ExamTopics Logo
Mail Us[email protected]
Menu
Microsoft Discussions
exam questions

Exam AZ-500 All Questions

View all questions & answers for the AZ-500 exam
Go to Exam

Exam AZ-500 topic 5 question 24 discussion

Actual exam question from Microsoft's AZ-500
Question #: 24
Topic #: 5
[All AZ-500 Questions]

HOTSPOT -
You have an Azure subscription that contains an Azure key vault named ContosoKey1.
You create users and assign them roles as shown in the following table.

You need to identify which users can perform the following actions:
✑ Delegate permissions for ContosoKey1.
✑ Configure network access to ContosoKey1.
Which users should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Show Suggested Answer Hide Answer
Suggested Answer:
Reference:
https://docs.microsoft.com/en-gb/azure/key-vault/general/rbac-guide
by cvarl at March 17, 2021, 10:13 p.m.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
cvarl
Highly Voted 4 years, 4 months ago
Delegate permissions for ContosoKey1: User 1 and User 3 Configure network access to ContosoKey1: User 1 and User 4 Key Vault Contributor role definition includes Microsoft.KeyVault/*, which means it has full rights and can therefore modify network access https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
upvoted 60 times
massnonn
2 years ago
wrong: Microsoft.Resources/subscriptions/resourceGroups/read Gets or lists resource groups. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
upvoted 2 times
...
Pinto
4 years, 4 months ago
Not sure about box1, Box1: User1 and User3/User4. Box2: User1 and User4. https://docs.microsoft.com/en-us/azure/key-vault/general/secure-your-key-vault#management-plane-and-azure-rbac https://docs.microsoft.com/en-us/azure/key-vault/general/security-overview https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
upvoted 3 times
guser99
4 years, 4 months ago
Tested in lab Box1: User1,User3 and User4. Box2: User1 and User4.
upvoted 11 times
macco455
4 years, 4 months ago
@guser99 Contributors on ANY blade have full right EXCEPT modifying permission which includes delegation. Therefore this is incorrect. COrrect answer are: Box 1: User 1 and User 3 Box 2: User 1 and User 4
upvoted 11 times
russ0
4 years, 3 months ago
Box 2 should be User 1 only since Key Vault Contributor role is for management plane operations to manage key vaults. It does not allow access to keys, secrets and certificates.
upvoted 2 times
pentium75
1 year ago
But it is about "network access" which is a "management plane operation". Box 2 is not about "keys, secrets and certificates".
upvoted 1 times
...
...
...
...
...
TJ001
3 years, 7 months ago
key Vault contributor wont be enough to completely configure network setting - suppose it needs to access the VNET/subnet for service endpoint or create private endpoint - it is contentious we can argue those resource are in separate RG and for those RGs user 4 have the required permissions
upvoted 7 times
CliveW
3 years, 1 month ago
Even an Owner (at Key Vault level) wouldn't be able to access the VNET/subnet....
upvoted 1 times
Ajdlfasudfo0
2 years, 6 months ago
that doesn't matter, he could also just whitelist IP ranges
upvoted 1 times
...
...
micofucho
3 years, 5 months ago
Questions says: "Configure network access to ContosoKey1". Key Vault Contributor can modify network access of Key Vault
upvoted 6 times
...
...
...
Cyberbug2021
Highly Voted 4 years, 3 months ago
A contributor does not have rights to grant permissions, check microsoft.keyvault/* does not include network access - https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkeyvault box 1 - user 1 and user 3 box 2 - user 1
upvoted 24 times
zsedo
4 years, 1 month ago
One only need Microsoft.KeyVault/vaults/accessPolicies/write which is part of the Key Vault Contributor role. You can add a single IP range, don't need to read the network configs (vnet/subnet)
upvoted 4 times
...
...
Jimmy500
Most Recent 1 year, 1 month ago
In the first box we need to know Key Vault Contributor can manage key vault but cannot grant access for key vault. There might be question can Key Vault Administrator could do this if it would be here instead of Key vault contributor? Answer would be not as well. As, Key vault administrator can perform all data plane operations but cannot grant access to the Key Vault. Owner and User Access administrator can grant an access to the Azure Key vault. That is why, in the box1 we should choose User1, User3. However, may be in the exam you can see Owner can see data plane directly, answer is not Owner should assign him/herself role first. I think this is enough for the box1. I will add next section as reply to here Exam Topics does not allow to add full comment as it is long a bit
upvoted 1 times
Jimmy500
1 year, 1 month ago
Let’s go with box2, Security Admin role is obvious to us we need to use it for Defender for Cloud side this is not option for us to choose in our answer. User Access Contributor cannot change any network settings as we see it is intended for access. We left for owner and Key vault contributor. Owner will be able to manage any management plane operation that is why one of the answers will be User1 who has owner role here. For the second role which is Key vault contributor I revoked my all permission in the subscription and tried to add network rules to Azure Key vault .
upvoted 1 times
Jimmy500
1 year, 1 month ago
I could only add Allow Access from section’s 2 options which are Allow public access from all networks, Disable Public access. When it comes to Allow public access from specific virtual networks and IP addresses, we cannot add Virtual network with just Key Vault Contributor role (You can test this as I did), In firewall setting where can only add public IP, I could add it. For the Private endpoint connections settings, we cannot add anything with just Key Vault contributor role. As a result of long tests, I would choose User1 only for the second box as we saw Key Vault Contributor could not add all settings for Network of Azure key vault.
upvoted 1 times
Jimmy500
1 year, 1 month ago
Box-1: User1, User3, Box:2- User1
upvoted 2 times
Hot_156
4 months, 4 weeks ago
I did test this, and I can manipulate Network properties with the Key Vault contributor role Box 2 - User 1 and User 4
upvoted 1 times
Hot_156
4 months, 3 weeks ago
These are the Contributor role permissions "actions": [ "*" ], "notActions": [ "Microsoft.Authorization/*/Delete", "Microsoft.Authorization/*/Write", "Microsoft.Authorization/elevateAccess/Action", "Microsoft.Blueprint/blueprintAssignments/write", "Microsoft.Blueprint/blueprintAssignments/delete", "Microsoft.Compute/galleries/share/action", "Microsoft.Purview/consents/write", "Microsoft.Purview/consents/delete", "Microsoft.Resources/deploymentStacks/manageDenySetting/action", "Microsoft.Subscription/cancel/action", "Microsoft.Subscription/enable/action"
upvoted 1 times
...
...
...
...
...
...
wardy1983
1 year, 9 months ago
Delegate permissions for ContosoKey1: User 1 and User 3 Configure network access to ContosoKey1: User 1 and User 4 Key Vault Contributor role definition includes Microsoft.KeyVault/*, which means it has full rights and can therefore modify network access https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
upvoted 4 times
...
[Removed]
1 year, 9 months ago
Tested in the lab Configure network access to ContosoKey1: User 1 and User 4 I gave User 4 keyvault contributor and was able to add my public IP to the network allow list, when I was logged in as User4
upvoted 1 times
Jimmy500
1 year, 1 month ago
You can not any vnet with just Key Vault Contributor Access , you can only do 2 things 1-Allow Public access from all networks in the firewall and virtual network settings, and second one is Disable public access, there is nothing else besides these you can do with just Key vault contributor role
upvoted 1 times
...
...
TheProfessor
1 year, 10 months ago
Answers are correct. Key Vault Contributor Manage key vaults, but does not allow you to assign roles in Azure RBAC, and does not allow you to access secrets, keys, or certificates. Learn more Actions Description Microsoft.Authorization/*/read Read roles and role assignments Microsoft.Insights/alertRules/* Create and manage a classic metric alert Microsoft.KeyVault/* Microsoft.Resources/deployments/* Create and manage a deployment Microsoft.Resources/subscriptions/resourceGroups/read Gets or lists resource groups. Microsoft.Support/* Create and update a support ticket NotActions Microsoft.KeyVault/locations/deletedVaults/purge/action Purge a soft deleted key vault Microsoft.KeyVault/hsmPools/* Microsoft.KeyVault/managedHsms/*
upvoted 1 times
...
AzureAdventure
1 year, 10 months ago
Box 1 : User 1 and User 3 (The Key Vault Contributor role is for management plane operations to manage key vaults. It does not allow access to keys, secrets and certificates) Box 2: User 1 and User 4
upvoted 3 times
...
zellck
2 years, 3 months ago
1. User1 and User3 only. 2. User1 only. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator Lets you manage user access to Azure resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor Manage key vaults, but does not allow you to assign roles in Azure RBAC, and does not allow you to access secrets, keys, or certificates.
upvoted 4 times
pentium75
1 year ago
But 'configuring network settings for key vault' IS 'managing key vaults'
upvoted 1 times
...
...
majstor86
2 years, 5 months ago
Delegate permissions for ContosoKey1: User 1 and User 3 only Configure network access to ContosoKey1: User 1 only
upvoted 5 times
...
prasdey
2 years, 5 months ago
Given Answer is correct
upvoted 2 times
...
fonte
2 years, 7 months ago
Delegate Permissions: User 1 and User 3 Configure Network Access (Networking > Firewalls and virtual Networks): User 1 and User 4 Tested in lab.
upvoted 4 times
Alexbz
2 years, 1 month ago
I also tested this in lab For configuring the Network access, user4 was able to do some network configurations like Changing "Allow access from:" option for all to Disable but not to an specific VNet as the user doesn't have any rights on those VNETs or even no right to create a new VNET. the User also could add an IP to firewall and change the Exception settings. So considering all these I thing Box 2 should be User1 and User4.
upvoted 3 times
...
...
Muaamar_Alsayyad
2 years, 9 months ago
Box1: User1 and User3 Box2: User1 and User4
upvoted 4 times
...
Riyasriy
3 years ago
Box1: User1 and User3 Box2: User1 and User4 I have tested this on my lab. user4 also can modify network access https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
upvoted 7 times
...
tnagy
3 years, 1 month ago
For Q2: The answer should be User 1 and User 4. Why user 4? KeyVault Contributer has the following permission: Microsoft.Resources/deployments/* (Create and manage a deployment) which means he can configure network access to keys. https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#key-vault-contributor
upvoted 2 times
...
CliveW
3 years, 1 month ago
Tested - Key Vault Contributor role most definitely allows network access configuration. Only issue seems to be if no service endpoint configured on a subnet, in which case the lack of write access to networks comes into play.
upvoted 1 times
...
Exams_Prep_2021
3 years, 1 month ago
In Exam - 20/6/2022 - 1 Case Study ( 6 ) - Lab ( 10 Tasks )
upvoted 2 times
...
WhalerTom
3 years, 7 months ago
In exam Dec'21. 40 questions, 1 case study, no labs.
upvoted 2 times
...
Load full discussion...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel