Q29 Key Vault Domain 4 · 20–25% of exam

What is the Key Vault network default when you first create a vault?

  1. A Private endpoint only
  2. B All networks (public internet access enabled) (correct answer)
  3. C VNet-only access
  4. D Disabled

Shortcut: By default, new Key Vaults allow access from all networks (public internet). Best practice: restrict to specific VNets or private endpoints immediately after creation for production vaults.