AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database with Transparent Data Encryption (TDE) and a customer-managed key stored in Azure Key Vault. The Key Vault is configured with a firewall that denies all public access. The SQL server must be able to access the key. What additional configuration is necessary?
⚠ Common exam trap
A common mix-up: candidates confuse the authentication/authorization step (assigning managed identity) with the network connectivity step (firewall bypass), assuming that granting permissions alone is sufficient when the Key Vault firewall is blocking all traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable trusted Microsoft services on the Key Vault firewall
When Azure Key Vault's firewall denies all public access, enabling 'Allow trusted Microsoft services' is necessary because Azure SQL Database's TDE key retrieval is considered a trusted service operation. This setting bypasses the firewall for specific Azure services like SQL Database that are authenticated and authorized to access the vault, without requiring a private endpoint or service endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable trusted Microsoft services on the Key Vault firewall
Why this is correct
Enabling “Allow trusted Microsoft services to bypass this firewall” on the Key Vault is the correct fix because Azure SQL Database’s TDE key fetches originate from Microsoft’s PaaS infrastructure and, with this setting, those requests are exempted from the Key Vault firewall even when all public network access is otherwise blocked. This setting must be combined with the SQL server’s managed identity being granted the required key permissions, but without it, firewall rules alone would continue to reject the TDE key-wrap and unwrap calls.
- ✗
Create a private endpoint for Key Vault
Why it's wrong here
A private endpoint for Key Vault enables private network connectivity, but the scenario’s firewall already denies all public access, so the SQL server’s access failure is not caused by a network path issue—it is caused by the absence of a Key Vault access policy or Microsoft Entra ID authentication granting the SQL server’s managed identity explicit cryptographic permissions. This option is tempting because private endpoints are commonly used to secure Key Vault traffic from public networks, and would be correct if the firewall were the sole barrier to connectivity rather than a missing authorisation layer.
- ✗
Assign the SQL server's managed identity to the Key Vault
Why it's wrong here
Assigning the SQL server’s managed identity to the Key Vault only establishes the necessary authorization plane—it creates the access policy and grants get/wrapKey/unwrapKey permissions—so that Key Vault recognizes the identity as a valid caller. It does not modify the Key Vault firewall, and because that firewall is currently rejecting all traffic unless explicitly allowed, the SQL Database cannot even reach Key Vault to present those credentials. The missing network-level allowance must be addressed separately, either through the trusted Microsoft services bypass or a private endpoint/pertinent firewall rule.
- ✗
Configure a service endpoint on the SQL server
Why it's wrong here
Configuring a service endpoint on the SQL server misunderstands the direction of connectivity: service endpoints apply to client subnets in a virtual network connecting to Azure PaaS services, and Azure SQL Database is itself a PaaS service that does not attach to a VNet for outbound calls to Key Vault. A SQL server logical server cannot have a service endpoint for its own outbound access to another service; service endpoints and VNet rules are instead used to control which VNet clients can connect to SQL Database. Therefore, this option would not affect Key Vault’s firewall or provide SQL Database with any path to the TDE encryption key.
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.