Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 1 — Questions and Answers
Question 1: What is the default soft-delete retention period for Azure Key Vault?
- 7 days
- 30 days
- 90 days (Correct answer)
- 365 days
Correct answer: 90 days
Azure Key Vault soft-delete retains deleted vaults and objects for 90 days by default, allowing recovery before permanent deletion.
Question 2: Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?
- Basic
- Standard
- Premium (Correct answer)
- Enterprise
Correct answer: Premium
The Premium tier is required to store keys in FIPS 140-2 Level 2 validated HSMs, providing hardware-level key protection.
Question 3: Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?
- Soft Delete
- Purge Protection (Correct answer)
- Resource Lock
- Access Policies
Correct answer: Purge Protection
Purge Protection enforces a mandatory retention period during which no one—including admins—can permanently purge a soft-deleted vault or object.
Question 4: What is the maximum size of a single secret value that can be stored in Azure Key Vault?
- 1 KB
- 10 KB
- 25 KB (Correct answer)
- 64 KB
Correct answer: 25 KB
Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.
Question 5: Compared to Key Vault Access Policies, what additional granularity does Azure RBAC provide for Key Vault?
- RBAC applies permissions vault-wide; Access Policies apply per-object
- RBAC allows per-secret and per-key permissions; Access Policies are vault-wide (Correct answer)
- Both models provide identical granularity
- Access Policies support per-object permissions; RBAC does not
Correct answer: RBAC allows per-secret and per-key permissions; Access Policies are vault-wide
Azure RBAC enables assigning roles at the individual secret, key, or certificate level, whereas Access Policies apply permissions across the entire vault.
Question 6: Which authentication method is recommended for production workloads accessing Azure Key Vault from an Azure VM or App Service?
- Service Principal with client secret
- Managed Identity (Correct answer)
- Certificate-based service principal
- Username and password
Correct answer: Managed Identity
Managed Identities eliminate the need to store credentials by automatically providing an Azure AD token, making them the recommended approach for Azure-hosted workloads.
Question 7: Which Azure Key Vault feature automatically renews certificates and notifies integrated services before expiration?
- Key auto-rotation policy
- Certificate lifecycle management with auto-renewal (Correct answer)
- Diagnostic log alerts
- Purge Protection
Correct answer: Certificate lifecycle management with auto-renewal
Key Vault's certificate lifecycle management can automatically renew certificates through integrated CAs and trigger notifications via Event Grid before expiration.
Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 1
What is the default soft-delete retention period for Azure Key Vault?