AZ-204 Azure RBAC Practice Question
Your company uses Azure Key Vault to store secrets. You need to ensure that only a specific Microsoft Entra ID application can read a particular secret, while other applications are denied access. You want to apply the principle of least privilege. Which access control method should you configure?
⚠ Common exam trap
Watch out — candidates often confuse vault-scoped access policies or RBAC roles with secret-scoped RBAC, mistakenly thinking they can achieve per-secret isolation with access policies, when in fact only RBAC at the secret scope provides that granularity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign the application to the Key Vault Secrets User RBAC role at the secret scope
Azure RBAC allows you to assign the Key Vault Secrets User role at the secret scope, which grants read access exclusively to the specified Microsoft Entra ID application for that particular secret. This aligns with the principle of least privilege by restricting access to only the necessary secret, without granting broader permissions at the vault level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Assign the application to the Key Vault Contributor RBAC role
Why it's wrong here
The Key Vault Contributor role is a control plane role primarily intended for managing the Azure Key Vault resource itself, such as creating, deleting, or updating vault properties and access policies. It does not grant data plane permissions to read, write, or delete secrets, keys, or certificates stored within the vault. Assigning this highly privileged management role would be inappropriate and ineffective for an application needing to retrieve a secret, and it severely violates the principle of least privilege.
- ✓
Assign the application to the Key Vault Secrets User RBAC role at the secret scope
Why this is correct
The Key Vault Secrets User role is a data plane role specifically designed to grant read access to secret contents. By assigning this role at the secret scope, meaning targeting the specific secret resource (e.g., "/secrets/{secretName}"), the application is precisely authorized to retrieve only that individual secret. This approach perfectly aligns with the principle of least privilege, providing the minimum necessary access for the application's requirement.
- ✗
Use Key Vault access policies
Why it's wrong here
Key Vault access policies are a legacy access control mechanism that operates at the vault level. When an access policy is configured, it grants a specified set of permissions (e.g., Get, List secrets) to a security principal across all secrets, keys, or certificates within that entire vault. This mechanism lacks the granularity to restrict access to an individual secret, making it unsuitable for scenarios requiring precise, secret-level access control.
- ✗
Use managed identity and assign the Key Vault Secrets User role at the vault scope
Why it's wrong here
While utilizing a managed identity is a recommended security practice for Azure services to authenticate to Key Vault without credential management, assigning the Key Vault Secrets User role at the vault scope is too broad. This grants the managed identity read access to all secrets within that entire vault. If the application only requires access to a single, specific secret, this configuration violates the principle of least privilege by providing unnecessary and excessive access.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.