SC-300 Certification Practice Question #164

Question

You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains two Azure key vaults named KV1 and KV2 that use Azure role-based access control (Azure RBAC).

The subscription contains the users shown in the following table.

KV1 contains a secret named Secret1. KV2 contains a secret named Secret2.

Which users can read the values of each secret? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Both vaults use Azure RBAC, so access flows by role + scope. User1's Key Vault Administrator role at the subscription (Sub1) scope grants full data-plane access — including `getSecret` — and inherits down to both KV1 and KV2, so User1 reads Secret1 and Secret2. User3's Key Vault Secrets User role grants `vaults/secrets/getSecret/action` (read secret value) but is assigned only at KV1, so User3 reads Secret1 but has no assignment reaching KV2/Secret2. User2's Key Vault Reader role explicitly "cannot read sensitive values such as secret contents," so User2 reads neither value. That yields Secret1 = User1 and User3 only, and Secret2 = User1 only, matching the top community comment (ethhacker, 👍 3).

More SC-300 practice questions