Connect to and consume Azure services and third-party services →mediumMultiple ChoiceObjective-mapped
AZ-204 Practice Question: Connect to and consume Azure services and third-party services
Your app uses Azure Key Vault to store secrets. You need to grant the app access to read secrets using managed identity. Which RBAC role should you assign to the app's managed identity?
⚠ Common exam trap
A common mix-up: candidates confuse the Key Vault Reader role (which only allows reading vault metadata, not secret values) with the Key Vault Secrets User role, or they mistakenly choose a broader role like Contributor, thinking it includes read access, but it grants excessive permissions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Key Vault Secrets User
The Key Vault Secrets User role (D) is the correct RBAC role because it grants the managed identity permission to perform read operations on secrets, specifically 'Microsoft.KeyVault/vaults/secrets/read' and 'Microsoft.KeyVault/vaults/secrets/getSecret/action'. This aligns with the requirement to read secrets using managed identity without granting broader management or cryptographic key permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Key Vault Crypto Officer
Why it's wrong here
The Key Vault Crypto Officer role is designed for performing cryptographic operations on keys within Azure Key Vault, such as encrypting, decrypting, wrapping, and unwrapping keys. While it grants permissions for key management and usage, it explicitly does not include data plane permissions to read or access the actual values of secrets. Therefore, an application requiring secret values cannot use this role.
- ✗
Key Vault Reader
Why it's wrong here
The Key Vault Reader role provides read-only access to the Key Vault resource and its metadata, allowing users or applications to list vaults, keys, secrets, and certificates. However, this role is limited to viewing properties and names, and it specifically lacks the `Microsoft.KeyVault/vaults/secrets/read` data action required to retrieve the confidential content or actual value of a secret. Consequently, it is insufficient for an application needing to consume secret values.
- ✗
Key Vault Contributor
Why it's wrong here
The Key Vault Contributor role is a management plane role that grants broad permissions to manage the Key Vault resource itself and its contained objects, including creating, updating, and deleting secrets. While it allows for the management of secret objects, it does not inherently provide data plane access to read the *values* of those secrets. Furthermore, granting contributor access is overly permissive for an application that only needs to retrieve secret values, violating the principle of least privilege.
- ✓
Key Vault Secrets User
Why this is correct
The Key Vault Secrets User role is the appropriate choice as it is specifically designed to grant data plane access for reading secret values stored in Azure Key Vault. This role includes the `Microsoft.KeyVault/vaults/secrets/read` permission, enabling an application to retrieve and utilize the confidential information. It adheres to the principle of least privilege by providing only the necessary permissions for secret consumption without granting broader management capabilities.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
Key term
Managed identity
A managed identity is an automatically managed service principal in Azure that allows your code to authenticate to any service that supports Azure AD authentication without storing credentials.
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.