Hotspot Question You have an Azure subscription that contains the key vaults shown in the following table. The subscription contains the users shown in the following table. On June 1, you perform…

Question

Exhibits

Answer Area

• Admin1 can recover key1 on June 5.Yes
• Admin2 can purge secret1 on June 12.Yes
• Admin3 can recover key1 on June 17.No

Explanation

This question tests understanding of Azure Key Vault soft-delete, purge protection, and role-based access control (RBAC) for recovering or purging deleted keys and secrets.

Approach. Azure Key Vault soft-delete retains deleted keys and secrets for a configurable retention period (default 90 days), allowing recovery. Purge protection, when enabled, prevents permanent deletion during the retention period even by admins. Recovery of a deleted key or secret requires the 'Key Vault Contributor' role or specific data plane permissions like 'keys/recover' or 'secrets/recover'. Only users with sufficient permissions on the specific vault can recover or purge deleted objects. If a vault has soft-delete enabled without purge protection, authorized users can both recover and permanently purge deleted items; if purge protection is enabled, purging is blocked until the retention period expires. Statements are evaluated based on whether each user has the necessary permissions on the relevant vault and whether vault configuration (soft-delete/purge protection) allows the action.

Concept tested. Azure Key Vault soft-delete, purge protection, and RBAC/access policy permissions for recovering and purging deleted keys and secrets

Reference. https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview

No community discussion yet for this question.