Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 2 — Questions and Answers
Question 1: What is the primary purpose of Azure Key Vault Managed HSM?
- To provide multi-tenant shared key storage for cost savings
- To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance (Correct answer)
- To manage Azure Active Directory service principals
- To encrypt Azure SQL Database transparent data encryption keys
Correct answer: To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance
Managed HSM is a fully managed, single-tenant service providing FIPS 140-2 Level 3 validated HSMs where only the customer controls the security domain.
Question 2: Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?
- Service Tags
- Private Link DNS zones
- Network ACLs and firewall rules (Correct answer)
- VNet peering
Correct answer: Network ACLs and firewall rules
Key Vault firewall and virtual network rules (Network ACLs) allow you to allow-list specific public IP ranges and VNet subnets, blocking all other traffic.
Question 3: When a secret in Azure Key Vault is rotated, which Azure service should be configured to notify dependent applications of the new version?
- Azure Monitor action groups
- Azure Event Grid (Correct answer)
- Azure Service Bus
- Azure Logic Apps
Correct answer: Azure Event Grid
Azure Key Vault publishes lifecycle events (e.g., SecretNewVersionCreated) to Azure Event Grid, which downstream applications subscribe to for near-real-time rotation notifications.
Question 4: Which Azure service uses Key Vault to provide transparent, host-level disk encryption for Azure Virtual Machines?
- Azure Storage Service Encryption
- Azure Disk Encryption (ADE) (Correct answer)
- Azure Backup Encryption
- Azure Site Recovery
Correct answer: Azure Disk Encryption (ADE)
Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) with encryption keys or Key Encryption Keys (KEKs) stored and protected in Azure Key Vault.
Question 5: What Key Vault property ensures that cryptographic operations are performed inside the HSM and keys never exist in plaintext outside it?
- Soft Delete enabled
- Key exportable flag set to false
- HSM-protected key type (Correct answer)
- Purge Protection enabled
Correct answer: HSM-protected key type
Selecting the HSM-protected key type (Premium tier) ensures all cryptographic operations occur within the HSM boundary, so plaintext key material never leaves it.
Question 6: Which built-in RBAC role allows a principal to manage Key Vault properties (create, update, delete the vault) but grants NO access to secrets, keys, or certificates?
- Key Vault Secrets Officer
- Key Vault Contributor (Correct answer)
- Key Vault Administrator
- Contributor
Correct answer: Key Vault Contributor
Key Vault Contributor is a control-plane role that manages the vault resource itself but intentionally has no data-plane permissions to read or write secrets, keys, or certificates.
Question 7: An Azure App Service needs to read a database connection string from Key Vault without storing any credentials. Which feature enables this?
- Key Vault diagnostic settings
- App Service Key Vault references in application settings (Correct answer)
- App Service Managed Certificates
- API Management Key Vault integration
Correct answer: App Service Key Vault references in application settings
App Service Key Vault references let you use the syntax @Microsoft.KeyVault(SecretUri=...) directly in app settings, and the platform resolves the secret value at runtime using a managed identity.
Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 2
What is the primary purpose of Azure Key Vault Managed HSM?