Hotspot Question You have an Azure subscription that contains an Azure key vault named ContosoKey1. You create users and assign them roles as shown in the following table. You need to identify which…

Question

Exhibit

Answer Area

• Delegate permissions for ContosoKey1:
  User1 onlyUser1 and User2 onlyUser1 and User3 onlyUser1 and User4 onlyUser1, User2, and User3 onlyUser1, User2, User3, and User4
• Configure network access to ContosoKey1:
  User1 onlyUser1 and User2 onlyUser1 and User3 onlyUser1 and User4 onlyUser1, User2, and User3 onlyUser1, User2, User3, and User4

Explanation

This question tests understanding of Azure RBAC roles and their permissions on Azure Key Vault, specifically who can delegate permissions (manage access control) and who can configure network access (manage Key Vault settings).

Approach. For 'Delegate permissions for ContosoKey1': Only a user with the Owner role can delegate permissions (assign roles to others via IAM). The Contributor role can manage the Key Vault resource but CANNOT grant access to other users - that requires Owner or a role with Microsoft.Authorization/roleAssignments/write permission. For 'Configure network access to ContosoKey1': Both Owner and Contributor can configure network access (firewall and virtual network settings) on the Key Vault resource, because network access is a resource management plane operation. The Key Vault Contributor role specifically grants the ability to manage Key Vault properties including network ACLs. A user with only Key Vault Reader or Key Vault secrets/keys/certificates roles (data plane roles) would not be able to configure network access since that is a control plane operation requiring Contributor or Owner at the resource level.

Concept tested. Azure RBAC roles on Azure Key Vault - specifically the distinction between Owner (can delegate/assign roles), Contributor (can manage resource settings like network access but cannot assign roles), and data plane roles (Key Vault Secrets Officer, etc., which only grant data plane access and cannot manage resource configuration or delegate permissions).

Reference. https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide and https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

No community discussion yet for this question.