AZ-204 Implement Azure security Practice Question
You have an Azure App Service that uses a system-assigned managed identity. You need to grant it permission to read a secret from Azure Key Vault. Which RBAC role should you assign at the Key Vault scope?
⚠ Common exam trap
Watch out — candidates often confuse 'Key Vault Reader' (a management-plane role) with the data-plane role needed to actually read secret values, or they over-provision by choosing 'Key Vault Contributor' thinking it includes read access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault Secrets User
The system-assigned managed identity needs to read a secret from Azure Key Vault. The 'Key Vault Secrets User' RBAC role grants exactly that permission — the ability to read secret contents. This is the least-privilege role that allows the 'Microsoft.KeyVault/vaults/secrets/read' action, which is required for reading secret values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Key Vault Reader
Why it's wrong here
The Key Vault Reader role provides permissions to view the Key Vault's metadata, such as its name, resource group, tags, and access policies. However, it explicitly does not grant access to the actual secret values, keys, or certificates stored within the vault. Since the App Service needs to retrieve the secret content, this role is insufficient as it only allows property enumeration, not data retrieval from the data plane.
- ✓
Key Vault Secrets User
Why this is correct
The Key Vault Secrets User role is specifically designed to grant data plane access for retrieving secrets. It provides permissions to perform actions like Microsoft.KeyVault/vaults/secrets/read and Microsoft.KeyVault/vaults/secrets/list, enabling the App Service to successfully fetch the actual secret values. This role adheres to the principle of least privilege by providing only the necessary permissions for secret retrieval without granting broader management capabilities.
- ✗
Key Vault Contributor
Why it's wrong here
The Key Vault Contributor role provides extensive management plane permissions, allowing full control over the Key Vault resource itself, including creating, updating, and deleting vaults, as well as managing access policies and all contained secrets, keys, and certificates. While it implicitly allows access to secrets by granting management over them, it far exceeds the requirement of merely retrieving a secret. Assigning this role violates the principle of least privilege by granting unnecessary destructive and administrative capabilities.
- ✗
Key Vault Certificate User
Why it's wrong here
The Key Vault Certificate User role is specifically scoped to operations related to certificates stored within Azure Key Vault. It grants permissions to read, list, and manage certificate objects, including their properties and content. However, this role provides no access whatsoever to secret objects, which are distinct entities within Key Vault. Therefore, it cannot fulfill the requirement for the App Service to retrieve a secret value.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.