Exam AZ-500 topic 1 question 23 discussion

# IN EXAM - 31/8/2021

A is correct

Answer: A, Key vault access policy Reason: Key vault access policies allow you to grant specific permissions for managing certificates in Azure Key Vault. This method provides granular control over actions like adding and deleting certificates, adhering to the principle of least privilege by granting only the necessary permissions to the user. Reference: https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal

Azure Key Vault Access Policies are used for granular control on key vault Keys, secrets, certificates.

These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions.

Answer A is correct - RBAC gives you access to the vault (management plane), Key vault policies grants access to the data within the vault (data plane)

Answer: A Explanation: These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions. Reference: https://docs.microsoft.com/en-us/azure/key-vault/key-vault-secure-your-key-vault

KW has 2 models for access 1. RBAC 2. KW policy. If you want more control one should go for KW policy Ans a

The answer is: A

A. A key vault access policy

A is the answer. https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy A Key Vault access policy determines whether a given security principal, namely a user, application or user group, can perform different operations on Key Vault secrets, keys, and certificates. You can assign access policies using the Azure portal, the Azure CLI, or Azure PowerShell.

correct answer A

A. A key vault access policy

A. A key vault access policy

A is correct

vote A

The answer is A: These operations are done on the key vault's data plane. The suitable built-in role would be a Key Vault Certificates Officer - able to perform any action on the certificates of a key vault, except manage permissions. https://docs.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli#azure-built-in-roles-for-key-vault-data-plane-operations