Question 78 of 194
AZ-500 Secure compute, storage, and databases Practice Question
A company uses Azure SQL Database with Transparent Data Encryption (TDE) using a customer-managed key (CMK) stored in Azure Key Vault. The Key Vault has a firewall enabled that denies all public network access. The SQL server has a system-assigned managed identity assigned the 'Key Vault Crypto Service Encryption User' role. However, TDE operations are failing because the SQL server cannot access the Key Vault. What additional configuration is needed?
⚠ Common exam trap
Many candidates assume a private endpoint is required for any cross-service communication when firewalls are involved, but Azure's 'Allow trusted Microsoft services' exception is a simpler, first-line configuration that enables necessary platform-level access without exposing the Key Vault to the internet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable the Key Vault firewall to allow trusted Microsoft services
When Azure Key Vault has its firewall enabled to deny all public network access, it blocks all traffic, including requests from Azure SQL Database. By enabling the 'Allow trusted Microsoft services' exception, Azure Key Vault permits specific Azure platform services (like Azure SQL Database) to bypass the firewall, provided the service authenticates using a managed identity with appropriate permissions. This setting is essential for TDE with CMK because the SQL server's system-assigned managed identity must reach the Key Vault to unwrap the encryption key, even when public access is disabled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable the Key Vault firewall to allow trusted Microsoft services
Why this is correct
Azure SQL Database TDE with customer-managed keys requires SQL to access Key Vault for key wrap and unwrap operations. The Key Vault firewall blocks public access, but the 'Allow trusted Microsoft services' exception lets Azure SQL's underlying service bypass the firewall for these cryptographic operations, using the SQL server's managed identity. This is the only network change needed while keeping public access blocked.
- ✗
Create a private endpoint for the SQL server to access the Key Vault
Why it's wrong here
A private endpoint on the SQL server would provide a private IP for connecting to Azure services, but it does not, by itself, allow SQL to bypass the Key Vault firewall unless a corresponding private endpoint is also provisioned on the Key Vault resource. Additionally, the trusted Microsoft services exception already provides the necessary access without the complexity of private DNS resolution and endpoint configuration, making this option an unnecessary overengineering.
- ✗
Enable public network access on the Key Vault
Why it's wrong here
Enabling public network access on the Key Vault disables the firewall entirely, exposing the vault to all internet traffic. This directly violates the requirement to block public access and introduces significant security risk. The correct approach is to keep the firewall enabled and add only the 'Allow trusted Microsoft services' exception, which restricts access to Microsoft's trusted services rather than the entire internet.
- ✗
Assign the SQL server's managed identity the 'Reader' role on the Key Vault
Why it's wrong here
The SQL server's managed identity already holds the cryptographic permissions needed for TDE through the Key Vault Crypto Service Encryption User role, which permits wrap and unwrap key operations. Assigning the 'Reader' role would only grant read-only metadata access to the vault, not the ability to use the key, so it fails to address the connectivity issue. The actual blocker is the Key Vault firewall, not missing RBAC permissions.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.