Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 2

Question 1

What is the primary purpose of Azure Key Vault Managed HSM?

Accepted Answer

To deliver a fully managed, single-tenant HSM service with FIPS 140-2 Level 3 compliance

Answer

Managed HSM is a fully managed, single-tenant service providing FIPS 140-2 Level 3 validated HSMs where only the customer controls the security domain.

Question 2

Which Key Vault networking feature restricts vault access to specific IP ranges or virtual networks without requiring a private endpoint?

Accepted Answer

Network ACLs and firewall rules

Answer

Key Vault firewall and virtual network rules (Network ACLs) allow you to allow-list specific public IP ranges and VNet subnets, blocking all other traffic.

Question 3

When a secret in Azure Key Vault is rotated, which Azure service should be configured to notify dependent applications of the new version?

Accepted Answer

Azure Event Grid

Answer

Azure Key Vault publishes lifecycle events (e.g., SecretNewVersionCreated) to Azure Event Grid, which downstream applications subscribe to for near-real-time rotation notifications.

Question 4

Which Azure service uses Key Vault to provide transparent, host-level disk encryption for Azure Virtual Machines?

Accepted Answer

Azure Disk Encryption (ADE)

Answer

Azure Disk Encryption uses BitLocker (Windows) or DM-Crypt (Linux) with encryption keys or Key Encryption Keys (KEKs) stored and protected in Azure Key Vault.

Question 5

What Key Vault property ensures that cryptographic operations are performed inside the HSM and keys never exist in plaintext outside it?

Accepted Answer

HSM-protected key type

Answer

Selecting the HSM-protected key type (Premium tier) ensures all cryptographic operations occur within the HSM boundary, so plaintext key material never leaves it.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 2