Exam SC-300 topic 2 question 115 discussion

1. No. Must be Key Vault Secrets User. User1 is only a Reader. 2. Yes. User2 is a Key Vault Secrets User! :D 3. Yes. User3 is the Owner of RG1 and has god-like powers. >:-) https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

NYY (as others stated) Key Vault Administrator: Can perform all data plane operations on a key vault and its objects, including certificates, keys, and secrets. Key Vault Reader: Can read metadata of key vaults and their certificates, keys, and secrets, but cannot read sensitive values such as secret contents or key material1. Key Vault Secrets User: Can read secret contents from a key vault1. Key Vault Certificates Officer: Can perform actions on the certificates of a key vault, excluding reading the secret and key portions1. Key Vault Certificates User: Can read certificate contents from a key vault1. Key Vault Contributor: Can manage key vaults but does not allow access to keys, secrets, and certificates. Key Vault Crypto Officer: Can perform cryptographic operations using keys in a key vault2. Key Vault Crypto User: Can perform cryptographic operations using keys in a key vault but cannot manage keys2. Key Vault Purge Operator: Allows permanent deletion of soft-deleted vaults

NO Yes Yes

NYY, key: look at scope