Microsoft AZ-305 Secrets, Certificates and Key Management Practice Test

 

Topic 05 focuses on Secrets, Certificates, and Key Management for the Microsoft Certified: Azure Solutions Architect Expert certification and the AZ-305 exam, using Microsoft Azure solution-architecture scenarios. For broader exam preparation, review the Microsoft Azure Solutions Architect Expert AZ-305 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which Azure capability lets an Azure workload authenticate to Key Vault without storing client credentials?

1. Managed identity for Key Vault access
2. Key Vault secret
3. Azure Key Vault
4. Key Vault certificate

Correct Answer: A

 

Correct Answer

Answer A is correct because Managed identity for Key Vault access matches the described capability and is intended to retrieve secrets or keys securely without embedding application credentials.

Incorrect Answers

Answer B is incorrect because Key Vault secret is intended to remove application secrets from source code and configuration files, which is a different architectural function.

Answer C is incorrect because Azure Key Vault is intended to centralize application secrets, encryption keys, and certificates in a managed service, which is a different architectural function.

Answer D is incorrect because Key Vault certificate is intended to centralize certificate storage and lifecycle management, which is a different architectural function.

 

Question 2

To enforce a recovery window even for privileged deletion attempts, which Azure design option should be selected?

1. Key Vault purge protection
2. Key Vault secret
3. Key Vault private endpoint
4. Azure Key Vault

Correct Answer: A

 

Correct Answer

Answer A is correct because Key Vault purge protection prevents permanent deletion of soft-deleted vaults and objects until the retention period expires. It directly meets the requirement to enforce a recovery window even for privileged deletion attempts.

Incorrect Answers

Answer B is incorrect because Key Vault secret is used to remove application secrets from source code and configuration files; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Key Vault private endpoint is used to keep Key Vault data-plane access on private network paths; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Key Vault is used to centralize application secrets, encryption keys, and certificates in a managed service; that does not directly satisfy the requirement in this scenario.

 

Question 3

Which Azure capability provides private IP connectivity to a vault through Azure Private Link?

1. Azure Key Vault Managed HSM
2. Key Vault key
3. Key Vault private endpoint
4. Managed identity for Key Vault access

Correct Answer: C

 

Correct Answer

Answer C is correct because Key Vault private endpoint matches the described capability and is intended to keep Key Vault data-plane access on private network paths.

Incorrect Answers

Answer A is incorrect because Azure Key Vault Managed HSM is intended to protect high-value cryptographic keys when dedicated HSM-backed key custody is required, which is a different architectural function.

Answer B is incorrect because Key Vault key is intended to centralize cryptographic key operations and lifecycle management, which is a different architectural function.

Answer D is incorrect because Managed identity for Key Vault access is intended to retrieve secrets or keys securely without embedding application credentials, which is a different architectural function.

 

Question 4

For Key Vault certificate, which statement is accurate?

1. Manages X.509 certificates and can automate supported certificate creation or renewal workflows.
2. Uses Azure role assignments to control management-plane and supported data-plane access to vault contents.
3. Lets an Azure workload authenticate to Key Vault without storing client credentials.
4. Prevents permanent deletion of soft-deleted vaults and objects until the retention period expires.

Correct Answer: A

 

Correct Answer

Answer A is correct because Key Vault certificate manages X.509 certificates and can automate supported certificate creation or renewal workflows.

Incorrect Answers

Answer B is incorrect because that description belongs to Key Vault Azure RBAC authorization, whose purpose is to apply consistent Azure RBAC-based access control to vault data.

Answer C is incorrect because that description belongs to Managed identity for Key Vault access, whose purpose is to retrieve secrets or keys securely without embedding application credentials.

Answer D is incorrect because that description belongs to Key Vault purge protection, whose purpose is to enforce a recovery window even for privileged deletion attempts.

 

Question 5

For Key Vault Azure RBAC authorization, which statement is accurate?

1. Retains deleted vaults and vault objects for a configured retention period so they can be recovered.
2. Stores and controls access to secrets, keys, and certificates with Azure-integrated authentication, logging, and lifecycle features.
3. Provides private IP connectivity to a vault through Azure Private Link.
4. Uses Azure role assignments to control management-plane and supported data-plane access to vault contents.

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault Azure RBAC authorization uses Azure role assignments to control management-plane and supported data-plane access to vault contents.

Incorrect Answers

Answer A is incorrect because that description belongs to Key Vault soft delete, whose purpose is to protect against accidental or malicious deletion by enabling recovery.

Answer B is incorrect because that description belongs to Azure Key Vault, whose purpose is to centralize application secrets, encryption keys, and certificates in a managed service.

Answer C is incorrect because that description belongs to Key Vault private endpoint, whose purpose is to keep Key Vault data-plane access on private network paths.

 

Question 6

Which Azure capability prevents permanent deletion of soft-deleted vaults and objects until the retention period expires?

1. Azure Key Vault
2. Key Vault private endpoint
3. Key Vault purge protection
4. Key Vault secret

Correct Answer: C

 

Correct Answer

Answer C is correct because Key Vault purge protection matches the described capability and is intended to enforce a recovery window even for privileged deletion attempts.

Incorrect Answers

Answer A is incorrect because Azure Key Vault is intended to centralize application secrets, encryption keys, and certificates in a managed service, which is a different architectural function.

Answer B is incorrect because Key Vault private endpoint is intended to keep Key Vault data-plane access on private network paths, which is a different architectural function.

Answer D is incorrect because Key Vault secret is intended to remove application secrets from source code and configuration files, which is a different architectural function.

 

Question 7

When considering Key Vault secret, which requirement supports that choice?

1. To enforce a recovery window even for privileged deletion attempts.
2. To centralize cryptographic key operations and lifecycle management.
3. To apply consistent Azure RBAC-based access control to vault data.
4. To remove application secrets from source code and configuration files.

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault secret stores sensitive string values such as passwords, connection strings, and API keys.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Key Vault purge protection, not Key Vault secret.

Answer B is incorrect because that outcome is more directly associated with Key Vault key, not Key Vault secret.

Answer C is incorrect because that outcome is more directly associated with Key Vault Azure RBAC authorization, not Key Vault secret.

 

Question 8

To keep Key Vault data-plane access on private network paths, which Azure design option should be selected?

1. Azure Key Vault Managed HSM
2. Key Vault key
3. Managed identity for Key Vault access
4. Key Vault private endpoint

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault private endpoint is designed to keep Key Vault data-plane access on private network paths. Key Vault private endpoint provides private IP connectivity to a vault through Azure Private Link.

Incorrect Answers

Answer A is incorrect because Azure Key Vault Managed HSM can be useful in Azure architectures, but its primary role is to protect high-value cryptographic keys when dedicated HSM-backed key custody is required; it is not the best match for the stated priority.

Answer B is incorrect because Key Vault key can be useful in Azure architectures, but its primary role is to centralize cryptographic key operations and lifecycle management; it is not the best match for the stated priority.

Answer C is incorrect because Managed identity for Key Vault access can be useful in Azure architectures, but its primary role is to retrieve secrets or keys securely without embedding application credentials; it is not the best match for the stated priority.

 

Question 9

To centralize application secrets, encryption keys, and certificates in a managed service, which Azure design option should be selected?

1. Key Vault key
2. Azure Key Vault Managed HSM
3. Azure Key Vault
4. Key Vault Azure RBAC authorization

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Key Vault is designed to centralize application secrets, encryption keys, and certificates in a managed service. Azure Key Vault stores and controls access to secrets, keys, and certificates with Azure-integrated authentication, logging, and lifecycle features.

Incorrect Answers

Answer A is incorrect because Key Vault key can be useful in Azure architectures, but its primary role is to centralize cryptographic key operations and lifecycle management; it is not the best match for the stated priority.

Answer B is incorrect because Azure Key Vault Managed HSM can be useful in Azure architectures, but its primary role is to protect high-value cryptographic keys when dedicated HSM-backed key custody is required; it is not the best match for the stated priority.

Answer D is incorrect because Key Vault Azure RBAC authorization can be useful in Azure architectures, but its primary role is to apply consistent Azure RBAC-based access control to vault data; it is not the best match for the stated priority.

 

Question 10

To protect high-value cryptographic keys when dedicated HSM-backed key custody is required, which Azure design option should be selected?

1. Key Vault secret
2. Azure Key Vault Managed HSM
3. Key Vault certificate
4. Key Vault soft delete

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Key Vault Managed HSM is designed to protect high-value cryptographic keys when dedicated HSM-backed key custody is required. Azure Key Vault Managed HSM provides a single-tenant, highly available FIPS-validated managed hardware security module for cryptographic keys.

Incorrect Answers

Answer A is incorrect because Key Vault secret can be useful in Azure architectures, but its primary role is to remove application secrets from source code and configuration files; it is not the best match for the stated priority.

Answer C is incorrect because Key Vault certificate can be useful in Azure architectures, but its primary role is to centralize certificate storage and lifecycle management; it is not the best match for the stated priority.

Answer D is incorrect because Key Vault soft delete can be useful in Azure architectures, but its primary role is to protect against accidental or malicious deletion by enabling recovery; it is not the best match for the stated priority.

 

Question 11

For Key Vault purge protection, which statement is accurate?

1. Provides private IP connectivity to a vault through Azure Private Link.
2. Stores sensitive string values such as passwords, connection strings, and API keys.
3. Stores and controls access to secrets, keys, and certificates with Azure-integrated authentication, logging, and lifecycle features.
4. Prevents permanent deletion of soft-deleted vaults and objects until the retention period expires.

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault purge protection prevents permanent deletion of soft-deleted vaults and objects until the retention period expires.

Incorrect Answers

Answer A is incorrect because that description belongs to Key Vault private endpoint, whose purpose is to keep Key Vault data-plane access on private network paths.

Answer B is incorrect because that description belongs to Key Vault secret, whose purpose is to remove application secrets from source code and configuration files.

Answer C is incorrect because that description belongs to Azure Key Vault, whose purpose is to centralize application secrets, encryption keys, and certificates in a managed service.

 

Question 12

An administrator must not be able to bypass a Key Vault recovery period by immediately purging a deleted object. Which protection should the architect enable?

1. Key Vault purge protection
2. Azure Key Vault
3. Key Vault secret
4. Key Vault private endpoint

Correct Answer: A

 

Correct Answer

Answer A is correct because Key Vault purge protection is designed to enforce a recovery window even for privileged deletion attempts. Key Vault purge protection prevents permanent deletion of soft-deleted vaults and objects until the retention period expires.

Incorrect Answers

Answer B is incorrect because Azure Key Vault can be useful in Azure architectures, but its primary role is to centralize application secrets, encryption keys, and certificates in a managed service; it is not the best match for the stated priority.

Answer C is incorrect because Key Vault secret can be useful in Azure architectures, but its primary role is to remove application secrets from source code and configuration files; it is not the best match for the stated priority.

Answer D is incorrect because Key Vault private endpoint can be useful in Azure architectures, but its primary role is to keep Key Vault data-plane access on private network paths; it is not the best match for the stated priority.

 

Question 13

For Managed identity for Key Vault access, which statement is accurate?

1. Lets an Azure workload authenticate to Key Vault without storing client credentials.
2. Manages X.509 certificates and can automate supported certificate creation or renewal workflows.
3. Stores and controls access to secrets, keys, and certificates with Azure-integrated authentication, logging, and lifecycle features.
4. Stores sensitive string values such as passwords, connection strings, and API keys.

Correct Answer: A

 

Correct Answer

Answer A is correct because Managed identity for Key Vault access lets an Azure workload authenticate to Key Vault without storing client credentials.

Incorrect Answers

Answer B is incorrect because that description belongs to Key Vault certificate, whose purpose is to centralize certificate storage and lifecycle management.

Answer C is incorrect because that description belongs to Azure Key Vault, whose purpose is to centralize application secrets, encryption keys, and certificates in a managed service.

Answer D is incorrect because that description belongs to Key Vault secret, whose purpose is to remove application secrets from source code and configuration files.

 

Question 14

To apply consistent Azure RBAC-based access control to vault data, which Azure design option should be selected?

1. Azure Key Vault
2. Key Vault private endpoint
3. Key Vault soft delete
4. Key Vault Azure RBAC authorization

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault Azure RBAC authorization is designed to apply consistent Azure RBAC-based access control to vault data. Key Vault Azure RBAC authorization uses Azure role assignments to control management-plane and supported data-plane access to vault contents.

Incorrect Answers

Answer A is incorrect because Azure Key Vault can be useful in Azure architectures, but its primary role is to centralize application secrets, encryption keys, and certificates in a managed service; it is not the best match for the stated priority.

Answer B is incorrect because Key Vault private endpoint can be useful in Azure architectures, but its primary role is to keep Key Vault data-plane access on private network paths; it is not the best match for the stated priority.

Answer C is incorrect because Key Vault soft delete can be useful in Azure architectures, but its primary role is to protect against accidental or malicious deletion by enabling recovery; it is not the best match for the stated priority.

 

Question 15

An enterprise architect needs to centralize application secrets, encryption keys, and certificates in a managed service. Which Azure service or capability is the best fit?

1. Key Vault key
2. Azure Key Vault
3. Key Vault Azure RBAC authorization
4. Azure Key Vault Managed HSM

Correct Answer: B

 

Correct Answer

Answer B is correct because Azure Key Vault stores and controls access to secrets, keys, and certificates with Azure-integrated authentication, logging, and lifecycle features. It directly meets the requirement to centralize application secrets, encryption keys, and certificates in a managed service.

Incorrect Answers

Answer A is incorrect because Key Vault key is used to centralize cryptographic key operations and lifecycle management; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Key Vault Azure RBAC authorization is used to apply consistent Azure RBAC-based access control to vault data; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Azure Key Vault Managed HSM is used to protect high-value cryptographic keys when dedicated HSM-backed key custody is required; that does not directly satisfy the requirement in this scenario.

 

Question 16

When considering Azure Key Vault Managed HSM, which requirement supports that choice?

1. To protect against accidental or malicious deletion by enabling recovery.
2. To remove application secrets from source code and configuration files.
3. To protect high-value cryptographic keys when dedicated HSM-backed key custody is required.
4. To centralize certificate storage and lifecycle management.

Correct Answer: C

 

Correct Answer

Answer C is correct because Azure Key Vault Managed HSM provides a single-tenant, highly available FIPS-validated managed hardware security module for cryptographic keys.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Key Vault soft delete, not Azure Key Vault Managed HSM.

Answer B is incorrect because that outcome is more directly associated with Key Vault secret, not Azure Key Vault Managed HSM.

Answer D is incorrect because that outcome is more directly associated with Key Vault certificate, not Azure Key Vault Managed HSM.

 

Question 17

When considering Key Vault private endpoint, which requirement supports that choice?

1. To keep Key Vault data-plane access on private network paths.
2. To centralize cryptographic key operations and lifecycle management.
3. To retrieve secrets or keys securely without embedding application credentials.
4. To protect high-value cryptographic keys when dedicated HSM-backed key custody is required.

Correct Answer: A

 

Correct Answer

Answer A is correct because Key Vault private endpoint provides private IP connectivity to a vault through Azure Private Link.

Incorrect Answers

Answer B is incorrect because that outcome is more directly associated with Key Vault key, not Key Vault private endpoint.

Answer C is incorrect because that outcome is more directly associated with Managed identity for Key Vault access, not Key Vault private endpoint.

Answer D is incorrect because that outcome is more directly associated with Azure Key Vault Managed HSM, not Key Vault private endpoint.

 

Question 18

For Key Vault secret, which statement is accurate?

1. Stores cryptographic keys that can be used for encryption, signing, wrapping, and related cryptographic operations.
2. Stores sensitive string values such as passwords, connection strings, and API keys.
3. Prevents permanent deletion of soft-deleted vaults and objects until the retention period expires.
4. Uses Azure role assignments to control management-plane and supported data-plane access to vault contents.

Correct Answer: B

 

Correct Answer

Answer B is correct because Key Vault secret stores sensitive string values such as passwords, connection strings, and API keys.

Incorrect Answers

Answer A is incorrect because that description belongs to Key Vault key, whose purpose is to centralize cryptographic key operations and lifecycle management.

Answer C is incorrect because that description belongs to Key Vault purge protection, whose purpose is to enforce a recovery window even for privileged deletion attempts.

Answer D is incorrect because that description belongs to Key Vault Azure RBAC authorization, whose purpose is to apply consistent Azure RBAC-based access control to vault data.

 

Question 19

For Key Vault key, which statement is accurate?

1. Stores cryptographic keys that can be used for encryption, signing, wrapping, and related cryptographic operations.
2. Manages X.509 certificates and can automate supported certificate creation or renewal workflows.
3. Retains deleted vaults and vault objects for a configured retention period so they can be recovered.
4. Provides private IP connectivity to a vault through Azure Private Link.

Correct Answer: A

 

Correct Answer

Answer A is correct because Key Vault key stores cryptographic keys that can be used for encryption, signing, wrapping, and related cryptographic operations.

Incorrect Answers

Answer B is incorrect because that description belongs to Key Vault certificate, whose purpose is to centralize certificate storage and lifecycle management.

Answer C is incorrect because that description belongs to Key Vault soft delete, whose purpose is to protect against accidental or malicious deletion by enabling recovery.

Answer D is incorrect because that description belongs to Key Vault private endpoint, whose purpose is to keep Key Vault data-plane access on private network paths.

 

Question 20

To remove application secrets from source code and configuration files, which Azure design option should be selected?

1. Key Vault key
2. Key Vault secret
3. Key Vault Azure RBAC authorization
4. Key Vault purge protection

Correct Answer: B

 

Correct Answer

Answer B is correct because Key Vault secret stores sensitive string values such as passwords, connection strings, and API keys. It directly meets the requirement to remove application secrets from source code and configuration files.

Incorrect Answers

Answer A is incorrect because Key Vault key is used to centralize cryptographic key operations and lifecycle management; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Key Vault Azure RBAC authorization is used to apply consistent Azure RBAC-based access control to vault data; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Key Vault purge protection is used to enforce a recovery window even for privileged deletion attempts; that does not directly satisfy the requirement in this scenario.

 

Question 21

To centralize certificate storage and lifecycle management, which Azure design option should be selected?

1. Managed identity for Key Vault access
2. Key Vault certificate
3. Key Vault Azure RBAC authorization
4. Key Vault purge protection

Correct Answer: B

 

Correct Answer

Answer B is correct because Key Vault certificate manages X.509 certificates and can automate supported certificate creation or renewal workflows. It directly meets the requirement to centralize certificate storage and lifecycle management.

Incorrect Answers

Answer A is incorrect because Managed identity for Key Vault access is used to retrieve secrets or keys securely without embedding application credentials; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Key Vault Azure RBAC authorization is used to apply consistent Azure RBAC-based access control to vault data; that does not directly satisfy the requirement in this scenario.

Answer D is incorrect because Key Vault purge protection is used to enforce a recovery window even for privileged deletion attempts; that does not directly satisfy the requirement in this scenario.

 

Question 22

To centralize cryptographic key operations and lifecycle management, which Azure design option should be selected?

1. Key Vault certificate
2. Key Vault key
3. Key Vault private endpoint
4. Key Vault soft delete

Correct Answer: B

 

Correct Answer

Answer B is correct because Key Vault key is designed to centralize cryptographic key operations and lifecycle management. Key Vault key stores cryptographic keys that can be used for encryption, signing, wrapping, and related cryptographic operations.

Incorrect Answers

Answer A is incorrect because Key Vault certificate can be useful in Azure architectures, but its primary role is to centralize certificate storage and lifecycle management; it is not the best match for the stated priority.

Answer C is incorrect because Key Vault private endpoint can be useful in Azure architectures, but its primary role is to keep Key Vault data-plane access on private network paths; it is not the best match for the stated priority.

Answer D is incorrect because Key Vault soft delete can be useful in Azure architectures, but its primary role is to protect against accidental or malicious deletion by enabling recovery; it is not the best match for the stated priority.

 

Question 23

When considering Managed identity for Key Vault access, which requirement supports that choice?

1. To centralize certificate storage and lifecycle management.
2. To centralize application secrets, encryption keys, and certificates in a managed service.
3. To retrieve secrets or keys securely without embedding application credentials.
4. To remove application secrets from source code and configuration files.

Correct Answer: C

 

Correct Answer

Answer C is correct because Managed identity for Key Vault access lets an Azure workload authenticate to Key Vault without storing client credentials.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Key Vault certificate, not Managed identity for Key Vault access.

Answer B is incorrect because that outcome is more directly associated with Azure Key Vault, not Managed identity for Key Vault access.

Answer D is incorrect because that outcome is more directly associated with Key Vault secret, not Managed identity for Key Vault access.

 

Question 24

An organization wants to centralize cryptographic key operations and lifecycle management. Which design choice most directly meets the requirement?

1. Key Vault soft delete
2. Key Vault certificate
3. Key Vault private endpoint
4. Key Vault key

Correct Answer: D

 

Correct Answer

Answer D is correct because Key Vault key stores cryptographic keys that can be used for encryption, signing, wrapping, and related cryptographic operations. It directly meets the requirement to centralize cryptographic key operations and lifecycle management.

Incorrect Answers

Answer A is incorrect because Key Vault soft delete is used to protect against accidental or malicious deletion by enabling recovery; that does not directly satisfy the requirement in this scenario.

Answer B is incorrect because Key Vault certificate is used to centralize certificate storage and lifecycle management; that does not directly satisfy the requirement in this scenario.

Answer C is incorrect because Key Vault private endpoint is used to keep Key Vault data-plane access on private network paths; that does not directly satisfy the requirement in this scenario.

 

Question 25

When considering Key Vault soft delete, which requirement supports that choice?

1. To retrieve secrets or keys securely without embedding application credentials.
2. To protect high-value cryptographic keys when dedicated HSM-backed key custody is required.
3. To protect against accidental or malicious deletion by enabling recovery.
4. To enforce a recovery window even for privileged deletion attempts.

Correct Answer: C

 

Correct Answer

Answer C is correct because Key Vault soft delete retains deleted vaults and vault objects for a configured retention period so they can be recovered.

Incorrect Answers

Answer A is incorrect because that outcome is more directly associated with Managed identity for Key Vault access, not Key Vault soft delete.

Answer B is incorrect because that outcome is more directly associated with Azure Key Vault Managed HSM, not Key Vault soft delete.

Answer D is incorrect because that outcome is more directly associated with Key Vault purge protection, not Key Vault soft delete.