SC-300 · Question #396
Hotspot Question You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control…
The correct answer is User1 can read Secret1 = Yes; User1 can read Secret2 = Yes; User2 can read Secret1 = No; User2 can read Secret2 = No; User3 can read Secret1 = Yes; User3 can read Secret2 = No. This question tests understanding of Azure RBAC inheritance and scope levels for Key Vault secrets access. The Key Vault Secrets User role grants read access to secret values, and permissions can be assigned at the subscription, resource group, or individual resource level.
Question
Hotspot Question You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC). The subscription contains the users shown in the following table. KV1 contains a secret named Secret1. KV2 contains a secret named Secret2. Which users can read the values of each secret? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:
Exhibit
Answer Area
- User1 can read Secret1Yes
- User1 can read Secret2Yes
- User2 can read Secret1No
- User2 can read Secret2No
- User3 can read Secret1Yes
- User3 can read Secret2No
Explanation
This question tests understanding of Azure RBAC inheritance and scope levels for Key Vault secrets access. The Key Vault Secrets User role grants read access to secret values, and permissions can be assigned at the subscription, resource group, or individual resource level.
Approach. Azure RBAC permissions are inherited from parent scopes downward: Subscription → Resource Group → Resource. A user assigned 'Key Vault Secrets User' at the Subscription level (Sub1) can read secrets in ALL key vaults (KV1 and KV2). A user assigned 'Key Vault Secrets User' at the Resource Group level (RG1) can read secrets in both KV1 and KV2 since both vaults are in RG1. A user assigned 'Key Vault Secrets User' scoped to only KV1 can read Secret1 but NOT Secret2. A user with no Key Vault Secrets User role assignment (or only a different role like Reader) cannot read secret VALUES even if they can see the key vault exists - because reading a secret's value requires the Microsoft.KeyVault/vaults/secrets/getSecret/action permission. The critical distinction is that with Azure RBAC-enabled Key Vaults, the 'Key Vault Secrets User' built-in role is required to retrieve secret values, and inheritance flows top-down through the scope hierarchy.
Concept tested. Azure RBAC scope inheritance for Key Vault secrets - understanding how permissions assigned at subscription, resource group, and resource scopes affect access to Key Vault secrets when the vault uses Azure RBAC (as opposed to legacy access policies). The Key Vault Secrets User role (id: 4633458b-17de-408a-b874-0445c86b69e6) grants the ability to read secret contents, while roles like Reader only grant management plane access.
Reference. https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
Topics
Community Discussion
No community discussion yet for this question.