Hotspot Question You have an Azure subscription that is linked to an Azure Active Directory (Azure AD). The tenant contains the users shown in the following table. You have an Azure key vault named…

Question

Exhibits

Answer Area

• User1 can set Purge protection to Enable for Vault1.No
• User2 can configure firewalls and virtual networks for Vault1.Yes
• User3 can add access policies to Vault1.Yes

Explanation

User2 can configure firewalls and virtual networks because this is a control plane operation managed through Azure RBAC, and the Key Vault Contributor role grants permissions to manage Key Vault resources including networking settings. User3 can add access policies because the Key Vault Administrator role (or Owner role) through RBAC grants full control over the Key Vault, including managing access policies. User1 cannot enable Purge Protection because enabling Purge Protection is an irreversible control plane operation that requires the Owner or Contributor role at the Key Vault level - access policies alone (which govern data plane operations like get/set secrets) do not grant control plane permissions, and User1 only has an access policy with no RBAC role assignment that would allow modifying Key Vault properties.

No community discussion yet for this question.