Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management — Questions and Answers
Question 1: What is the default soft-delete retention period for Azure Key Vault?
- 7 days
- 30 days
- 90 days (Correct answer)
- 365 days
Correct answer: 90 days
Azure Key Vault soft-delete retains deleted vaults and objects for 90 days by default, allowing recovery before permanent deletion.
Question 2: Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?
- Basic
- Standard
- Premium (Correct answer)
- Enterprise
Correct answer: Premium
The Premium tier is required to store keys in FIPS 140-2 Level 2 validated HSMs, providing hardware-level key protection.
Question 3: Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?
- Soft Delete
- Purge Protection (Correct answer)
- Resource Lock
- Access Policies
Correct answer: Purge Protection
Purge Protection enforces a mandatory retention period during which no one—including admins—can permanently purge a soft-deleted vault or object.
Question 4: What is the maximum size of a single secret value that can be stored in Azure Key Vault?
- 1 KB
- 10 KB
- 25 KB (Correct answer)
- 64 KB
Correct answer: 25 KB
Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.
Question 5: Compared to Key Vault Access Policies, what additional granularity does Azure RBAC provide for Key Vault?
- RBAC applies permissions vault-wide; Access Policies apply per-object
- RBAC allows per-secret and per-key permissions; Access Policies are vault-wide (Correct answer)
- Both models provide identical granularity
- Access Policies support per-object permissions; RBAC does not
Correct answer: RBAC allows per-secret and per-key permissions; Access Policies are vault-wide
Azure RBAC enables assigning roles at the individual secret, key, or certificate level, whereas Access Policies apply permissions across the entire vault.
Question 6: Which authentication method is recommended for production workloads accessing Azure Key Vault from an Azure VM or App Service?
- Service Principal with client secret
- Managed Identity (Correct answer)
- Certificate-based service principal
- Username and password
Correct answer: Managed Identity
Managed Identities eliminate the need to store credentials by automatically providing an Azure AD token, making them the recommended approach for Azure-hosted workloads.
Question 7: Which Azure Key Vault feature automatically renews certificates and notifies integrated services before expiration?
- Key auto-rotation policy
- Certificate lifecycle management with auto-renewal (Correct answer)
- Diagnostic log alerts
- Purge Protection
Correct answer: Certificate lifecycle management with auto-renewal
Key Vault's certificate lifecycle management can automatically renew certificates through integrated CAs and trigger notifications via Event Grid before expiration.
Question 8: What is the primary purpose of Azure Key Vault Managed HSM?
- To provide multi-tenant shared key storage for cost savings
- To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance (Correct answer)
- To manage Azure Active Directory service principals
- To encrypt Azure SQL Database transparent data encryption keys
Correct answer: To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance
Managed HSM is a fully managed, single-tenant service providing FIPS 140-2 Level 3 validated HSMs where only the customer controls the security domain.
Question 9: Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?
- Service Tags
- Private Link DNS zones
- Network ACLs and firewall rules (Correct answer)
- VNet peering
Correct answer: Network ACLs and firewall rules
Key Vault firewall and virtual network rules (Network ACLs) allow you to allow-list specific public IP ranges and VNet subnets, blocking all other traffic.
Question 10: When a secret in Azure Key Vault is rotated, which Azure service should be configured to notify dependent applications of the new version?
- Azure Monitor action groups
- Azure Event Grid (Correct answer)
- Azure Service Bus
- Azure Logic Apps
Correct answer: Azure Event Grid
Azure Key Vault publishes lifecycle events (e.g., SecretNewVersionCreated) to Azure Event Grid, which downstream applications subscribe to for near-real-time rotation notifications.
Question 11: Which Azure service uses Key Vault to provide transparent, host-level disk encryption for Azure Virtual Machines?
- Azure Storage Service Encryption
- Azure Disk Encryption (ADE) (Correct answer)
- Azure Backup Encryption
- Azure Site Recovery
Correct answer: Azure Disk Encryption (ADE)
Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) with encryption keys or Key Encryption Keys (KEKs) stored and protected in Azure Key Vault.
Question 12: What Key Vault property ensures that cryptographic operations are performed inside the HSM and keys never exist in plaintext outside it?
- Soft Delete enabled
- Key exportable flag set to false
- HSM-protected key type (Correct answer)
- Purge Protection enabled
Correct answer: HSM-protected key type
Selecting the HSM-protected key type (Premium tier) ensures all cryptographic operations occur within the HSM boundary, so plaintext key material never leaves it.
Question 13: Which built-in RBAC role allows a principal to manage Key Vault properties (create, update, delete the vault) but grants NO access to secrets, keys, or certificates?
- Key Vault Secrets Officer
- Key Vault Contributor (Correct answer)
- Key Vault Administrator
- Contributor
Correct answer: Key Vault Contributor
Key Vault Contributor is a control-plane role that manages the vault resource itself but intentionally has no data-plane permissions to read or write secrets, keys, or certificates.
Question 14: An Azure App Service needs to read a database connection string from Key Vault without storing any credentials. Which feature enables this?
- Key Vault diagnostic settings
- App Service Key Vault references in application settings (Correct answer)
- App Service Managed Certificates
- API Management Key Vault integration
Correct answer: App Service Key Vault references in application settings
App Service Key Vault references let you use the syntax @Microsoft.KeyVault(SecretUri=...) directly in app settings, and the platform resolves the secret value at runtime using a managed identity.
Question 15: When you update a secret in Azure Key Vault, what happens to the previous secret value?
- It is permanently deleted immediately
- It is retained as an older version, accessible by its specific version ID (Correct answer)
- It is automatically backed up to Azure Blob Storage
- It is disabled and deleted after 7 days
Correct answer: It is retained as an older version, accessible by its specific version ID
Key Vault maintains a full version history for secrets; each update creates a new version, and all previous versions remain accessible by their unique version ID.
Question 16: Which diagnostic log category in Azure Key Vault records all data-plane operations such as reading, writing, and deleting secrets, keys, and certificates?
- AllMetrics
- AuditEvent (Correct answer)
- ActivityLog
- DiagnosticEvent
Correct answer: AuditEvent
The AuditEvent log category captures all authenticated requests to the Key Vault data plane, including who accessed which object and when.
Question 17: A security team wants to allow only resources within a specific Azure Virtual Network subnet to access Key Vault, with all other access blocked. What should they configure?
- A private endpoint with public network access disabled (Correct answer)
- A network security group on the Key Vault resource
- An Azure Firewall policy targeting Key Vault FQDNs
- A conditional access policy in Azure AD
Correct answer: A private endpoint with public network access disabled
A private endpoint assigns a private IP to Key Vault within the VNet, and disabling public network access ensures only resources reachable via private link can connect.
Question 18: When should an organization choose Azure Dedicated HSM over Azure Key Vault Premium?
- When they need a lower-cost multi-tenant key management solution
- When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware (Correct answer)
- When storing application configuration secrets at scale
- When they need native integration with Azure Disk Encryption
Correct answer: When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware
Dedicated HSM provides single-tenant, customer-exclusive physical HSM devices meeting FIPS 140-2 Level 3, satisfying strict regulatory requirements that prohibit shared infrastructure.
Question 19: Which Key Vault access model should be used when you need to allow a specific service principal to read only one specific secret, without any access to other secrets in the same vault?
- Key Vault Access Policies scoped to that secret
- Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource (Correct answer)
- Key Vault firewall rules restricting the service principal's IP
- Managed Identity with vault-wide Reader permissions
Correct answer: Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource
Azure RBAC supports role assignments scoped to individual secret, key, or certificate resources within a vault, enabling least-privilege access at the object level.
Question 20: A developer hardcoded an Azure Key Vault client secret in source code that was pushed to a public repository. What is the FIRST remediation step?
- Rotate the client secret in Azure AD immediately (Correct answer)
- Enable soft-delete on Key Vault
- Delete the public repository
- Enable Key Vault firewall rules
Correct answer: Rotate the client secret in Azure AD immediately
The exposed credential must be revoked immediately by rotating the client secret in Azure AD, rendering the leaked secret invalid before any attacker can exploit it.
Question 21: Which Azure Key Vault feature allows you to define a rotation schedule so that cryptographic keys are automatically regenerated at set intervals?
- Key expiry date enforcement
- Key rotation policy (Correct answer)
- Certificate auto-renewal
- Purge Protection schedule
Correct answer: Key rotation policy
Key rotation policies (generally available for RSA and EC keys) let you define time-based schedules that automatically create new key versions and optionally trigger notifications.
