Exam SC-200 topic 4 question 27 discussion

Actual exam question from Microsoft's SC-200

Question #: 27
Topic #: 4

HOTSPOT
-

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).

The subscription contains the users shown in the following table.

KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.

Which users can read the values of each secret? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Show Suggested Answer

Suggested Answer:

by Blasty at Feb. 24, 2025, 1:54 p.m.

Comments

Submit Cancel

Krayzr

1 month ago

GIVEN CORRECT User1: Key Vault Administrator at Sub1 Scope: Sub1 (the subscription) includes RG1, which contains KV1 and KV2. Permissions: As Key Vault Administrator, User1 has full access to both KV1 and KV2, including the ability to read secrets. Access: KV1: Can read Secret1. KV2: Can read Secret2. User2: Key Vault Reader at RG1 Scope: RG1 (the resource group) contains both KV1 and KV2. Permissions: As Key Vault Reader, User2 can view the properties of KV1 and KV2 but lacks data plane permissions to access secret values. Access: KV1: Cannot read Secret1. KV2: Cannot read Secret2. User3: Key Vault Secrets User at KV1 Scope: KV1 (the specific key vault). Permissions: As Key Vault Secrets User, User3 can read secrets within KV1 but has no permissions on KV2 because the scope is limited to KV1. Access: KV1: Can read Secret1. KV2: Cannot read Secret2 (no permissions at KV2’s scope).

upvoted 1 times

...

a_kto_to

3 months, 3 weeks ago

Seems to be correct: https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

upvoted 2 times

...