AZ-500 Question 205
Single answerYour organization needs to replicate certificates, secrets, and keys stored in an existing Azure Key Vault in Subscription A to a newly created Azure Key Vault in Subscription B for disaster recovery and compliance purposes. Both subscriptions belong to the same Azure AD tenant, and both Key Vaults use the Premium SKU. Which approach correctly accomplishes this backup and restore process?
- A
Perform a backup of the existing Key Vault, securely store the backup file, and then restore it to the new Key Vault in Subscription B using the Azure Key Vault backup and restore functionality.
- B
Use the built-in Azure portal feature to directly copy all secrets, keys, and certificates between the two Key Vaults in different subscriptions without performing a backup.
- C
Enable soft delete on both Key Vaults and rely on the service to automatically synchronize secrets, keys, and certificates between Vault A and Vault B.
- D
Generate new keys and certificates in the new Key Vault, as cross-subscription backup and restore is not supported even in the same tenant.
Show answer and explanation
Correct answer: A
Explanation
To properly back up and restore secrets, keys, or certificates across different Azure subscriptions, they must be in the same Azure AD tenant, and the Key Vaults must share the same SKU (for example, Premium). The supported process is to generate a backup from the source vault, store it securely (for example, in Azure Storage), and then restore that backup to the target vault. For more guidance, see the official Azure Key Vault documentation: https://learn.microsoft.com/azure/key-vault/general/backup
- A. Correct.
Option 1 is correct. Azure Key Vault supports backing up and restoring secrets, keys, and certificates within the same Azure AD tenant, even across different subscriptions, as long as the Key Vaults share the same SKU (Premium in this case). The recommended approach is to perform a backup from the source Key Vault, securely store the backup file, then restore it to the target Key Vault in the new subscription.
- B. Incorrect.
Option 2 is incorrect because there is no built-in Azure portal feature that directly copies secrets, keys, and certificates from one Key Vault to another across subscriptions without creating a backup. The backup and restore process is the supported method.
- C. Incorrect.
Option 3 is incorrect. Soft delete helps recover deleted items within the same Key Vault. It does not automatically synchronize or copy content from one Key Vault to another. Soft delete is for recovering accidentally deleted secrets, keys, or certificates within the same vault.
- D. Incorrect.
Option 4 is incorrect. Azure Key Vault does allow backup and restore across subscriptions within the same tenant, provided the vaults are of the same SKU. You do not need to recreate keys and certificates from scratch, as cross-subscription backup and restore is indeed supported.