Microsoft Certified: DevOps Engineer ExpertDevelop a security and compliance planHard
A company is developing a highly sensitive application that processes personal health information (PHI). They are using Azure App Services and Azure Key Vault to store secrets and certificates. Current security requirements state that all access to Azure Key Vault must originate from a private IP address within a specific Azure Virtual Network (VNet) and must not traverse the public internet. Which Key Vault networking feature should be configured to meet this requirement?
- AKey Vault Firewall and virtual network settings
- BAzure Service Endpoints for Key Vault
- CKey Vault Access Policies
- DAzure Private Link for Key Vault
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Private Link for Key Vault
Azure Private Link for Key Vault allows you to connect privately and securely to Key Vault from your Azure Virtual Network using a private endpoint. This ensures that access to Key Vault traverses the Azure backbone network and not the public internet, meeting the requirement for private IP access without public internet exposure.
Why the other options are wrong
- A. Key Vault Firewall and VNet settings can restrict public access and allow specific VNets, but Private Link ensures the traffic *never* leaves the Azure backbone, offering true private IP access.
- B. Azure Service Endpoints for Key Vault allow traffic to stay on the Azure backbone, but the service still presents a public IP address. Private Link offers true private IP access within your VNet.
- C. Key Vault Access Policies control *who* can access Key Vault and *what* actions they can perform, but not *how* they connect (private vs. public network).
Azure Private Link for Key Vault
A networking service that provides private connectivity to Azure Key Vault from your Azure Virtual Network, ensuring traffic traverses the Microsoft backbone network and not the public internet.
- Creates a private endpoint in your VNet.
- Key Vault becomes accessible via a private IP address.
- Enhances security by eliminating public internet exposure.
Memory trick: Key Vault's Private Link: Your Secrets' Private Road to Security!