AZ-500 Question 195
Single answerYour company hosts a production web application in Azure App Service and stores credentials in Azure Key Vault. You need to lock down access to Key Vault so that only the following sources can retrieve secrets: • The App Service, which uses a static outbound public IP address. • Your on-premises environment with a known public IP address. • Azure Resource Manager for deployment scripts. You enable the Key Vault firewall to block public access by default. What configuration should you apply to meet these requirements?
- A
A) Enable the firewall and add only your on-premises network's public IP address to the allowed list. Leave 'Allow trusted Microsoft services to bypass this firewall' disabled.
- B
B) Enable the firewall and add only the App Service's public IP address to the allowed list. Also enable 'Allow trusted Microsoft services to bypass this firewall.'
- C
C) Enable the firewall, add both the on-premises IP address and the App Service's public IP address to the allowed list, and enable 'Allow trusted Microsoft services to bypass this firewall.'
- D
D) Disable the firewall and rely exclusively on Azure RBAC (Role-Based Access Control) for restricting access.
Show answer and explanation
Correct answer: C
Explanation
Configuring Key Vault to restrict access at the network layer requires enabling its firewall and specifying which IP addresses or subnets are allowed. In this scenario, you need to include both your on-premises IP address and the static outbound IP address used by your App Service. Enabling 'Allow trusted Microsoft services to bypass this firewall' permits services like Azure Resource Manager to manage and access Key Vault without manually adding their IP addresses. Refer to Microsoft documentation on ‘Configure Azure Key Vault firewalls and virtual networks’ at https://learn.microsoft.com/azure/key-vault/general/network-security for detailed guidance.
- A. Incorrect.
A) Incorrect. Adding only the on-premises IP address would prevent the App Service and Azure Resource Manager from accessing the Key Vault, which violates the requirements.
- B. Incorrect.
B) Incorrect. This approach allows the App Service and trusted Microsoft services, but on-premises access is blocked since that IP address is not added to the Key Vault firewall.
- C. Correct.
C) Correct. Enabling the Key Vault firewall, adding the on-premises IP address, adding the App Service's IP address, and enabling 'Allow trusted Microsoft services to bypass this firewall' satisfies all the listed access needs (on-prem, App Service, and Azure Resource Manager).
- D. Incorrect.
D) Incorrect. Disabling the firewall leaves the Key Vault publicly accessible, which fails the requirement to enforce network-level restrictions.