Question

A financial services company stores encryption keys used by several Azure VM disk encryption and Azure SQL Transparent Data Encryption workloads. Compliance mandates that (1) the key material must be protected by FIPS 140-2 Level 3 validated hardware, and (2) the key vault must not be reachable from the public internet — only from specific virtual networks. You must recommend a solution that satisfies both requirements while minimizing operational overhead. What should you recommend?

Accepted Answer

Use Azure Key Vault Premium tier with a private endpoint and disable public network access.

Answer

Use Azure Key Vault Standard tier with a service endpoint and a firewall rule allowing only the required virtual networks.

Answer

Use Azure Key Vault Standard tier with a private endpoint and enable soft-delete and purge protection.

Answer

Deploy Azure Dedicated HSM and expose it publicly with an NSG restricting inbound traffic to the required subnets.