AZ-500 Question 206
Select 2Your organization stores an SSL certificate in an Azure Key Vault located in the West Europe region, which secures a production web application. Now, you want to reuse the same SSL certificate for another web app running in the East US region. You attempted to back up the certificate from the West Europe Key Vault and restore it into the East US Key Vault but received an error indicating that cross-region restoration is not supported. Which two actions should you take to successfully use this SSL certificate in East US?
- A
Export the certificate as a .pfx file from the West Europe Key Vault and then import it into the East US Key Vault
- B
Enable geo-redundant backups in the East US Key Vault to allow direct cross-region restoration of the certificate backup
- C
Set up another Key Vault in the West Europe region for restoration of the certificate backup and then replicate the certificate manually to East US
- D
Enable soft delete on both Key Vaults to allow the certificate backup to be restored directly across regions
Show answer and explanation
Correct answers: A, C
Explanation
Azure Key Vault backups are region-specific; you cannot directly restore a Key Vault backup taken in one region to a vault in another region. To work around this limitation, you can export certificates in a standard format (such as .pfx) and then import them into a new Key Vault, even if it's in a different region. For references, see Microsoft’s Azure Key Vault documentation on backup and restore (https://learn.microsoft.com/azure/key-vault/general/backup-restore).
- A. Correct.
Correct: Exporting the SSL certificate as a .pfx file and then importing it into the new Key Vault is a valid approach. This approach bypasses the region limitation on Key Vault backups by treating the certificate as a standard .pfx file rather than a Key Vault backup blob.
- B. Incorrect.
Incorrect: Azure Key Vault does not provide a geo-redundant backup restoration feature that automatically enables cross-region backups and restores. Simply enabling geo-redundancy does not solve the limitation that Key Vault backups can only be restored within the same region.
- C. Correct.
Correct: By creating another Key Vault in the same West Europe region, you can restore the certificate backup there (if needed, for testing or redundancy). To use it in East US, you would still need to export the certificate from a Key Vault in West Europe in a supported format (like .pfx) and then import it into the East US Key Vault. The key point is that a Key Vault backup blob cannot be restored directly across regions.
- D. Incorrect.
Incorrect: Soft delete helps protect against accidental deletion and allows you to recover deleted keys and secrets within the same Key Vault. However, it does not enable cross-region restoration from a Key Vault backup.