" - whenever a question mentions users, delegation, administrative access, or least privilege, RBAC is almost always the answer.

No community discussion yet for this question.