AZ-204 Implement Azure security Practice Question
You have an Azure App Service web app with a system-assigned managed identity. You need to grant it permission to read secrets from an Azure Key Vault. Which RBAC role should you assign to the managed identity at the Key Vault scope?
⚠ Common exam trap
Many exam-takers confuse 'Key Vault Reader' (which only reads vault metadata, not secrets) with the actual data-plane role needed for secret access, or they mistakenly choose a broad role like 'Contributor' thinking it includes secret read permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault Secrets User
The system-assigned managed identity needs to read secrets from Key Vault. The 'Key Vault Secrets User' role grants exactly that permission — it allows the identity to perform secret read operations (Get, List) on the secrets in the vault. This is the correct RBAC role for read-only access to secrets, as opposed to keys or certificates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Key Vault Secrets User
Why this is correct
The Key Vault Secrets User role grants the necessary data plane permissions to retrieve the actual secret values stored within Azure Key Vault. Specifically, this role includes the `Microsoft.KeyVault/vaults/secrets/getSecret` data action, which is essential for an application's managed identity to programmatically access and use sensitive configuration data like database connection strings or API keys. Without this specific role, the App Service would be unable to decrypt and fetch the secret's content for operational use.
- ✗
Key Vault Reader
Why it's wrong here
The Key Vault Reader role provides permissions to view Key Vault properties, policies, and metadata of secrets, keys, and certificates, but crucially, it does not grant access to the secret *values* themselves. While an application with this role could enumerate the secrets present in a vault and see their attributes, it lacks the `Microsoft.KeyVault/vaults/secrets/getSecret` data action required to retrieve the sensitive content. Therefore, it is insufficient for an App Service to consume secrets.
- ✗
Key Vault Crypto User
Why it's wrong here
The Key Vault Crypto User role is specifically designed for performing cryptographic operations such as encrypt, decrypt, wrap, unwrap, sign, and verify, but exclusively with *keys* stored in Azure Key Vault. This role does not grant any permissions to access or retrieve the *secret values* themselves, as its focus is on cryptographic processing rather than secret retrieval. Its purpose is distinct from secret access, making it irrelevant for an App Service needing to read a database connection string.
- ✗
Contributor
Why it's wrong here
The Contributor role provides full management access to *all* resources within a resource group, including the Key Vault itself, but it is a *management plane* role. While it allows creating, updating, and deleting Key Vaults, it does not inherently grant *data plane* access to the secrets, keys, or certificates *within* the vault. Furthermore, granting such broad permissions for merely reading secrets violates the principle of least privilege, introducing unnecessary security risks far beyond what is required.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.