AZ-204 Implement Azure security Practice Question
Your application uses Azure Key Vault to store cryptographic keys used for signing. You need to ensure that the keys can be used by multiple applications, but only one application should be able to delete the key. What should you do?
⚠ Common exam trap
It's easy for candidates to confuse soft-delete/purge protection with access control, thinking they restrict who can delete, when in fact they only protect against permanent loss after a delete is already authorized.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the 'Key Vault Crypto Officer' role to the application that needs to delete, and 'Key Vault Crypto User' to others.
Azure RBAC for Key Vault allows granular permissions. The 'Key Vault Crypto Officer' role includes delete permission for keys, while the 'Key Vault Crypto User' role only allows cryptographic operations (sign, verify, encrypt, decrypt) without delete. This meets the requirement of allowing multiple applications to use keys but restricting deletion to one specific application.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Assign the 'Key Vault Crypto Officer' role to the application that needs to delete, and 'Key Vault Crypto User' to others.
Why this is correct
The 'Key Vault Crypto Officer' Azure RBAC role grants comprehensive permissions over cryptographic keys, including the `delete` action, making it suitable for applications requiring the ability to remove keys. Conversely, the 'Key Vault Crypto User' role provides permissions for cryptographic operations like `encrypt` and `decrypt` but explicitly excludes deletion capabilities. This granular role assignment directly implements the principle of least privilege, ensuring only authorized applications can perform destructive actions on sensitive cryptographic material.
- ✗
Enable soft-delete and purge protection on the key vault.
Why it's wrong here
Enabling soft-delete and purge protection on an Azure Key Vault is a critical data recovery feature designed to prevent accidental or malicious permanent data loss. While soft-delete retains deleted keys for a specified period and purge protection prevents immediate purging, these features do not act as an authorization mechanism. They do not restrict *who* can initiate the initial delete operation; rather, they control the *finality* of the deletion, ensuring keys can be recovered after being marked for deletion by an authorized principal.
- ✗
Create a key rotation policy that automatically deletes old keys.
Why it's wrong here
Key rotation policies are designed to automate the lifecycle management of cryptographic keys, enhancing security by regularly generating new key versions and disabling or deleting older ones. Although a rotation policy can automatically delete old key versions, this is a scheduled, automated process for key hygiene, not a control mechanism for manual delete permissions. It does not dictate which specific application identity has the explicit authorization to manually delete an active key at any given time, which is a function of access control.
- ✗
Configure the key vault firewall to allow only the authorized application's IP.
Why it's wrong here
Configuring a Key Vault firewall restricts network access, allowing connections only from specified IP addresses, IP ranges, or virtual networks. This network-level control is a crucial layer of defense, ensuring that only traffic from trusted sources can reach the Key Vault endpoint. However, network access is entirely separate from authorization; an application granted network access by the firewall still requires appropriate Azure RBAC roles or Key Vault access policies to perform specific operations, such as deleting keys, within the vault.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.