nerdexam
Microsoft

SC-300 · Question #291

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. The subscription uses Privileged Identity Management (PIM). You need to configure the…

The correct answer is The Key Vault Secrets Officer RBAC role; The Key Vault Secrets User RBAC role. For User1, the Key Vault Secrets Officer RBAC role is correct because it grants both read and update (get, list, set, delete) permissions on secrets, satisfying the requirement to read and update Secret1 while following least privilege. For User2, the Key Vault Secrets User…

Submitted by zhang_li· Mar 6, 2026Manage Identity and Access – Configure Azure Key Vault RBAC and access policies, and implement Privileged Identity Management (PIM) for just-in-time access

Question

Drag and Drop Question You have an Azure subscription that contains the resources shown in the following table. The subscription uses Privileged Identity Management (PIM). You need to configure the following access controls by using PIM:

  • Ensure that User1 can read and update Secret1.
  • Ensure that User2 can read the contents of the secrets stored in

Vault2. The solution must follow the principle of least privilege. Which authorization method should you use for each user? To answer, drag the appropriate authorization methods to the correct users. Each authorization method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Answer:

Exhibit

SC-300 question #291 exhibit

Answer Area

Drag items

The GET Secret Permissions Access Policy permissionThe Key Vault Secrets Officer RBAC roleThe Key Vault Reader RBAC roleThe Key Vault Secrets User RBAC roleThe LIST Secret Permissions Access Policy permissionThe SET Secret Permissions Access Policy permission

Correct arrangement

  • The Key Vault Secrets Officer RBAC role
  • The Key Vault Secrets User RBAC role

Explanation

For User1, the Key Vault Secrets Officer RBAC role is correct because it grants both read and update (get, list, set, delete) permissions on secrets, satisfying the requirement to read and update Secret1 while following least privilege. For User2, the Key Vault Secrets User RBAC role is correct because it grants only the ability to read secret contents (get and list), which is exactly what is needed to read the contents of secrets in Vault2 without granting excessive permissions. Both roles use Azure RBAC, which is the modern and preferred authorization method that integrates with PIM for just-in-time access assignments.

Topics

#Azure Key Vault#Privileged Identity Management#RBAC#Least Privilege

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice