nerdexam
Microsoft

SC-300 · Question #423

Hotspot Question You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1. You need to ensure that Automation1 can…

The correct answer is For Automation1, configure:: A system-assigned managed identity; Role:: Key Vault Secrets User. This question tests your knowledge of Azure Automation identity types and Key Vault RBAC roles to securely grant an Automation account access to a Key Vault while meeting least privilege and automatic cleanup requirements.

Submitted by miguelv· Mar 6, 2026Plan and implement workload identities

Question

Hotspot Question You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1. You need to ensure that Automation1 can access Vault1. The solution must meet the following requirements: - Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically. - Ensure that runbooks created in Automation1 can read secret values stored in Vault1. - Follow the principle of least privilege. What should you configure for Automation1, and which built-in role should Automation1 use to access Vault1? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point. Answer:

Answer Area

  • For Automation1, configure:A system-assigned managed identity
    A service accountA system-assigned managed identityA user-assigned managed identityAn app registrationAn enterprise application
  • Role:Key Vault Secrets User
    Key Vault Crypto OfficerKey Vault Crypto UserKey Vault ReaderKey Vault Secrets OfficerKey Vault Secrets User

Explanation

This question tests your knowledge of Azure Automation identity types and Key Vault RBAC roles to securely grant an Automation account access to a Key Vault while meeting least privilege and automatic cleanup requirements.

Approach. For Automation1, you should configure a System-assigned managed identity. A system-assigned managed identity is tied to the lifecycle of the Azure resource (Automation1), meaning if Automation1 is deleted, the managed identity and its associated permissions are automatically removed - satisfying the first requirement. For the built-in role, Automation1 should be assigned the Key Vault Secrets User role on Vault1. This role grants read-only access to secret values (Get and List secrets), which satisfies the 'read secret values' requirement and follows the principle of least privilege - it does not grant permissions to manage keys, certificates, or write/delete secrets, unlike broader roles such as Key Vault Contributor or Key Vault Administrator.

Concept tested. Azure Automation managed identities (system-assigned vs user-assigned) and Azure Key Vault RBAC built-in roles (Key Vault Secrets User vs Key Vault Contributor vs Key Vault Administrator), combined with the principle of least privilege and identity lifecycle management.

Reference. https://learn.microsoft.com/en-us/azure/automation/automation-security-overview | https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide

Topics

#system-assigned managed identity#Key Vault Secrets User#least privilege#Azure Automation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-300 Practice