Azure Key Vault Network Restrictions Using Private Endpoint or Selected Networks
A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?
Quick Answer
The answer is to use firewall and virtual network restrictions, specifically by configuring private endpoints or selected networks. This is correct because private endpoints leverage Azure Private Link to assign the Key Vault a private IP within a virtual network, ensuring traffic never traverses the public internet, while selected networks use firewall rules to permit only specified IP ranges or VNets and approved Azure services, effectively blocking all other access. On the AZ-500 exam, this scenario tests your understanding of network segmentation and the principle of least privilege for securing sensitive resources like Key Vaults; a common trap is confusing service endpoints with private endpoints—remember that private endpoints provide a more granular, fully private connection. A useful memory tip is “Private for precision, selected for scope”: private endpoints lock access to a single VNet, while selected networks allow broader but still restricted IP-based control.
⚠ Common exam trap
It's easy for candidates to confuse data protection features like soft delete (Option B) with network access controls, or mistakenly think that storing secrets in tags (Option D) is a valid configuration, when in fact tags are unencrypted metadata and never intended for secret storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Key Vault networking with private endpoint or selected networks
Configuring Key Vault networking with private endpoints or selected networks restricts access to only traffic from specified virtual networks and approved Azure services, aligning with the requirement to limit accessibility. Private endpoints use Azure Private Link to expose the vault to a VNet via a private IP, while selected networks use firewall rules to allow only specific IP ranges or VNets. This ensures that only authorized private networks and trusted Azure services (like Azure SQL or Azure App Service) can reach the vault, blocking all public internet traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Key Vault networking with private endpoint or selected networks
Why this is correct
Correct for the stated requirement.
- ✗
Disable soft delete permanently
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
- ✓
Use firewall and virtual network restrictions
Why this is correct
Correct for the stated requirement.
- ✗
Store secrets as plain text tags
Why it's wrong here
This does not meet the stated requirement as directly as the correct option.
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that an Azure Key Vault is accessible only from a specific virtual network and that all operations are logged. What should you configure?
easy- ✓ A.Key Vault firewall and virtual network service endpoints, and diagnostic settings
- B.Azure RBAC roles and diagnostic settings
- C.Soft-delete and purge protection, and diagnostic settings
- D.Azure Policy and diagnostic settings
Why A: To restrict Key Vault access to a specific virtual network, you must configure the Key Vault firewall and virtual network service endpoints, which allow you to deny all traffic except that originating from the specified VNet/subnet. To log all operations, you must configure diagnostic settings to send audit events (e.g., AuditEvent logs) to a Log Analytics workspace, Storage account, or Event Hub. Option A is correct because it combines both network access control and logging requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.