Canal-authority secrets in Key Vault must not be reachable from the public Internet. Which configuration best meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Shut the public door on the vault and walk secrets in through a private endpoint. Point DNS at privatelink.vaultcore.azure.net so callers stay on the private path instead of the open Internet.
Full Explanation
Disabling public network access or setting the Key Vault firewall default action to Deny removes public data-plane reachability. A private endpoint provides private connectivity into the vault, and private DNS for privatelink.vaultcore.azure.net resolves the vault hostname to the private address. Broad public access plus privileged roles expands exposure. Moving secrets to a public storage container defeats the isolation goal.