AZ-204 Implement Azure security Practice Question
Your company has an application running on Azure Virtual Machines that needs to access secrets in Azure Key Vault. You want to restrict network access to the Key Vault so that only the virtual network/subnet containing the VMs can reach it. You also want to ensure that the solution works with the least management overhead. Which configuration should you use?
⚠ Common exam trap
Candidates often confuse Private Endpoints with service endpoints, assuming Private Endpoints are always the best choice for network isolation, but service endpoints are simpler and have less management overhead when you only need to restrict access to a specific virtual network/subnet without requiring private IP connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Key Vault firewall to allow access from the virtual network and subnet using service endpoints.
Configuring Key Vault firewall with virtual network service endpoints allows you to restrict access to the Key Vault to a specific virtual network and subnet without exposing the VMs to the internet. This approach leverages Azure's backbone network for traffic, providing secure and direct connectivity with minimal management overhead, as service endpoints are automatically maintained by Azure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Key Vault firewall with IP-based rules that allow the VM's public IP address.
Why it's wrong here
Relying on a VM's public IP address for Key Vault firewall rules is generally insecure and not recommended for production environments. Public IP addresses can change if the VM is deallocated and reallocated, requiring constant updates to the firewall rules. More critically, this approach still routes traffic over the public internet, even if filtered, failing to leverage the secure, private network boundary of an Azure Virtual Network.
- ✗
Configure a Private Endpoint for the Key Vault in the same virtual network as the VMs.
Why it's wrong here
While a Private Endpoint is a highly secure and robust solution that brings the Key Vault into the virtual network using a private IP address, it introduces additional configuration complexity. Specifically, it requires proper setup of Private DNS zones to resolve the Key Vault's FQDN to its private IP, which is a more involved process than simply enabling service endpoints for direct VNet access. For a straightforward VNet-to-Key Vault connection, service endpoints offer a simpler, yet secure, alternative.
- ✓
Configure Key Vault firewall to allow access from the virtual network and subnet using service endpoints.
Why this is correct
Configuring Key Vault firewall to allow access from a specific virtual network and subnet using service endpoints is the most appropriate and secure solution for this scenario. Service endpoints extend the virtual network's identity to the Azure Key Vault service, allowing traffic to flow directly over the Azure backbone network rather than the public internet. This approach is straightforward to implement, ensuring that only resources within the designated subnet can access the Key Vault, thus providing robust network isolation.
- ✗
Use a shared access signature (SAS) to access Key Vault secrets.
Why it's wrong here
Shared Access Signatures (SAS) are a security mechanism specifically designed for granting limited, time-bound access to resources within Azure Storage accounts, such as blobs, files, queues, or tables. They are fundamentally incompatible with Azure Key Vault, which relies on Microsoft Entra ID for authentication and authorization, utilizing either Key Vault access policies or Azure role-based access control (RBAC) to manage permissions to secrets, keys, and certificates.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.