Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 2

Question 1

What is the primary purpose of Azure Key Vault Managed HSM?

Accepted Answer

To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance

Answer

To provide multi-tenant shared key storage for cost savings

Answer

To manage Azure Active Directory service principals

Answer

To encrypt Azure SQL Database transparent data encryption keys

Question 2

Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?

Accepted Answer

Network ACLs and firewall rules

Answer

Service Tags

Answer

Private Link DNS zones

Answer

VNet peering

Question 3

When a secret in Azure Key Vault is rotated, which Azure service should be configured to notify dependent applications of the new version?

Accepted Answer

Azure Event Grid

Answer

Azure Monitor action groups

Answer

Azure Service Bus

Answer

Azure Logic Apps

Question 4

Which Azure service uses Key Vault to provide transparent, host-level disk encryption for Azure Virtual Machines?

Accepted Answer

Azure Disk Encryption (ADE)

Answer

Azure Storage Service Encryption

Answer

Azure Backup Encryption

Answer

Azure Site Recovery

Question 5

What Key Vault property ensures that cryptographic operations are performed inside the HSM and keys never exist in plaintext outside it?

Accepted Answer

HSM-protected key type

Answer

Soft Delete enabled

Answer

Key exportable flag set to false

Answer

Purge Protection enabled

Question 6

Which built-in RBAC role allows a principal to manage Key Vault properties (create, update, delete the vault) but grants NO access to secrets, keys, or certificates?

Accepted Answer

Key Vault Contributor

Answer

Key Vault Secrets Officer

Answer

Key Vault Administrator

Answer

Contributor

Question 7

An Azure App Service needs to read a database connection string from Key Vault without storing any credentials. Which feature enables this?

Accepted Answer

App Service Key Vault references in application settings

Answer

Key Vault diagnostic settings

Answer

App Service Managed Certificates

Answer

API Management Key Vault integration