Exam AZ-400 topic 8 question 14 discussion

Other way around, should be rbac and then access policy.

Delete key vault - RBAC Access to secrets - Vault Policy https://docs.microsoft.com/en-us/azure/key-vault/general/security-overview

1. RBAC (management plane) 2. RBAC or Key Vault Access Policy (data plane)

Slot1: RBAC Slot2: Access Policy (because in azure pipelines Azure Key Vaults that use Azure role-based access control (Azure RBAC) are not supported -- this is the link to the related documentation: https://learn.microsoft.com/en-us/azure/devops/pipelines/release/azure-key-vault?view=azure-devops&tabs=classic#set-up-key-vault-access-policies

Will pick RBAC and Access Policy although RBAC and RBAC is also correct

Final answer after going thorugh all comments 1. RBAC 2. Access Policy

ChatGPT: RBAC (Role-Based Access Control) to grant the necessary permissions to the appropriate users or groups. Access Policies allow you to specify which users, groups, or applications have access to the secrets stored in the key vault.

RBAC RBAC https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli

In my opinion: rbac & rbac https://learn.microsoft.com/en-gb/azure/key-vault/general/rbac-access-policy

RBAC will prevent the key vault from being deleted Access policy will prevent data from being deleted

Access to vaults takes place through two interfaces or planes. Management plane is controlled via RBAC to manage Key Vault itself. Operations that can be controlled are: > Create, read, update, and delete key vaults > Set Key Vault access policies > Set Key Vault tags Data plane is controlled via Access Policies to allows you to work with the data stored in a key vault. Operations that can be controlled are: > Keys: encrypt, decrypt, wrapKey, unwrapKey, sign, verify, get, list, create, update, import, delete, recover, backup, restore, purge > Certificates: managecontacts, getissuers, listissuers, setissuers, deleteissuers, manageissuers, get, list, create, import, update, delete, recover, backup, restore, purge > Secrets: get, list, set, delete,recover, backup, restore, purge

Why not RBAC and RBAC?

Delete key vault - RBAC Access to secrets - Vault Policy https://docs.microsoft.com/en-us/answers/questions/370371/restrict-access-to-the-secrets-in-the-key-vault-ar.html

It is the other way round https://docs.microsoft.com/en-us/azure/key-vault/general/security-features Look under the section "Privileged access"

RBAC Access Policy

Selected during exam. Delete key vault - RBAC Access to secrets - Vault Policy

To manage to delete KEYVAULT ==> RBAC To access to secrets inside KV ==> Access Policy https://docs.microsoft.com/en-us/answers/questions/370371/restrict-access-to-the-secrets-in-the-key-vault-ar.html