Hotspot Question You have an Azure key vault. You need to delegate administrative access to the key vault to meet the following requirements: - Provide a user named User1 with the ability to set…

The correct answer is User1:: RBAC only; User2:: Key vault access policy only. This question tests your understanding of Azure Key Vault access control mechanisms, specifically the difference between Azure RBAC roles (for management plane) and Key Vault Access Policies (for data plane) to follow least privilege.

Submitted by kim_seoul· Mar 6, 2026Secure compute, storage, and databases

Question

Hotspot Question You have an Azure key vault. You need to delegate administrative access to the key vault to meet the following requirements: - Provide a user named User1 with the ability to set access policies for the key vault. - Provide a user named User2 with the ability to add and delete certificates in the key vault. - Use the principle of least privilege. What should you use to assign access to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

User1:RBAC only
RBAC onlyKey vault access policy onlyRBAC and key vault access policy
User2:Key vault access policy only
RBAC onlyKey vault access policy onlyRBAC and key vault access policy

Explanation

This question tests your understanding of Azure Key Vault access control mechanisms, specifically the difference between Azure RBAC roles (for management plane) and Key Vault Access Policies (for data plane) to follow least privilege.

Approach. For User1, who needs to set access policies for the key vault, you should assign the Azure RBAC role 'Key Vault Contributor' (or 'Owner') at the management plane level - this grants control over the key vault resource itself including access policy management, without granting access to secrets/keys/certificates. For User2, who needs to add and delete certificates, you should use a Key Vault Access Policy with the 'Certificate Management' permissions (specifically Get, List, Delete, Create, Import, Update) - this grants data-plane access scoped only to certificates, following least privilege by not granting broader RBAC roles. Alternatively, if using Azure RBAC for data plane, User2 would be assigned the 'Key Vault Certificates Officer' built-in role.

Concept tested. Azure Key Vault has two planes of access: the management plane (controlled by Azure RBAC, e.g., Key Vault Contributor role) for administrative tasks like managing access policies and vault settings, and the data plane (controlled by Key Vault Access Policies or Azure RBAC data plane roles) for operations on keys, secrets, and certificates. Assigning the correct plane-specific permission ensures least privilege - a Contributor can manage the vault without accessing its secrets, while an access policy or data-plane RBAC role grants only the needed certificate operations.

Reference. https://docs.microsoft.com/en-us/azure/key-vault/general/security-features#managing-administrative-access-to-key-vault

Topics

#Azure Key Vault#Azure RBAC#Access policies#Certificates#Least privilege

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice