SC-200 Certification Practice Question #177

Question

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).

The subscription contains the users shown in the following table.

KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.

Which users can read the values of each secret? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Azure RBAC role assignments inherit downward through the scope hierarchy (subscription → resource group → resource). User1's Key Vault Administrator at the subscription scope grants full data-plane access — including reading secret values — to every vault under Sub1, so User1 can read both Secret1 (KV1) and Secret2 (KV2). User2's Key Vault Reader at RG1 grants only metadata read on both vaults and explicitly "Cannot read sensitive values such as secret contents," so User2 reads neither value. User3's Key Vault Secrets User is scoped to KV1 only, granting `vaults/secrets/getSecret`, so User3 reads Secret1 but has no assignment on KV2 and cannot read Secret2. That yields Secret1 = User1 and User3, Secret2 = User1 only — exactly the Krayzr breakdown (3 👍) and confirmed by a_kto_to citing the Key Vault RBAC guide.

More SC-200 practice questions