Deploying an Azure key vault to each enterprise-scale landing zone

Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework
Answer Correct answer: D — Each application landing zone should include an Azure Key Vault; firewalls and gateways belong to the shared connectivity hub, not per landing zone.

You have an Azure subscription. You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application. You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones. What should you recommend?

  1. an Azure firewall
  2. an Azure virtual network gateway
  3. an Azure Private DNS zone
  4. an Azure key vault Correct Answer
enterprise scale landing zone azure key vault per landing zone cloud adoption framework security

Community Votes

D
73%
A
27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Azure Key Vault is the security resource recommended in every application landing zone (separate key vaults per environment/region); Azure Firewall and VNet gateways belong to the shared connectivity subscription, not each app landing zone.

In a Cloud Adoption Framework enterprise-scale landing zone design, each application landing zone should include its own Azure Key Vault to store secrets, keys, and certificates isolated per application environment, while shared platform resources such as firewalls and gateways live in the connectivity/network hub.

Choosing Azure Firewall (A) or a VNet gateway (B) — those are shared platform/connectivity resources deployed once in the network hub, not per application landing zone.

Community Discussion (9 comments)

424ede1 👍 1 Selected: D
Landing Zone Subscription --> Azure Key Vault Connectivity Subscription --> Azure Firewall https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/define-an-azure-network-topology#virtual-wan-network-topology
424ede1 👍 1 Selected: D
Based on the provided picture and the conceptual architecture of the landing zone, both landing zone subscriptions include KeyVault. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/#azure-landing-zone-architecture
Er_01 👍 4 Selected: D
The question related to ent scale application landing zones from the document only shows Azure Key Vault in each one. Also, in the access section it states to “separate key vaults for each application environment in each region”. Pg 419
sweetykaur 👍 1 Selected: A
The best recommendation to meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones is A. an Azure firewall. Deploying an Azure firewall in each landing zone provides centralized protection against network threats and supports security and compliance requirements. This aligns with the Cloud Adoption Framework's best-practices for securing your environment and ensuring consistent security controls across all landing zones.
jim85 👍 1 Selected: A
should be A for app landing zone and D for single-platform landing zone
Ali96 👍 1 Selected: C
an Azure Private DNS zone
tuyi2 👍 1 Selected: D
From Chat GPT: The Microsoft Cloud Adoption Framework for Azure recommends deploying an Azure Key Vault in each landing zone to securely manage and store secrets, keys, and certificates for the applications and resources hosted in the landing zone. This approach ensures that sensitive information is isolated and secured within each application landing zone.
676ae1a 👍 1 Selected: D
Azure key vault es uno de los recursos que debe tener una zona de aterrizaje en relación a seguridad y cumplimiento y por lo tanto sería la opción más óptima pese a que se recomiende un Azure firewall relativo a redes y conectividad
676ae1a 👍 1 Selected: A
Azure firewall es uno de los recursos que debe tener la zona de aterrizaje

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Cloud Adoption Framework enterprise-scale landing zone architecture places an Azure Key Vault in each application landing zone (with separate key vaults for each application environment in each region) to isolate and secure secrets, keys, and certificates. This matches the recommendation to deploy a security resource to each landing zone.

Why the Other Options Are Wrong

Azure Firewall (A) and VNet gateway (B) are connectivity/network-hub resources deployed once in the shared platform/connectivity subscription, not repeated in every application landing zone. An Azure Private DNS zone (C) is also a shared service typically centralized in the connectivity hub rather than per application landing zone.

Community Comment Notes

The community favored D (67 votes). Multiple comments cite the enterprise-scale landing zone documentation showing Azure Key Vault in each application landing zone and separate key vaults per environment, while firewalls/gateways belong to the connectivity subscription.

Official Reference

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/

Related Analysis

Your on-premises network contains an Active Directory Domain

A-Grade

You have 10 Azure subscriptions that contain 100 role-based

S-Grade

You have a Microsoft 365 subscription that contains 1,000 Mi

S-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide