App-subnet virtual machines must Get secrets from Key Vault while the public Internet must not. Which network setting should the security engineer apply on the vault?
Select an answer to reveal the explanation.
Short Explanation
Don’t leave the vault on All networks. Flip it to Selected networks, allow the app subnet (service endpoints or VNet rules), and keep the Internet off the guest list.
Full Explanation
Key Vault can restrict data-plane access to selected networks using virtual network / service endpoint rules and optional public IP ranges. That pattern allows trusted subnets while denying general Internet access, unlike All networks. Private endpoints are a stronger private option, but selected networks remain a valid AZ-500 control. Soft-delete and RBAC do not replace network restriction.