Examkin

Question

Difficulty: MediumAzure Key Vault Secret, Key, and Certificate Management

You are authoring a Bicep template to deploy a new Azure Key Vault. The Key Vault must meet the following security requirements:

* Use Azure Role-Based Access Control (RBAC) for authorization instead of vault access policies.
* Prevent the permanent deletion of the Key Vault, its secrets, keys, and certificates by any user, including administrators.

Which two properties must you configure within the `properties` block of the Key Vault resource definition?

  1. `enableRbacAuthorization` set to `true`Answer
  2. `enablePurgeProtection` set to `true`Answer
  3. C
    `enableSoftDelete` set to `false`
  4. D
    An `accessPolicies` array containing tenant and permission mappings

Answer

Configure `enableRbacAuthorization` set to `true` and `enablePurgeProtection` set to `true`.
To configure Azure Key Vault via a Bicep/ARM template for Azure RBAC authorization and prevent permanent deletion, you must configure two key properties within the vault's properties block: setting `enableRbacAuthorization` to `true` ensures that Azure RBAC is used for data-plane authorization, and setting `enablePurgeProtection` to `true` prevents the immediate purging of deleted items. This enforces the soft-delete retention policy and secures key vault content against accidental or malicious permanent deletion.

Step-by-Step Solution

1
Enable Azure RBAC for key vault authorization by setting the `enableRbacAuthorization` property to `true` in the Bicep template's properties block.
This ensures that authorization is controlled via Azure Role-Based Access Control rather than traditional inline key vault access policies.
This directly satisfies the requirement to use Azure RBAC instead of vault access policies.
2
Enable purge protection by setting the `enablePurgeProtection` property to `true` in the properties block.
This prevents anyone, including administrators, from immediately and permanently deleting (purging) the Key Vault or any deleted secrets/keys/certificates before the soft-delete retention period expires.
This satisfies the security requirement to prevent permanent deletion of the vault and its objects.

Key Concept

Configuring Azure Key Vault properties in infrastructure-as-code templates to enforce RBAC authorization and purge protection.
Rate this question

Topics

Azure Key Vault Secret, Key, and Certificate Management

More questions from this topic