nerdexam
Microsoft

AZ-500 · Question #444

Hotspot Question You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1. You plan to implement Microsoft Entra Verified ID. You need to create an access…

The correct answer is Select all = No; Get = No; List = No; Update = No; Create = Yes; Import = No; Delete = Yes; Recover = No; Backup = No; Restore = No; Select all = No; Decrypt = No; Encrypt = No; Unwrap Key = No; Wrap Key = No; Verify = No; Sign = Yes; Select all = No; Purge = No; Release = No; Select all = No; Rotate = No; Get Rotation Policy = No; Set Rotation Policy = No. This question tests knowledge of the specific Azure Key Vault key permissions required by Microsoft Entra Verified ID service when setting up an access policy for an administrator. The principle of least privilege means granting only the minimum permissions necessary.

Submitted by akirajp· Mar 6, 2026Secure identity and access

Question

Hotspot Question You have an Azure subscription that contains a user named Admin1 and an Azure key vault named Vault1. You plan to implement Microsoft Entra Verified ID. You need to create an access policy to ensure that Admin1 has permissions to Vault1 that support the implementation of the Verified ID service. The solution must use the principle of least privilege. Which three key permissions should you select? To answer, select the appropriate permissions in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

AZ-500 question #444 exhibit

Answer Area

  • Select allNo
  • GetNo
  • ListNo
  • UpdateNo
  • CreateYes
  • ImportNo
  • DeleteYes
  • RecoverNo
  • BackupNo
  • RestoreNo
  • Select allNo
  • DecryptNo
  • EncryptNo
  • Unwrap KeyNo
  • Wrap KeyNo
  • VerifyNo
  • SignYes
  • Select allNo
  • PurgeNo
  • ReleaseNo
  • Select allNo
  • RotateNo
  • Get Rotation PolicyNo
  • Set Rotation PolicyNo

Explanation

This question tests knowledge of the specific Azure Key Vault key permissions required by Microsoft Entra Verified ID service when setting up an access policy for an administrator. The principle of least privilege means granting only the minimum permissions necessary.

Approach. Microsoft Entra Verified ID requires specific Key Vault key permissions to perform cryptographic operations for signing and verifying credentials. The three required key permissions are: Sign (used to sign Verified ID credentials with the key), Verify (used to verify signatures on credentials), and Get (used to retrieve key metadata and public key information). These three permissions are the minimum required for the Verified ID service to function correctly - Sign enables the DID document and credential signing operations, Verify enables signature verification, and Get allows the service to read the key properties. No other permissions (such as Create, Delete, Encrypt, Decrypt, Wrap, Unwrap, etc.) are needed, satisfying the principle of least privilege.

Concept tested. Microsoft Entra Verified ID requires an Azure Key Vault access policy with the minimum key permissions of Get, Sign, and Verify to support cryptographic operations for decentralized identity credential issuance and verification, adhering to least privilege principles.

Reference. https://learn.microsoft.com/en-us/entra/verified-id/verifiable-credentials-configure-tenant-quick#set-access-policies

Topics

#Azure Key Vault#Access policies#Microsoft Entra Verified ID#Least privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice