SC-300 Certification Practice Question #150

Question

You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named Vault1. VM1 has a system-assigned managed identity.

You need to ensure that VM1 can retrieve the values of secrets stored in Vault1. The solution must minimize administrative effort.

What should you do first?

Accepted Answer

With a system-assigned managed identity already present, the documented action to let the VM read secrets is to **grant that identity an Azure role** — the Key Vault Secrets User role — exactly as every MS Learn VM-to-Key-Vault tutorial shows (`az role assignment create --role "Key Vault Secrets User"`). RBAC is Microsoft's default and recommended access-control model for Key Vault (and the default for new vaults), so the tutorials never include a "change the permission model" step; assigning the role is the direct, minimal-effort first action. The dissent (B) hinges on an unstated assumption that the vault is configured for legacy access policies and therefore must be flipped to RBAC first — plausible test-writer trickery, but not stated in the question and contrary to the default. Both the Suggested Answer and the 6-vote Most Voted are D, with two 👍3 comments supporting it. Confidence is held in the 75–81 band because of the genuine, well-argued B/D community split, with MS Learn and the default RBAC model serving as the tiebreaker for D.

More SC-300 practice questions