Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 3

Question 1

When you update a secret in Azure Key Vault, what happens to the previous secret value?

Accepted Answer

It is retained as an older version, accessible by its specific version ID

Answer

Key Vault maintains a full version history for secrets; each update creates a new version, and all previous versions remain accessible by their unique version ID.

Question 2

Which diagnostic log category in Azure Key Vault records all data-plane operations such as reading, writing, and deleting secrets, keys, and certificates?

Accepted Answer

AuditEvent

Answer

The AuditEvent log category captures all authenticated requests to the Key Vault data plane, including who accessed which object and when.

Question 3

A security team wants to allow only resources within a specific Azure Virtual Network subnet to access Key Vault, with all other access blocked. What should they configure?

Accepted Answer

A private endpoint with public network access disabled

Answer

A private endpoint assigns a private IP to Key Vault within the VNet, and disabling public network access ensures only resources reachable via private link can connect.

Question 4

When should an organization choose Azure Dedicated HSM over Azure Key Vault Premium?

Accepted Answer

When regulatory requirements demand exclusive, customer-controlled FIPS 140-2 Level 3 HSM hardware

Answer

Dedicated HSM provides single-tenant, customer-exclusive physical HSM devices meeting FIPS 140-2 Level 3, satisfying strict regulatory requirements that prohibit shared infrastructure.

Question 5

Which Key Vault access model should be used when you need to allow a specific service principal to read only one specific secret, without any access to other secrets in the same vault?

Accepted Answer

Azure RBAC with the Key Vault Secrets User role scoped to the specific secret resource

Answer

Azure RBAC supports role assignments scoped to individual secret, key, or certificate resources within a vault, enabling least-privilege access at the object level.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management 3