After the lock-lab Key Vault firewall is set to Deny by default, a contractor can still change vault networking and access settings from the Azure portal. What should the security engineer conclude about the firewall’s scope?
Select an answer to reveal the explanation.
Short Explanation
The vault firewall guards the data plane—secrets, keys, certificates—not the ARM switches that change the vault itself. Portal tweaks to networking still ride the control plane, so Deny-by-default didn’t fail; you’re looking at a different door.
Full Explanation
Key Vault network firewalls and service endpoints / selected-network rules apply to data-plane operations against secrets, keys, and certificates. Creating or updating the vault, changing network settings, and altering access configuration are control-plane Azure Resource Manager operations and are not blocked by the Key Vault data-plane firewall. Private endpoints harden data-plane connectivity; they are not required for the control-plane versus data-plane distinction itself. Authorization still applies separately on both planes.