AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database with Transparent Data Encryption (TDE) protected by a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server is a Microsoft service. How can the SQL server be granted access to the key vault to perform TDE operations?
⚠ Common exam trap
Many candidates think a private endpoint is required for PaaS services to access a firewalled Key Vault, but they overlook that Azure SQL Database is a trusted Microsoft service that can bypass the firewall with the appropriate setting, and that a private endpoint would require the SQL server to be network-integrated, which it is not by default.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault
Azure Key Vault's firewall includes a setting to 'Allow trusted Microsoft services to bypass this firewall.' Azure SQL Database is a trusted Microsoft service, so enabling this setting allows the SQL server to authenticate to Key Vault using its system-assigned managed identity to retrieve the customer-managed key for TDE operations, without needing to disable the firewall or create a private endpoint.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint on the Key Vault for the SQL server
Why it's wrong here
While a private endpoint on the Key Vault could provide a secure network path, it requires additional configuration beyond the SQL server's scope: the server must resolve the vault's private DNS and route traffic through a virtual network, which is not a default behavior for Azure SQL Database. Moreover, the Key Vault firewall would still need to explicitly allow that private endpoint connection, and enabling the trusted services bypass achieves the same secure access with far less complexity and no networking prerequisites.
- ✗
Disable the Key Vault firewall
Why it's wrong here
Disabling the Key Vault firewall removes the network-level access controls entirely, setting the default action to 'Allow' for all source IPs. This exposes the vault to any internet user who has valid credentials or tokens, significantly expanding the attack surface for unauthorized attempts to retrieve the TDE protector encryption keys. It violates the security requirement by sacrificing network security for the sake of connectivity, whereas a targeted bypass rule can grant access only to trusted Microsoft services.
- ✓
Enable the 'Allow trusted Microsoft services to bypass the firewall' setting on the Key Vault
Why this is correct
This setting permits Azure Key Vault to accept requests from Azure SQL Database and other first-party Microsoft services even when the firewall is enabled, without opening the vault to public internet traffic. The service's request originates from Azure's internal infrastructure, and the firewall bypass is combined with strict identity-based authorization via the SQL server's managed identity and access policies. It directly addresses the network-layer restriction for TDE operations while keeping the vault protected against all other external clients.
- ✗
Assign the SQL server a system-assigned managed identity and grant it access to the key vault
Why it's wrong here
Assigning a system-assigned managed identity and granting it key permissions only satisfies the authentication and authorization layer — it does not influence the Key Vault firewall's network-layer evaluation. The firewall will drop the SQL server's request before the access policy is ever consulted unless a matching network rule (such as a virtual network rule or IP rule) or the trusted services bypass is also configured. Thus, while this setup is a required component for TDE, it is insufficient by itself to overcome the existing firewall block.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.