Azure Key Vault Functions for SC-900
Short answer
AE Azure Key Vault allows you to store secrets and manage encryption keys securely.
Question
Key Takeaways
The exam tests your ability to distinguish between secret management services and infrastructure-as-code storage or network security controls.
Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. This question tests the core capabilities of Key Vault versus general Azure resource management tools.
Common mistake: Learners often confuse Key Vault with Azure Blob Storage or Git repositories for storing ARM templates, or mix it up with Network Watcher for DDoS protection.
Expert Analysis
Why the Answer Is Correct
Azure Key Vault is specifically designed to protect cryptographic keys and other secrets, such as passwords and API keys, used by cloud apps and services. The primary functions include storing secrets (Option A) and managing encryption keys (Option E). These are the fundamental pillars of the service, allowing developers to avoid hardcoding sensitive data in their applications.
Why the Other Options Are Wrong
Azure Resource Manager (ARM) templates are configuration files used for deploying resources; they should be stored in source control like GitHub, not Key Vault (Option B). Network Security Groups (NSGs) are virtual network firewalls managed via the Azure Networking service, not Key Vault (Option C). Azure DDoS Protection is a separate dedicated service under Azure Networking that protects against distributed denial-of-service attacks (Option D).
Community Comment Notes
The community consensus strongly supports options A and E. Commenters frequently cite the official Microsoft documentation overview page which explicitly lists "secrets" and "keys" as the two main categories of data stored in Key Vault. There is no significant disagreement in the comments regarding these selections.
Official Reference
https://learn.microsoft.com/en-us/azure/key-vault/general/overview
This link opens the official vendor documentation in a new tab.
Exam Strategy
When asked about Azure services, identify the specific category of the solution (e.g., Identity, Networking, Compute). For Key Vault, always associate it immediately with 'Secrets', 'Keys', and 'Certificates'. If an option relates to deployment templates or network traffic filtering, it is likely incorrect.
Frequently Asked Questions
Can I store ARM templates in Azure Key Vault?
Does Key Vault provide DDoS protection?
Community Votes
100% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
LegendaryZA 👍 3Answer: Store Secrets Store Keys https://learn.microsoft.com/en-us/azure/key-vault/general/overview
-
IT_Security_Team 👍 1Store Azure Resource Manager (ARM) templates means saving the configuration files (in JSON or Bicep format) that describe the infrastructure and resources you want to deploy in Azure. These templates define what resources (like virtual machines, databases, networks) to create and how they should be set up. However, Azure Key Vault does not store ARM templates. ARM templates are typically stored in places like Azure Storage or source control systems (e.g., GitHub), not in Key Vault, as Key Vault is focused on securely storing secrets, keys, and certificates.
-
KindFlame 👍 1Correct A. Store secrets E. Store keys https://learn.microsoft.com/en-us/azure/key-vault/general/overview
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SC-900 Questions
Access 141 questions with complete answers and detailed explanations.
View Full SC-900 Practice Test →