AZ-204 Implement Azure security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Create Key Vault, then Add a secret, then Grant access to the secret, then Retrieve the secret, then Use the secret

  Why this is correct

  This sequence correctly outlines the logical and technical dependencies for secure secret management within Azure. First, the Azure Key Vault resource must be provisioned. Next, the specific secret (e.g., database connection string, API key) is securely stored within the vault. Subsequently, an identity (user, application, or Managed Identity) is granted appropriate access policies (e.g., 'Get', 'List') to the secret. Only then can the application programmatically retrieve the secret, typically at runtime, for its intended operational use.

• ✗

  Create Key Vault, then Grant access to the secret, then Add a secret, then Retrieve the secret, then Use the secret

  Why it's wrong here

  This order is incorrect because you cannot grant access to a secret that has not yet been created or stored within the Key Vault. Access policies are defined for specific vault objects like secrets, keys, or certificates. Attempting to assign permissions to a non-existent secret would either fail or be ineffective, as the target resource for the access policy is missing. The secret must exist before permissions can be meaningfully applied to it.

• ✗

  Create Key Vault, then Add a secret, then Retrieve the secret, then Grant access to the secret, then Use the secret

  Why it's wrong here

  This sequence is fundamentally flawed because an application or user cannot retrieve a secret from Azure Key Vault without having the necessary permissions explicitly granted beforehand. Azure Key Vault enforces a robust access control model, requiring an identity to possess at least the 'Get' secret permission. Attempting retrieval before access is granted would result in an authorization failure, preventing the secret from being accessed and subsequently used by the application.

• ✗

  Add a secret, then Create Key Vault, then Grant access to the secret, then Retrieve the secret, then Use the secret

  Why it's wrong here

  This order is incorrect because a secret must reside within an Azure Key Vault instance; it cannot exist independently or be added to a non-existent container. The Key Vault itself is the secure, managed service that provides the storage, encryption, and lifecycle management for secrets. Therefore, the Key Vault resource must be provisioned and available in Azure before any secrets can be uploaded or stored within it.

Go deeper

Related to this question