Question 349 of 194
AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall that blocks all public access. The SQL server is a managed service that needs to access the key to perform TDE operations. The Key Vault is in the same Azure region as the SQL server. Which additional configuration is needed?
⚠ Common exam trap
A common mix-up: candidates assume a private endpoint or service endpoint is always required for secure access, but for PaaS services like Azure SQL Database that use managed identities, the 'Allow trusted Microsoft services' setting is the simplest and correct solution when the Key Vault firewall blocks public access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings
When Azure Key Vault has a firewall that blocks all public access, Azure services like SQL Database that need to access the key for TDE operations must be explicitly allowed. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits the SQL server's managed service identity to authenticate and retrieve the CMK from Key Vault, even when public network access is denied. This setting is required because the SQL server, as a platform-as-a-service (PaaS) resource, does not reside in a virtual network by default and cannot use a private endpoint or service endpoint without additional networking configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable 'Allow trusted Microsoft services to bypass this firewall' in the Key Vault firewall settings
Why this is correct
The Key Vault firewall blocks all data plane access by default, which would break TDE key operations. Enabling 'Allow trusted Microsoft services to bypass this firewall' explicitly authorizes Azure SQL Database (as a trusted Microsoft service) to reach the vault for wrap/unwrap operations, provided the SQL server's managed identity is also granted the correct RBAC role or access policy. This is the standard configuration when using customer-managed keys for TDE on Azure SQL Database while the vault firewall is turned on.
- ✗
Configure a service endpoint for Microsoft.KeyVault on the SQL server's subnet
Why it's wrong here
A service endpoint for Microsoft.KeyVault on the SQL server's subnet extends VNet connectivity to the Key Vault service, but Azure SQL Database is a PaaS service that is not deployed inside that subnet. The key access flow is from the SQL service to the Key Vault, not from the VNet, so this setting does nothing to authorize the SQL server's identity at the Key Vault's data plane. Service endpoints also do not replace the need for an identity-based permission; they only provide network-level routing, so this option misidentifies the networking mechanism required.
- ✗
Assign the SQL server's server identity the 'Contributor' role on the Key Vault
Why it's wrong here
The 'Contributor' role on Key Vault grants control-plane permissions—such as managing the vault's configuration—but not data-plane permissions to perform cryptographic operations like wrapKey and unwrapKey, which TDE requires. To use a key for TDE, the SQL server's identity must be assigned the 'Key Vault Crypto Service Encryption User' role (or an access policy with those specific cryptographic permissions). Moreover, even with a role assignment, the Key Vault firewall would still block the SQL Database service unless the trusted services exception is also enabled, so Contributor alone is insufficient.
- ✗
Create a private endpoint for the Key Vault in the SQL server's virtual network
Why it's wrong here
A private endpoint would allow access from a specific VNet, but SQL Database is not deployed in a VNet by default; you would need to use Azure SQL Managed Instance or integrate with VNet. For a regular SQL Database, this is not straightforward and the trusted services exception is the standard solution.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.