AZ-305 Design infrastructure solutions Practice Question
Exhibit
{
"roleAssignments": [
{
"principalId": "user1@contoso.com",
"roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
"scope": "/subscriptions/1234-5678/resourceGroups/rg-prod/providers/Microsoft.KeyVault/vaults/vault-prod"
},
{
"principalId": "user1@contoso.com",
"roleDefinitionId": "8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
"scope": "/subscriptions/1234-5678/resourceGroups/rg-prod"
}
]
}Refer to the exhibit. The JSON shows role assignments for user1. The role definition IDs are: b24988ac-6180-42a0-ab88-20f7382dd24c = Key Vault Secrets User, 8e3af657-a8ff-443c-a75c-2fe8c4bcb635 = Reader. User1 reports being unable to list secrets in the key vault 'vault-prod' using Azure CLI. What is the most likely cause?
⚠ Common exam trap
Watch out — candidates often assume the Key Vault Secrets User role can list secrets because it can read secret values, but Azure RBAC distinguishes between reading a specific secret and enumerating all secrets in a vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Key Vault Secrets User role does not include the ability to list secrets
The Key Vault Secrets User role (b24988ac-6180-42a0-ab88-20f7382dd24c) grants permissions only to read secret values and metadata, but it does not include the 'list' action on secrets. To list secrets in a key vault, a role such as Key Vault Secrets Officer or a custom role with Microsoft.KeyVault/vaults/secrets/read action is required. Since User1 only has the Key Vault Secrets User role on the vault, they cannot execute the 'az keyvault secret list' command.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
User1 does not have any role assignment on the key vault
Why it's wrong here
User1 has a role assignment at vault scope.
- ✓
The Key Vault Secrets User role does not include the ability to list secrets
Why this is correct
The role only allows reading secret values, not listing.
- ✗
User1 must have the Contributor role on the key vault
Why it's wrong here
Contributor is not required; Key Vault Secrets Officer can list.
- ✗
The Reader role at resource group scope overrides the vault role
Why it's wrong here
Permissions are additive, not overriding.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-305 question from scratch — 212 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.