A meadowlark-count teammate begins designing private-endpoint hub-and-spoke plus Managed HSM pools for a simple app secret read. What scope matches AZ-204 Domain 3 for Key Vault?
Select an answer to reveal the explanation.
Short Explanation
AZ-204 asks whether the app can read secrets/keys/certs—not whether you designed an HSM fleet with hub-and-spoke private endpoints. That deeper security-engineer territory is AZ-500.
Full Explanation
AZ-204 Domain 3 expects developers to read secrets, keys, and certificates from Key Vault in application code—clients, credentials, references, and basic permissions. Designing private-endpoint hub-and-spoke topologies plus Managed HSM fleets for a simple meadowlark-count secret read overshoots into AZ-500-style security engineering. Stay on the app's GetSecret, GetKey, and GetCertificate path and identity grants.
Making Defender for Cloud secure-score playbooks the primary vault client fails the developer skill: secure score guides posture; it does not replace SecretClient in your Function. Focusing on Microsoft Sentinel analytics rules as a SecretClient replacement fails similarly—Sentinel is SIEM analytics, not the app's secret retrieval library. Cataloging subscription Owner roles unrelated to the app identity misses least privilege: Owner is a control-plane hammer, not the data-plane secret permission the meadowlark service principal needs.
Exam caveat: network isolation and HSM are real Azure capabilities, but exam items that only ask how the app reads a secret grade the SDK and identity story, not hub design. Operational check: implement secret read with managed identity and Secrets User on a standard vault, document that private endpoints are optional hardening tracked separately, and keep AZ-500 network diagrams out of the AZ-204 acceptance checklist for this feature.