After the lock-lab Key Vault firewall is set to Deny by default, a contractor can still change vault networking and access settings from the Azure portal. What should the security engineer conclude about the firewall’s scope?
Select an answer to reveal the explanation.
Short Explanation
The vault firewall guards the data plane—secrets, keys, certificates—not the ARM switches that change the vault itself. Portal tweaks to networking still ride the control plane, so Deny-by-default didn’t fail; you’re looking at a different door.
Full Explanation
Key Vault firewall rules, service endpoints, and selected-network settings govern data-plane calls such as get secret, wrap key, and get certificate. They do not block Azure Resource Manager control-plane management of the vault resource itself. After Deny by default, a contractor who can still change networking and access settings from the portal is operating on the control plane; that behavior does not prove the firewall failed—it proves the firewall was never the gate for ARM writes.
Claiming the firewall blocks every ARM write so portal changes prove Deny failed fails by concept: network ACLs are data-plane scoped. Claiming portal access always bypasses both data-plane and control-plane authorization fails because portal management still requires ARM RBAC (or equivalent), and data-plane calls still require Key Vault data-plane authorization plus network path. Claiming only Private Link can ever allow portal management after Deny by default fails because portal vault-property edits travel through ARM regardless of Private Link; Private Link addresses private data-plane connectivity, not ARM authorization.
Exam caveat: AZ-500 tests control-plane versus data-plane separation on Key Vault repeatedly—network Deny does not replace RBAC on Microsoft.KeyVault/vaults/*. Operational check: with firewall Deny default, attempt a data-plane secret Get from a disallowed network (expect failure), then change a networking property in the portal or via ARM (expect success if the principal has control-plane rights), and document both results for the lock-lab review.