Hotspot Question You have the Azure key vaults shown in the following table. KV1 stores a secret named Secret1 and a key for a managed storage account named Key1. You back up Secret1 and Key1. To…

The correct answer is Restore Secret1 to KV1 = Yes; Restore Secret1 to KV2 = Yes; Restore Secret1 to KV3 = No; Restore Secret1 to KV4 = No; Restore Secret1 to KV5 = No; Restore Key1 to KV1 = Yes; Restore Key1 to KV2 = Yes; Restore Key1 to KV3 = No; Restore Key1 to KV4 = No; Restore Key1 to KV5 = No. This question tests knowledge of Azure Key Vault backup and restore rules, specifically the geographic and subscription constraints that govern where a backup can be restored.

Submitted by kev92· Mar 6, 2026Secure compute, storage, and databases

Question

Hotspot Question You have the Azure key vaults shown in the following table. KV1 stores a secret named Secret1 and a key for a managed storage account named Key1. You back up Secret1 and Key1. To which key vaults can you restore each backup? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibits

Answer Area

Restore Secret1 to KV1Yes
Restore Secret1 to KV2Yes
Restore Secret1 to KV3No
Restore Secret1 to KV4No
Restore Secret1 to KV5No
Restore Key1 to KV1Yes
Restore Key1 to KV2Yes
Restore Key1 to KV3No
Restore Key1 to KV4No
Restore Key1 to KV5No

Explanation

This question tests knowledge of Azure Key Vault backup and restore rules, specifically the geographic and subscription constraints that govern where a backup can be restored.

Approach. Azure Key Vault backups can only be restored to a key vault within the same Azure geography (region pair/geo) and the same Azure subscription as the source vault. Secret1 (a regular secret) can be restored to any key vault in the same geography and subscription as KV1. Key1 (a managed storage account key) follows the same geographic and subscription rule, but additionally the destination key vault must support managed storage account keys - meaning it must be in a region that supports that feature. In practice, both Secret1 and Key1 backups from KV1 can be restored to any vault in the same geography/subscription, but NOT to vaults in a different geography or different subscription, regardless of SKU (Standard vs. Premium) differences.

Concept tested. Azure Key Vault backup and restore constraints: backups are geo-bound and subscription-bound, meaning a backup taken from a key vault can only be restored to another key vault within the same Azure geography (not necessarily the same region, but the same geographic boundary) and the same Azure subscription. Cross-subscription and cross-geography restores are not supported.

Reference. https://learn.microsoft.com/en-us/azure/key-vault/general/backup?tabs=azure-cli

Topics

#Azure Key Vault#Secret management#Key management#Backup and restore

Community Discussion

No community discussion yet for this question.

Full AZ-500 Practice