Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 3

Question 1

When you update a secret in Azure Key Vault, what happens to the previous secret value?

Accepted Answer

It is retained as an older version, accessible by its specific version ID

Answer

It is permanently deleted immediately

Answer

It is automatically backed up to Azure Blob Storage

Answer

It is disabled and deleted after 7 days

Question 2

Which diagnostic log category in Azure Key Vault records all data-plane operations such as reading, writing, and deleting secrets, keys, and certificates?

Accepted Answer

AuditEvent

Answer

AllMetrics

Answer

ActivityLog

Answer

DiagnosticEvent

Question 3

A security team wants to allow only resources within a specific Azure Virtual Network subnet to access Key Vault, with all other access blocked. What should they configure?

Accepted Answer

A private endpoint with public network access disabled

Answer

A network security group on the Key Vault resource

Answer

An Azure Firewall policy targeting Key Vault FQDNs

Answer

A conditional access policy in Azure AD

Question 4

When should an organization choose Azure Dedicated HSM over Azure Key Vault Premium?

Accepted Answer

When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware

Answer

When they need a lower-cost multi-tenant key management solution

Answer

When storing application configuration secrets at scale

Answer

When they need native integration with Azure Disk Encryption

Question 5

Which Key Vault access model should be used when you need to allow a specific service principal to read only one specific secret, without any access to other secrets in the same vault?

Accepted Answer

Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource

Answer

Key Vault Access Policies scoped to that secret

Answer

Key Vault firewall rules restricting the service principal's IP

Answer

Managed Identity with vault-wide Reader permissions

Question 6

A developer hardcoded an Azure Key Vault client secret in source code that was pushed to a public repository. What is the FIRST remediation step?

Accepted Answer

Rotate the client secret in Azure AD immediately

Answer

Enable soft-delete on Key Vault

Answer

Delete the public repository

Answer

Enable Key Vault firewall rules

Question 7

Which Azure Key Vault feature allows you to define a rotation schedule so that cryptographic keys are automatically regenerated at set intervals?

Accepted Answer

Key rotation policy

Answer

Key expiry date enforcement

Answer

Certificate auto-renewal

Answer

Purge Protection schedule