AZ-400 Develop a security and compliance plan Practice Question
Your company uses Azure Key Vault to store secrets. Which TWO actions should you take to ensure secure access? (Select TWO.)
⚠ Common exam trap
Candidates often confuse data protection features (like soft-delete) with access control mechanisms, or mistakenly think enabling HTTP improves performance without realizing Key Vault enforces HTTPS exclusively, leading them to select options that address recovery or monitoring rather than secure authentication and authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Restrict access using Key Vault access policies
Restricting access using Key Vault access policies (Option A) is correct because Azure Key Vault uses a granular permission model where you assign specific permissions (e.g., GET, LIST, SET) to individual security principals (users, groups, or service principals) at the vault level. This ensures that only authorized identities can read or manage secrets, keys, and certificates, following the principle of least privilege. Using managed identities (Option B) is correct because they provide an automatically managed identity in Azure AD for applications to authenticate to Key Vault without storing credentials in code or configuration, eliminating the risk of secret leakage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Restrict access using Key Vault access policies
Why this is correct
Restrict access using Key Vault access policies: Access policies are evaluated for each principal, allowing fine-grained permissions such as get, list, and set on secrets, certs, and keys. By assigning only the minimum required permissions to each user, group, or service principal, you implement least privilege and directly reduce the attack surface for unauthorized secret access.
- ✓
Use managed identities to authenticate applications
Why this is correct
Use managed identities to authenticate applications: Managed identities provide an Azure AD-backed identity automatically managed by Azure, removing the need to store client IDs or passwords in code or configuration. The identity can be assigned to an App Service, VM, or function and can authenticate to Key Vault without any hard-coded credentials, while Azure automatically rotates the underlying principal.
- ✗
Enable HTTP access for performance
Why it's wrong here
Enable HTTP access for performance: HTTP transmits all data, including secrets and authentication tokens, as plaintext, making it trivial to intercept on the network. Azure Key Vault does not support or allow HTTP; it requires TLS/HTTPS for all API calls, and the negligible performance gain from removing encryption is never worth the catastrophic security exposure.
- ✗
Disable audit logging to reduce exposure
Why it's wrong here
Disable audit logging to reduce exposure: Disabling diagnostic and audit logs removes your ability to detect unauthorized access, misuse, or exfiltration of secrets, and also breaks compliance requirements such as ISO 27001 or SOC 2. Security best practices mandate enabling Key Vault diagnostic logs and sending them to a SIEM or Log Analytics workspace for monitoring, so this option actually increases risk.
- ✗
Enable soft-delete to recover deleted secrets
Why it's wrong here
Enable soft-delete to recover deleted secrets: Soft-delete is a retention and recovery feature that lets you restore accidentally deleted secrets within a configurable retention period; it does not control who can access secrets. Access control is enforced by access policies or RBAC, whereas enabling soft-delete alone leaves a secret accessible to any principal that already has permission, so it does not address unauthorized access.
Go deeper
Related to this question
Learn chapter
Introduction to DevOps and Azure DevOps
Key term
Azure Key Vault
Azure Key Vault is a cloud service for securely storing and managing sensitive information like passwords, encryption keys, and certificates.
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
About these practice questions
One of 823 original AZ-400 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-400 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-400 exam.