Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management

Question 1

What is the default soft-delete retention period for Azure Key Vault?

Accepted Answer

90 days

Answer

Azure Key Vault soft-delete retains deleted vaults and objects for 90 days by default, allowing recovery before permanent deletion.

Question 2

Which Azure Key Vault pricing tier is required to use HSM-backed (Hardware Security Module) keys?

Accepted Answer

Premium

Answer

The Premium tier is required to store keys in FIPS 140-2 Level 2 validated HSMs, providing hardware-level key protection.

Question 3

Which Key Vault feature prevents even subscription administrators from permanently deleting a vault or its contents?

Accepted Answer

Purge Protection

Answer

Purge Protection enforces a mandatory retention period during which no one—including admins—can permanently purge a soft-deleted vault or object.

Question 4

What is the maximum size of a single secret value that can be stored in Azure Key Vault?

Accepted Answer

25 KB

Answer

Azure Key Vault secrets are limited to 25 KB per value; use Azure Blob Storage with envelope encryption for larger payloads.

Question 5

Compared to Key Vault Access Policies, what additional granularity does Azure RBAC provide for Key Vault?

Accepted Answer

RBAC allows per-secret and per-key permissions; Access Policies are vault-wide

Answer

Azure RBAC enables assigning roles at the individual secret, key, or certificate level, whereas Access Policies apply permissions across the entire vault.

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Practice Test

Microsoft Azure Security Engineer Certification Azure Key Vault and Secrets Management