Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management

Question 1

What is the default soft-delete retention period for Azure Key Vault?

Accepted Answer

90 days

Answer

7 days

Answer

30 days

Answer

365 days

Question 2

Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?

Accepted Answer

Premium

Answer

Basic

Answer

Standard

Answer

Enterprise

Question 3

Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?

Accepted Answer

Purge Protection

Answer

Soft Delete

Answer

Resource Lock

Answer

Access Policies

Question 4

What is the maximum size of a single secret value that can be stored in Azure Key Vault?

Accepted Answer

25 KB

Answer

1 KB

Answer

10 KB

Answer

64 KB

Question 5

Compared to Key Vault Access Policies, what additional granularity does Azure RBAC provide for Key Vault?

Accepted Answer

RBAC allows per-secret and per-key permissions; Access Policies are vault-wide

Answer

RBAC applies permissions vault-wide; Access Policies apply per-object

Answer

Both models provide identical granularity

Answer

Access Policies support per-object permissions; RBAC does not

Question 6

Which authentication method is recommended for production workloads accessing Azure Key Vault from an Azure VM or App Service?

Accepted Answer

Managed Identity

Answer

Service Principal with client secret

Answer

Certificate-based service principal

Answer

Username and password

Question 7

Which Azure Key Vault feature automatically renews certificates and notifies integrated services before expiration?

Accepted Answer

Certificate lifecycle management with auto-renewal

Answer

Key auto-rotation policy

Answer

Diagnostic log alerts

Answer

Purge Protection