Azure Key Vault Functions for SC-900

Answer Correct answer: A, E — Azure Key Vault allows you to store secrets and manage encryption keys securely.

Which two actions can you perform by using Azure Key Vault? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Store secrets. Correct Answer
Store Azure Resource Manager (ARM) templates.
Implement network security groups (NSGs).
Implement Azure DDoS Protection.
Store keys. Correct Answer

azure key vault secrets azure key vault keys sc-900 key vault questions azure key vault vs arm templates

Community Votes

100%

100% of anonymous learners picked answer AE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests your ability to distinguish between secret management services and infrastructure-as-code storage or network security controls.

Azure Key Vault is a cloud service for securely storing and accessing secrets, keys, and certificates. This question tests the core capabilities of Key Vault versus general Azure resource management tools.

Learners often confuse Key Vault with Azure Blob Storage or Git repositories for storing ARM templates, or mix it up with Network Watcher for DDoS protection.

Community Discussion (3 comments)

KindFlame 👍 1 Selected: AE

Correct A. Store secrets E. Store keys https://learn.microsoft.com/en-us/azure/key-vault/general/overview

IT_Security_Team 👍 1 Selected: AE

Store Azure Resource Manager (ARM) templates means saving the configuration files (in JSON or Bicep format) that describe the infrastructure and resources you want to deploy in Azure. These templates define what resources (like virtual machines, databases, networks) to create and how they should be set up. However, Azure Key Vault does not store ARM templates. ARM templates are typically stored in places like Azure Storage or source control systems (e.g., GitHub), not in Key Vault, as Key Vault is focused on securely storing secrets, keys, and certificates.

LegendaryZA 👍 3 Selected: AE

Answer: Store Secrets Store Keys https://learn.microsoft.com/en-us/azure/key-vault/general/overview

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Azure Key Vault is specifically designed to protect cryptographic keys and other secrets, such as passwords and API keys, used by cloud apps and services. The primary functions include storing secrets (Option A) and managing encryption keys (Option E). These are the fundamental pillars of the service, allowing developers to avoid hardcoding sensitive data in their applications.

Why the Other Options Are Wrong

Azure Resource Manager (ARM) templates are configuration files used for deploying resources; they should be stored in source control like GitHub, not Key Vault (Option B). Network Security Groups (NSGs) are virtual network firewalls managed via the Azure Networking service, not Key Vault (Option C). Azure DDoS Protection is a separate dedicated service under Azure Networking that protects against distributed denial-of-service attacks (Option D).

Community Comment Notes

The community consensus strongly supports options A and E. Commenters frequently cite the official Microsoft documentation overview page which explicitly lists "secrets" and "keys" as the two main categories of data stored in Key Vault. There is no significant disagreement in the comments regarding these selections.

Official Reference

https://learn.microsoft.com/en-us/azure/key-vault/general/overview

Exam Strategy

When asked about Azure services, identify the specific category of the solution (e.g., Identity, Networking, Compute). For Key Vault, always associate it immediately with 'Secrets', 'Keys', and 'Certificates'. If an option relates to deployment templates or network traffic filtering, it is likely incorrect.

Frequently Asked Questions

Can I store ARM templates in Azure Key Vault?

No. ARM templates should be stored in version control systems like GitHub or Azure DevOps. Key Vault is for sensitive data, not infrastructure code.

Does Key Vault provide DDoS protection?

No. DDoS protection is handled by Azure DDoS Protection Standard, a networking service. Key Vault focuses on secret and key management.

Related Analysis

Practice All SC-900 Questions

Access 141 questions with complete answers and detailed explanations.

View Full SC-900 Practice Test →

← Back to SC-900 Study Guide