Microsoft Azure Security Engineer Associate AZ-500 Practice Question

To upload a new value for an existing secret, the only permission required is Set. The Get permission returns the secret value, which must be blocked. Assigning any key permission (such as Sign or Get) would let the group access or use the RSA key, violating the requirement. Granting Set on secrets while leaving key permissions empty therefore provides the minimum access necessary.

Incorrect choices either expose secret values, permit key usage, or include extra permissions that exceed the stated need.