Microsoft Azure Security Engineer Associate AZ-500 Practice Question

The policy requires developers to do the following in their own resource group:

1. Read all control-plane metadata, including Key Vault objects. That requires the Microsoft.KeyVault//read* data action, so the role must include DataActions.
2. Create or modify resources except those with data actions; that is covered by Actions such as Microsoft.Resources/subscriptions/resourceGroups/.*
3. The role must not allow data write on Key Vault objects, so NotDataActions must explicitly deny Microsoft.KeyVault//write*.

Therefore, the custom role must contain:

• Actions to allow standard management operations.
• DataActions to let users read data plane items such as Key Vault secrets.
• NotDataActions to block data plane write operations. The AssignableScopes property is mandatory for any custom role, but it does not control the kinds of permissions; it simply states where the role can be assigned. Including only Actions and AssignableScopes would prevent access to Key Vault data. Including Actions plus NotActions still would not expose Key Vault secrets. Adding DataActions without also using NotDataActions would permit writes as well as reads on data plane objects.

Thus the correct option is the set that combines Actions, DataActions, and NotDataActions, with AssignableScopes.