SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company stores application secrets and encryption keys in Azure Key Vault. They want to move from the older vault access policy model to a more scalable and granular permission model that integrates with Azure's role-based access control (RBAC). They also need to audit permissions using Azure Policy. Which access configuration should they choose for Azure Key Vault?
⚠ Common exam trap
Test-takers frequently confuse 'managed identity' (an authentication mechanism for resources) with the permission model itself, or assume that vault access policies are still the recommended approach for scalability, when in fact Azure RBAC is the modern, policy-auditable solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Azure RBAC permission model for Key Vault
Enabling the Azure RBAC permission model for Key Vault replaces the older vault access policy model with Azure's native role-based access control, providing granular, scalable permissions that integrate directly with Azure Policy for auditing. This model allows you to assign roles like Key Vault Secrets User or Key Vault Crypto Officer at the management plane, enabling centralized permission management across multiple vaults and supporting Azure Policy compliance checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use a single vault access policy with the Contributor role
Why it's wrong here
Using a single vault access policy with the Contributor role is incorrect because the Contributor role grants management plane permissions, allowing actions like creating or deleting the Key Vault resource itself. It does not provide data plane access to the secrets, keys, or certificates stored within the vault. Furthermore, vault access policies are a legacy access control model, separate from Azure RBAC, and do not offer the same level of centralized management or auditing capabilities for data plane operations.
- ✓
Enable the Azure RBAC permission model for Key Vault
Why this is correct
Enabling the Azure RBAC permission model for Key Vault is the correct approach as it allows granular control over data plane operations, such as getting, listing, or setting secrets and keys. This model integrates directly with Azure Active Directory, enabling centralized identity and access management using standard Azure RBAC roles. This integration also facilitates comprehensive auditing via Azure Policy, ensuring compliance and robust security governance for application secrets and encryption keys.
- ✗
Assign a managed identity to the Key Vault
Why it's wrong here
Assigning a managed identity to the Key Vault itself is incorrect because a managed identity serves as an identity for an Azure resource (e.g., an Azure Function or Virtual Machine) to authenticate to other Azure services, like Key Vault. It is not an access control mechanism that defines who or what can access the contents of the Key Vault. The Key Vault itself does not need a managed identity to function or to control access to its secrets.
- ✗
Use a service principal and configure vault access policies per application
Why it's wrong here
Using a service principal and configuring vault access policies per application is an older, less preferred method compared to Azure RBAC. Vault access policies are a Key Vault-specific access control model that requires individual policy assignments for each principal, such as a service principal. This approach becomes difficult to manage at scale, lacks the centralized control and auditing benefits of Azure RBAC, and does not align with a unified identity and access management strategy across Azure resources.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.