Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureHard
An organization uses Azure Key Vault to store cryptographic keys, secrets, and certificates for its applications. Compliance requirements state that all access to Key Vault must originate from within a specific Azure Virtual Network and must not traverse the public internet. This applies to both applications and administrative access. Which networking feature should the architect implement to enforce this requirement?
- AAzure Private Link for Key Vault
- BNetwork Security Groups (NSGs)
- CVirtual Network Service Endpoints
- DKey Vault Firewall rules
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Private Link for Key Vault
Azure Private Link for Key Vault creates a private endpoint in the virtual network, mapping the Key Vault's public IP to a private IP within the VNet. This ensures that all traffic to Key Vault travels over the Azure backbone network, bypassing the public internet and meeting the requirement for private access confined to the specified VNet.
Why the other options are wrong
- B. NSGs control network traffic within and between VNets but do not inherently prevent traffic from traversing the public internet to PaaS services.
- C. Virtual Network Service Endpoints keep traffic on the Azure backbone but expose the public endpoint, which Private Link actively hides.
- D. Key Vault Firewall rules restrict access by IP address, but traffic still traverses the public internet if not combined with Private Link.
Azure Private Link for Key Vault
A networking service that provides private connectivity to Azure Key Vault from within an Azure virtual network, eliminating public internet exposure.
- Creates a private endpoint in your VNet for Key Vault.
- Traffic travels over the Azure backbone network, not the public internet.
- Enhances security and compliance for sensitive key management.
Memory trick: Private Link is like a secret tunnel direct to your cloud service.