Azure Key Vault and Secrets Management Flashcards

What is the default soft-delete retention period for Azure Key Vault?

Answer: 90 days

Azure Key Vault soft-delete retains deleted vaults and objects for 90 days by default, allowing recovery before permanent deletion.

Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?

Answer: Premium

The Premium tier is required to store keys in FIPS 140-2 Level 2 validated HSMs, providing hardware-level key protection.

Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?

Answer: Purge Protection

Purge Protection enforces a mandatory retention period during which no one—including admins—can permanently purge a soft-deleted vault or object.

What is the maximum size of a single secret value that can be stored in Azure Key Vault?

Answer: 25 KB

Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.

Compared to Key Vault Access Policies, what additional granularity does Azure RBAC provide for Key Vault?

Answer: RBAC allows per-secret and per-key permissions; Access Policies are vault-wide

Azure RBAC enables assigning roles at the individual secret, key, or certificate level, whereas Access Policies apply permissions across the entire vault.

Which authentication method is recommended for production workloads accessing Azure Key Vault from an Azure VM or App Service?

Answer: Managed Identity

Managed Identities eliminate the need to store credentials by automatically providing an Azure AD token, making them the recommended approach for Azure-hosted workloads.

Which Azure Key Vault feature automatically renews certificates and notifies integrated services before expiration?

Answer: Certificate lifecycle management with auto-renewal

Key Vault's certificate lifecycle management can automatically renew certificates through integrated CAs and trigger notifications via Event Grid before expiration.

What is the primary purpose of Azure Key Vault Managed HSM?

Answer: To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance

Managed HSM is a fully managed, single-tenant service providing FIPS 140-2 Level 3 validated HSMs where only the customer controls the security domain.

Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?

Answer: Network ACLs and firewall rules

Key Vault firewall and virtual network rules (Network ACLs) allow you to allow-list specific public IP ranges and VNet subnets, blocking all other traffic.

When a secret in Azure Key Vault is rotated, which Azure service should be configured to notify dependent applications of the new version?

Answer: Azure Event Grid

Azure Key Vault publishes lifecycle events (e.g., SecretNewVersionCreated) to Azure Event Grid, which downstream applications subscribe to for near-real-time rotation notifications.

Which Azure service uses Key Vault to provide transparent, host-level disk encryption for Azure Virtual Machines?

Answer: Azure Disk Encryption (ADE)

Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) with encryption keys or Key Encryption Keys (KEKs) stored and protected in Azure Key Vault.

What Key Vault property ensures that cryptographic operations are performed inside the HSM and keys never exist in plaintext outside it?

Answer: HSM-protected key type

Selecting the HSM-protected key type (Premium tier) ensures all cryptographic operations occur within the HSM boundary, so plaintext key material never leaves it.

Which built-in RBAC role allows a principal to manage Key Vault properties (create, update, delete the vault) but grants NO access to secrets, keys, or certificates?

Answer: Key Vault Contributor

Key Vault Contributor is a control-plane role that manages the vault resource itself but intentionally has no data-plane permissions to read or write secrets, keys, or certificates.

An Azure App Service needs to read a database connection string from Key Vault without storing any credentials. Which feature enables this?

Answer: App Service Key Vault references in application settings

App Service Key Vault references let you use the syntax @Microsoft.KeyVault(SecretUri=...) directly in app settings, and the platform resolves the secret value at runtime using a managed identity.

When you update a secret in Azure Key Vault, what happens to the previous secret value?

Answer: It is retained as an older version, accessible by its specific version ID

Key Vault maintains a full version history for secrets; each update creates a new version, and all previous versions remain accessible by their unique version ID.

Which diagnostic log category in Azure Key Vault records all data-plane operations such as reading, writing, and deleting secrets, keys, and certificates?

Answer: AuditEvent

The AuditEvent log category captures all authenticated requests to the Key Vault data plane, including who accessed which object and when.

A security team wants to allow only resources within a specific Azure Virtual Network subnet to access Key Vault, with all other access blocked. What should they configure?

Answer: A private endpoint with public network access disabled

A private endpoint assigns a private IP to Key Vault within the VNet, and disabling public network access ensures only resources reachable via private link can connect.

When should an organization choose Azure Dedicated HSM over Azure Key Vault Premium?

Answer: When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware

Dedicated HSM provides single-tenant, customer-exclusive physical HSM devices meeting FIPS 140-2 Level 3, satisfying strict regulatory requirements that prohibit shared infrastructure.

Which Key Vault access model should be used when you need to allow a specific service principal to read only one specific secret, without any access to other secrets in the same vault?

Answer: Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource

Azure RBAC supports role assignments scoped to individual secret, key, or certificate resources within a vault, enabling least-privilege access at the object level.

A developer hardcoded an Azure Key Vault client secret in source code that was pushed to a public repository. What is the FIRST remediation step?

Answer: Rotate the client secret in Azure AD immediately

The exposed credential must be revoked immediately by rotating the client secret in Azure AD, rendering the leaked secret invalid before any attacker can exploit it.