nerdexam
Microsoft

AZ-500 · Question #456

You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. You need to allow access to Vault1…

The correct answer is A. From the Firewalls and virtual networks tab, add the IP address of VM1. To restrict Azure Key Vault access exclusively to a specific virtual machine, its public IP address should be whitelisted in the Key Vault's networking firewall settings.

Submitted by carlos_mx· Mar 6, 2026Secure networking

Question

You have an Azure subscription that contains an Azure key vault named Vault1 and a virtual machine named VM1. VM1 is connected to a virtual network named VNet1. You need to allow access to Vault1 only from VM1. What should you do in the Networking settings of Vault1?

Options

  • AFrom the Firewalls and virtual networks tab, add the IP address of VM1.
  • BFrom the Private endpoint connections tab, create a private endpoint for VM1.
  • CFrom the Firewalls and virtual networks tab, add VNet1.
  • DFrom the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this

How the community answered

(34 responses)
  • A
    71% (24)
  • B
    9% (3)
  • C
    3% (1)
  • D
    18% (6)

Why each option

To restrict Azure Key Vault access exclusively to a specific virtual machine, its public IP address should be whitelisted in the Key Vault's networking firewall settings.

AFrom the Firewalls and virtual networks tab, add the IP address of VM1.Correct

From the Firewalls and virtual networks tab, adding the specific public IP address of VM1 to the allowed list ensures that only network traffic originating from that VM's egress IP can connect to the Key Vault. This directly fulfills the requirement for exclusive access from VM1.

BFrom the Private endpoint connections tab, create a private endpoint for VM1.

Creating a private endpoint provides secure, private connectivity for VM1 to Vault1, but it establishes a new private IP in VNet1 for Vault1 and is a different mechanism than directly allowing an existing IP through a firewall.

CFrom the Firewalls and virtual networks tab, add VNet1.

Adding VNet1 to the 'Firewalls and virtual networks' tab would allow any resource within VNet1 to access the Key Vault, violating the 'only from VM1' requirement.

DFrom the Firewalls and virtual networks tab, set Allow trusted Microsoft services to bypass this

Setting 'Allow trusted Microsoft services to bypass this firewall' would grant access to a broad category of Azure services, not specifically limit access to VM1, thus failing the 'only from VM1' requirement.

Concept tested: Azure Key Vault networking security (IP firewalls)

Source: https://learn.microsoft.com/en-us/azure/key-vault/general/network-security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice