SC-300 Certification Practice Question #180

Question

You have an Azure subscription that contains an Azure Automation account named Automation1 and an Azure key vault named Vault1. Vault1 contains a secret named Secret1.

You enable a system-assigned managed identity for Automation1.

You need to ensure that Automation1 can read the contents of Secret1. The solution must meet the following requirements:

•	Prevent Automation1 from accessing other secrets stored in Vault1.
•	Follow the principle of least privilege.

What should you do?

Accepted Answer

The requirement is twofold — Automation1's managed identity must read Secret1 only, and other secrets in Vault1 must remain inaccessible, following least privilege. MS Learn's RBAC guide states Azure RBAC for Key Vault allows separate permissions at the individual secret scope, and documents the exact portal flow: open the secret, go to its Access control (IAM) tab, and add a role assignment (e.g., Key Vault Secrets User) for the managed identity. That scopes access to Secret1 alone. Option A (Vault1 IAM) would grant the role across the whole vault, exposing every secret and breaking least privilege; the strong A-voting bloc (Manny_ez, etc.) reflects the older vault-wide pattern, which MS Learn now treats as not-least-privilege for this exact "share one secret" scenario. B and C don't grant data-plane read access at all. Confidence is 86% rather than higher because of a sizeable, well-argued community minority for A, but both the Suggested Answer and MS Learn clearly favor D.

More SC-300 practice questions