SC-200 Certification Practice Question #52

Question

You receive an alert from Azure Defender for Key Vault.
You discover that the alert is generated from multiple suspicious IP addresses.
You need to reduce the potential of Key Vault secrets being leaked while you investigate the issue. The solution must be implemented as soon as possible and must minimize the impact on legitimate users.
What should you do first?

Accepted Answer

The alert was generated from multiple suspicious IP addresses, which is the exact "unrecognized IP Address" scenario the Defender for Key Vault response guidance covers. MS Learn directs you to enable the Key Vault firewall and configure it with the trusted resources/VNets — this immediately scopes data-plane access to known IPs while leaving legitimate users (who come from the trusted ranges) unaffected, satisfying both "as soon as possible" and "minimize impact on legitimate users." The dissent that the firewall is "already on" is incorrect: by default a new key vault's firewall is disabled and all networks are allowed (confirmed by the Key Vault security baseline and danb67's comment), so enabling/configuring it is the correct first action. Access-policy or access-control changes (A/D) restrict principals rather than source IPs and don't address an attack arriving from many IPs; an application security group (C) is a networking construct for NSG rules and is unrelated to Key Vault firewalling.

More SC-200 practice questions