Azure Key Vault Network Restrictions Using Private Endpoint or Selected Networks
A Key Vault should be accessible only from selected private networks and approved Azure services. Which two settings are most relevant?
Quick Answer
The answer is to use firewall and virtual network restrictions, specifically by configuring private endpoints or selected networks. This is correct because private endpoints leverage Azure Private Link to assign the Key Vault a private IP within a virtual network, ensuring traffic never traverses the public internet, while selected networks use firewall rules to permit only specified IP ranges or VNets and approved Azure services, effectively blocking all other access. On the AZ-500 exam, this scenario tests your understanding of network segmentation and the principle of least privilege for securing sensitive resources like Key Vaults; a common trap is confusing service endpoints with private endpoints—remember that private endpoints provide a more granular, fully private connection. A useful memory tip is “Private for precision, selected for scope”: private endpoints lock access to a single VNet, while selected networks allow broader but still restricted IP-based control.
⚠ Common exam trap
It's easy for candidates to confuse data protection features like soft delete (Option B) with network access controls, or mistakenly think that storing secrets in tags (Option D) is a valid configuration, when in fact tags are unencrypted metadata and never intended for secret storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Key Vault networking with private endpoint or selected networks
Option A is correct because configuring Key Vault networking with a private endpoint or selected networks restricts access to the vault from approved private IP ranges within your virtual networks, blocking public internet access. Option C is correct because Key Vault's firewall and virtual network restrictions let you allow traffic only from specified VNets/subnets and trusted Azure services, directly enforcing the 'selected private networks and approved Azure services' requirement. Option B is incorrect because soft delete is a data-protection feature that retains deleted vaults/objects for recovery; disabling it does not control network accessibility and would weaken security. Option D is incorrect because storing secrets as plain text tags is insecure and unrelated to network access restrictions; tags are metadata and should never hold secret values.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Key Vault networking with private endpoint or selected networks
Why this is correct
Private endpoint gives the vault a private IP inside your VNet, while selected networks plus service endpoints restrict public access to approved subnets; the service firewall's 'Allow trusted Microsoft services' toggle then admits approved Azure services, satisfying both constraints.
- ✗
Disable soft delete permanently
Why it's wrong here
Soft delete governs recovery of deleted vault objects, not network reachability. It is tempting because it appears in Key Vault security hardening, but it does not restrict access paths. The relevant settings are the firewall with private endpoint or selected virtual networks, plus the trusted Azure services bypass.
- ✓
Use firewall and virtual network restrictions
Why this is correct
Key Vault's firewall and virtual network restrictions block all public traffic by default, then permit only listed subnets and IP ranges; enabling the trusted-services exception lets approved Azure services bypass the firewall, meeting the private-network and approved-service requirements.
- ✗
Store secrets as plain text tags
Why it's wrong here
Tags are metadata labels for classification and search; they store no secret material and enforce no access restriction. It is tempting because tags appear in governance and policy discussions, but plain-text tags would expose values and cannot gate network access. The relevant settings are the Key Vault firewall and trusted Azure services bypass.
Visual reference
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 617-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that an Azure Key Vault is accessible only from a specific virtual network and that all operations are logged. What should you configure?
easy- ✓ A.Key Vault firewall and virtual network service endpoints, and diagnostic settings
- B.Azure RBAC roles and diagnostic settings
- C.Soft-delete and purge protection, and diagnostic settings
- D.Azure Policy and diagnostic settings
Why A: To restrict Key Vault access to a specific virtual network, you must configure the Key Vault firewall and virtual network service endpoints, which allow you to deny all traffic except that originating from the specified VNet/subnet. To log all operations, you must configure diagnostic settings to send audit events (e.g., AuditEvent logs) to a Log Analytics workspace, Storage account, or Event Hub. Option A is correct because it combines both network access control and logging requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.