Exam AZ-400 topic 4 question 1 discussion

This came today (2023-02-14) for my exam. Selected Secret and Access Policy

saw it yesterday in my exam

Permission type: Secret - Since the password for SQL Server login is stored as a secret in Key Vault, you should choose "Secret". Access method: Role-based access control (RBAC): - This method allows you to control access to the Key Vault using Azure Active Directory (Azure AD) roles. It is the recommended approach as it provides fine-grained access control and adheres to the principle of least privilege.

Correct answer is: Secret, RBAC Access policies not available. The access configuration for this key vault is set to role-based access control. To add or manage your access policies, go to the Access control (IAM) page.

It's an old question. I believe the correct answer now would be: Secret RBAC

secret access policy

Agree with suggested answer

New recommended acceess configuration to vault is now RBAC instead of access policy and there is a role to give access only to secrets so The answer should be secret and RBAC

Access Policy is a legacy authorization system built in Key Vault to provide access to keys, secrets, and certificates but there is new recommended authorization, which is RBAC, you can setup the Managed Identity of Azure Data Factory and allow the identity to access Key Vault BUT since, in the question, they ask which permission type that you need which is Secret so you have to Access Policy instead of RBACK Answer is Secret and Access Policy refs: https://learn.microsoft.com/en-us/azure/data-factory/data-factory-service-identity https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-access-policy

Provided answer is correct

Answer is secret and access policy. See ref: https://tech-tutes.com/2020/05/16/get-database-password-from-key-vault-in-data-factory/

1. Secret 2. Access policy https://learn.microsoft.com/en-us/azure/key-vault/general/assign-access-policy?tabs=azure-portal A Key Vault access policy determines whether a given security principal, namely a user, application or user group, can perform different operations on Key Vault secrets, keys, and certificates. You can assign access policies using the Azure portal, the Azure CLI, or Azure PowerShell.

RBAC is the only one than can limit access per Secret. So you could argue that Rbac is correct

since keyvault have rbac now, should the answer be rbac instead of access policy ?

"Password" so secret for permission Access to Key Vault so Access Policy Answer is correct

Secret Access Policy (Data Plan)

Correct. Came today 22 july 9