Your company deploys a private endpoint for an Azure Key Vault so that a set of VMs in a hub virtual network can retrieve secrets over a private IP. You create the private endpoint and select the 'vault' target sub-resource. To ensure the VMs resolve the Key Vault FQDN to the private endpoint's private IP address automatically, you must link the correct Azure Private DNS zone to the virtual network. Which Private DNS zone name must you use?