Exam SC-200 topic 4 question 25 discussion

Actual exam question from Microsoft's SC-200

Question #: 25
Topic #: 4

HOTSPOT
-

You have an Azure subscription named Sub1 that contains an Azure key vault named Vault1 and an Azure Automation account named Automation1.

You need to ensure that Automation1 can access Vault1. The solution1 must meet the following requirements:

• Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically.
• Ensure that runbooks created in Automation1 can read secret values stored in Vault1.
• Follow the principle of least privilege.

What should you configure for Automation1, and which built-in role should Automation1 use to access Vault1? To answer, select the appropriate options in the answer area.

NOTE: Each correct answer is worth one point.

Show Suggested Answer

Suggested Answer:

by Blasty at Feb. 24, 2025, 1:44 p.m.

Comments

Submit Cancel

Blasty

4 months, 3 weeks ago

1. Ensure that if Automation1 is deleted, the permissions granted for Vault1 will be removed automatically --> This suggests the use of a system-assigned managed identity, as it is tied to the lifecycle of the resource (Automation1). When Automation1 is deleted, its identity and permissions are automatically removed. 2. Ensure that runbooks created in Automation1 can read secret values stored in Vault1 --> The appropriate role should grant read access to secrets in Key Vault. 3. Follow the principle of least privilege --> The Key Vault Secrets User role is the best choice because it provides read access to secrets without unnecessary permissions.

upvoted 3 times

...