Microsoft Azure Security Technologies (AZ-500)

What option should you use to delegate advanced access policies for an Azure key vault based on the principle of least privilege?

1. Azure Information Protection

2. RBAC

3. Azure AD Privileged Identity Management (PIM)

4. Azure DevOps

The correct answer is: RBAC

Using Role-Based Access Control (RBAC) is an effective way to delegate advanced access policies for an Azure Key Vault in alignment with the principle of least privilege. RBAC enables you to assign specific roles to users, groups, or applications, granting them only the permissions they need to perform their tasks and denying any additional permissions beyond that. In the context of an Azure Key Vault, RBAC allows you to define access at a granular level, such as who can create, read, update, or delete secrets, keys, and certificates stored in the vault. By implementing RBAC, you ensure that users have only the necessary access needed for their roles, which minimizes the risk of exposing sensitive data or resources unnecessarily. This model is particularly useful in environments with multiple users or applications requiring different levels of access, as it provides a clear and manageable way to control security permissions without broad access rights. Consequently, RBAC aligns perfectly with the principle of least privilege, enhancing overall security posture for Azure resources, including Key Vaults.