AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database with Transparent Data Encryption (TDE) and wants to use a customer-managed key (CMK) stored in Azure Key Vault. The security policy requires that the Key Vault be protected by a firewall and virtual network service endpoints to restrict network access. The storage account for TDE logs is in the same Azure region. Which additional configuration is necessary in the Key Vault to allow Azure SQL Database to access the CMK for encryption operations?
⚠ Common exam trap
Candidates often confuse network-level access controls (firewall rules) with authorization (RBAC or access policies), leading them to select Option D, which addresses permissions but not the network restriction imposed by the Key Vault firewall.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.
Azure SQL Database uses TDE with CMK stored in Azure Key Vault, and when the Key Vault firewall is enabled with virtual network service endpoints, Azure SQL Database must be able to bypass the firewall to retrieve the key. The 'Allow trusted Microsoft services to bypass this firewall' setting permits Azure services like Azure SQL Database, which are considered trusted by Microsoft, to access the Key Vault even when network restrictions are in place. This is the only configuration that satisfies the security policy while enabling the necessary encryption operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Add a network rule in the Key Vault firewall allowing the public IP range of the Azure SQL Database server.
Why it's wrong here
Adding an IP rule in the Key Vault firewall for Azure SQL Database's public IP range is ineffective because Azure SQL Database does not publish a fixed, stable outbound IP range; its public IP addresses can change and vary by region and deployment. Furthermore, the Key Vault firewall's IP rules are intended for client IP addresses, not for service-to-service traffic from platform services like SQL Database. The correct mechanism is to use the 'Allow trusted Microsoft services' bypass, which lets SQL Database's managed identity authenticate and retrieve the key without relying on IP-based allowlisting.
- ✓
Enable the 'Allow trusted Microsoft services to bypass this firewall' option in the Key Vault networking settings.
Why this is correct
Enabling 'Allow trusted Microsoft services to bypass this firewall' is the correct solution because Azure SQL Database is a trusted Microsoft service and its managed identity can authenticate to the Key Vault using Azure AD, then fetch the encryption key for TDE. With this setting, the Key Vault firewall remains enabled for public internet traffic, but Azure services like SQL Database are permitted to bypass the IP restrictions. This is the intended pattern for TDE with customer-managed keys, as SQL Database runs outside your virtual network and its outbound IPs cannot be reliably scoped.
- ✗
Create a private endpoint for the Key Vault and connect it to the same virtual network as the Azure SQL Database.
Why it's wrong here
While a private endpoint is secure, it does not grant access to Azure SQL Database as it runs outside the virtual network. SQL Database is a platform service; it would need a private endpoint as well, or use the trusted services bypass.
- ✗
Configure the Key Vault to use role-based access control (RBAC) and assign the 'Key Vault Crypto Service Encryption User' role to the SQL Database server's managed identity.
Why it's wrong here
RBAC is used for authorization (who can access the key), but the networking firewall still blocks the traffic. The network bypass is required to allow the SQL Database service to reach the Key Vault over the internet.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.