AZ-204 Implement Azure security Practice Question
Which TWO permissions should be granted to an application's managed identity to allow it to read secrets from Azure Key Vault and use them to access Azure Storage?
⚠ Common exam trap
It's easy for candidates to confuse the Key Vault Reader role (which only allows reading metadata, not secret values) with the Key Vault Secrets User role (which allows reading the actual secret content), or they mistakenly think the Key Vault Secrets Officer role is required when only read access is needed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault Secrets User role (includes get and list)
To read secrets from Azure Key Vault, the Key Vault Secrets User role provides the necessary 'get' and 'list' permissions using the principle of least privilege. To access Azure Storage after retrieving a secret (e.g., a connection string), the Storage Blob Data Contributor role is required. Therefore, two distinct roles (D and E) satisfy the requirements. The Key Vault Secrets Officer role (B) would also allow reading secrets but grants excessive permissions beyond what is required for just reading, so it is not a least-privilege choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Key Vault Crypto User role
Why it's wrong here
Key Vault Crypto User role is for cryptographic operations (e.g., encrypt/decrypt) and does not grant permissions to read secret values, so it is incorrect.
- ✗
Key Vault Secrets Officer role (includes all operations)
Why it's wrong here
Key Vault Secrets Officer role includes all operations on secrets, including 'get' and 'list', so it does allow reading secrets. Although it is more permissive than necessary, it is technically correct for this requirement.
- ✗
Key Vault Reader role
Why it's wrong here
Key Vault Reader role only allows reading metadata about Key Vault resources (e.g., listing names) but does not grant access to read the actual secret values, so it is incorrect.
- ✓
Key Vault Secrets User role (includes get and list)
Why this is correct
Key Vault Secrets User role grants exactly the 'get' and 'list' permissions on secrets, which is what the managed identity needs to read secrets from Key Vault. This is the most appropriate role for the first part of the requirement.
- ✓
Storage Blob Data Contributor role on the storage account
Why this is correct
Storage Blob Data Contributor role on the storage account provides read, write, and delete access to blob containers and blobs, which is necessary for the application to access Azure Storage after retrieving the secret (e.g., connection string).
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.