Practice Key Vault Questions Now
Start a timed practice session focusing on Azure Key Vault Security topics from the AZ-500 question bank.
Start AZ-500 Practice Quiz →AZ-500 Key Vault Question Bank (29 Questions)
Browse all 29 practice questions covering Azure Key Vault Security for the AZ-500 certification exam. Answers are intentionally hidden on this page so you can self-test first before checking results in quiz mode.
- Question 1Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Azure Key Vault is accidentally deleted. The vault and all its secrets, keys, and certificates are still recoverable. Which Key Vault feature makes this possible?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 2Secure identity and access
A custom RBAC role must allow listing and reading secrets in Key Vault but not creating or deleting them. Which action set is correct for this role definition?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 3Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A developer with the Key Vault Contributor role is unable to read secrets from the Key Vault configured with RBAC authorization. Why?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 4Secure compute, storage, and databases
An App Service must connect to Azure Key Vault to retrieve secrets. The App Service uses a system-assigned managed identity. Which Key Vault RBAC role grants read access to secrets only?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 5Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Which Azure feature provides immutable audit logging of all key operations (create, read, delete) on secrets in Azure Key Vault?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 6Secure compute, storage, and databases
An AKS workload needs to read secrets from Azure Key Vault. The recommended approach avoids storing credentials in pod specifications. Which mechanism should be used?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 7Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Key Vault automatic key rotation is configured for an RSA key. What happens to data that was encrypted with the previous key version after rotation?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 8Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Key Vault secret has multiple versions. Which version is returned when an application requests the secret without specifying a version?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 9Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
An organization's Key Vault stores certificates used by Azure App Service. The certificates expire in 30 days. Which Azure service can auto-renew certificates issued by public CAs (like DigiCert) in Key Vault?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 10Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A company backs up Azure Key Vault secrets to another Azure region as part of a disaster recovery plan. Which Key Vault feature provides this capability?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 11Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
An organization's IT policy requires that all Azure Key Vaults must have soft delete enabled. Which Azure mechanism can enforce this retroactively and for new vaults?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 12Secure compute, storage, and databases
An organization uses Transparent Data Encryption with customer-managed keys on Azure SQL. The CMK is accidentally deleted from Key Vault without purge protection. What happens to the database?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 13Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
An Azure DevOps pipeline must access Azure Key Vault secrets without storing any credentials in the pipeline. Which approach should be used?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 14Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A company needs to back up Azure Key Vault secrets to a different Azure region for disaster recovery. What is a limitation of Key Vault backup-restore?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 15Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Azure Key Vault Managed HSM provides what level of FIPS validation for cryptographic operations?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 16Secure compute, storage, and databases
Which Azure feature protects VM disks by encrypting them using keys stored in Azure Key Vault?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 17Secure identity and access
An Azure VM must authenticate to Azure Key Vault without storing credentials in code. Which identity approach should be used?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 18Secure compute, storage, and databases
A VM's OS disk must be encrypted using a customer-managed key stored in Azure Key Vault, with encryption happening in the Azure storage layer. Which option achieves this?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 19Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
An administrator must ensure that once a Key Vault is deleted, it cannot be permanently purged for 90 days even by administrators. Which Key Vault feature must be enabled?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 20Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Key Vault must be accessible only from a specific VNet subnet and deny all other access including from the Azure portal over the internet. Which configuration achieves this?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 21Secure compute, storage, and databases
An AKS cluster uses Workload Identity. How does a pod obtain credentials to access Azure Key Vault?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 22Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
A Key Vault key is configured with expiration in 30 days. Which Key Vault feature sends a notification 15 days before expiry to alert the operations team?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 23Secure networking
A company has configured forced tunneling (all internet traffic routed to on-premises). Azure VMs cannot reach Azure platform services (Blob Storage, Key Vault). What should be added to allow this traffic to bypass the tunnel?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 24Secure compute, storage, and databases
Azure Disk Encryption (ADE) is enabled on a Linux VM. Which key component stored in Azure Key Vault protects the volume encryption key (VEK)?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 25Secure compute, storage, and databases
An Azure SQL Managed Instance requires TDE with customer-managed keys. The key must be accessible at all times. What must be configured to prevent data loss if the primary Key Vault becomes unavailable?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 26Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
Azure Key Vault access policies are being replaced by which newer authorization model that Microsoft recommends?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 27Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel
An organization uses Azure Defender for Key Vault. Which activity would trigger a Defender for Key Vault alert?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 28Secure compute, storage, and databases
An organization wants to use their own encryption keys stored in an Azure-dedicated HSM for encrypting Azure Blob Storage, ensuring Microsoft cannot access the keys. Which approach is required?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz - Question 29Secure identity and access
A custom RBAC role is created with only `Microsoft.Storage/storageAccounts/listkeys/action` in the Actions section. What can a user with this role actually do?
Answer hidden for practice.
Use the interactive quiz to reveal the correct answer and explanation.
Start AZ-500 Quiz
Key Key Vault Concepts for AZ-500
AZ-500 Key Vault Exam Tips
Azure Key Vault Security questions in AZ-500 are typically scenario-based. Focus on identity protection, platform hardening, data security, and security operations. Priority concepts: key vault, secret, key, certificate, hsm, access policy.
What AZ-500 Expects
- Anchor your answer in choose controls that reduce exposure while preserving least-privilege access.
- Key Vault scenarios for AZ-500 are frequently mapped to Domain 3 (20-25%), so read the objective carefully before picking controls or architecture.
- Expect multi-topic scenarios where Key Vault interacts with identity, networking, governance, or monitoring patterns rather than appearing as an isolated question.
- When two options are both technically valid, prefer the choice that best aligns with the exam's operational scope (Associate) and vendor best practices.
High-Value Key Vault Concepts
- Know the core Key Vault building blocks cold: key vault, secret, key, certificate.
- Review the edge-case features and limits for hsm, access policy; these details are commonly used to differentiate answer choices.
- Practice service-integration reasoning: how Key Vault pairs with Data Security, Identity Security in real deployment patterns.
- For AZ-500, explain why the chosen Key Vault design meets reliability, security, and cost expectations better than the alternatives.
Common AZ-500 Traps
- Watch for identity controls that are too broad for the requested scope.
- Questions in Secure Compute, Storage, and Databases often include distractors that look correct for Key Vault but violate least-privilege, compliance, or availability requirements.
- Avoid picking options purely by feature name; validate data path, failure handling, and governance impact before answering.
- If the prompt hints at automation or repeatability, eliminate manual-only operational answers first.
Fast Review Checklist
- Can you compare at least two Key Vault implementation paths and justify which one best fits the scenario?
- Can you map the chosen answer back to Secure Compute, Storage, and Databases (20-25%) outcomes for AZ-500?
- Can you explain security and access boundaries for Key Vault without relying on default-open assumptions?
- Can you describe how Key Vault integrates with Data Security and Identity Security during failure, scaling, and monitoring events?