DP-300 Plan and implement data platform resources Practice Question

Correct answer & explanation

The correct configuration. Enabling the Key Vault firewall and selecting 'Allow trusted Microsoft services' ensures that only trusted Azure services, including Azure SQL Managed Instance with a system-assigned managed identity, can access the key. This satisfies the requirement that the key be accessible only from the managed instance's virtual network, as the managed instance is a trusted service within that network. Option B is incorrect because disabling the Key Vault firewall would allow public network access to the vault, violating the network restriction. Option C is incorrect because Azure SQL Managed Instance does not have a public IP address; it is deployed inside a virtual network and cannot be added as a public IP firewall rule. Option D is incorrect because disabling the firewall again allows public access, and using a user-assigned managed identity is unnecessary; a system-assigned managed identity is the recommended approach when using 'Allow trusted Microsoft services'.