AZ-500 Question 198
Select 3Your organization wants to unify access control for an Azure Key Vault by using Azure RBAC rather than the traditional vault access policies. Developers need read-only access to secrets, while the Security team requires the ability to create and update secrets. Which three configurations should you implement to meet these requirements with minimal access?
- A
Enable Azure role-based access control (RBAC) on the Key Vault by switching from vault access policies to RBAC in its Access configuration.
- B
Assign the built-in Key Vault Secrets User role to the developer group at the Key Vault scope.
- C
Assign the built-in Key Vault Secrets Officer role to the Security team at the Key Vault scope.
- D
Add the developer group to the Key Vault Contributor role to allow them to manage keys, secrets, and certificates at the resource level.
- E
Enable both Azure RBAC and vault access policies simultaneously to grant overlapping permissions for different users.
Show answer and explanation
Correct answers: A, B, C
Explanation
Using Azure RBAC instead of vault access policies simplifies permission management and reporting by consolidating data-plane and management-plane RBAC under one model. Microsoft recommends assigning just the required built-in roles, like Key Vault Secrets User for read-only or Key Vault Secrets Officer for secret creation and updates, at the Key Vault scope. For more information, refer to the official documentation on Key Vault RBAC: https://learn.microsoft.com/azure/key-vault/general/rbac-guide
- A. Correct.
Correct. Enabling Azure RBAC on the Key Vault is necessary when consolidating or migrating from vault access policies to the RBAC approach. This lets you use built-in or custom roles at the Key Vault scope for data-plane permissions.
- B. Correct.
Correct. Assigning the Key Vault Secrets User role grants read (get, list) permissions for secrets without allowing modifications, which aligns with the developers’ requirement for read-only access.
- C. Correct.
Correct. The Key Vault Secrets Officer role allows users to manage secrets (including creating and updating them) without granting full Key Vault resource management rights, matching the Security team’s needs.
- D. Incorrect.
Incorrect. The Key Vault Contributor role predominantly manages the Key Vault’s resource-level operations (e.g., configuring firewall rules or networking) but does not grant the ability to read or write secrets at the data-plane level. Additionally, it’s broader than needed for read-only access.
- E. Incorrect.
Incorrect. While it is technically possible to have both Azure RBAC and vault access policies active, it introduces unnecessary complexity and can create conflicting permission sets. Microsoft’s best practice is to adopt one access model (preferably Azure RBAC) for consistency and clearer permission management.