Deploying an Azure key vault to each enterprise-scale landing zone

SC-100 By islever Editorial Last updated

Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework

Short answer

D Each application landing zone should include an Azure Key Vault; firewalls and gateways belong to the shared connectivity hub, not per landing zone.

Question

You have an Azure subscription. You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application. You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones. What should you recommend?
  1. an Azure firewall
  2. an Azure virtual network gateway
  3. an Azure Private DNS zone
  4. an Azure key vault Correct Answer

Key Takeaways

Azure Key Vault is the security resource recommended in every application landing zone (separate key vaults per environment/region); Azure Firewall and VNet gateways belong to the shared connectivity subscription, not each app landing zone.

In a Cloud Adoption Framework enterprise-scale landing zone design, each application landing zone should include its own Azure Key Vault to store secrets, keys, and certificates isolated per application environment, while shared platform resources such as firewalls and gateways live in the connectivity/network hub.

Common mistake: Choosing Azure Firewall (A) or a VNet gateway (B) — those are shared platform/connectivity resources deployed once in the network hub, not per application landing zone.

Expert Analysis

Why the Answer Is Correct

Microsoft Cloud Adoption Framework enterprise-scale landing zone architecture places an Azure Key Vault in each application landing zone (with separate key vaults for each application environment in each region) to isolate and secure secrets, keys, and certificates. This matches the recommendation to deploy a security resource to each landing zone.

Why the Other Options Are Wrong

Azure Firewall (A) and VNet gateway (B) are connectivity/network-hub resources deployed once in the shared platform/connectivity subscription, not repeated in every application landing zone. An Azure Private DNS zone (C) is also a shared service typically centralized in the connectivity hub rather than per application landing zone.

Community Comment Notes

The community favored D (67 votes). Multiple comments cite the enterprise-scale landing zone documentation showing Azure Key Vault in each application landing zone and separate key vaults per environment, while firewalls/gateways belong to the connectivity subscription.

Official Reference

https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/

This link opens the official vendor documentation in a new tab.

Community Votes

D
73%
A
27%

73% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 9 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 9

  1. Er_01 👍 4 Answered D
    The question related to ent scale application landing zones from the document only shows Azure Key Vault in each one. Also, in the access section it states to “separate key vaults for each application environment in each region”. Pg 419
  2. sweetykaur 👍 1 Answered A
    The best recommendation to meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones is A. an Azure firewall. Deploying an Azure firewall in each landing zone provides centralized protection against network threats and supports security and compliance requirements. This aligns with the Cloud Adoption Framework's best-practices for securing your environment and ensuring consistent security controls across all landing zones.
  3. tuyi2 👍 1 Answered D
    From Chat GPT: The Microsoft Cloud Adoption Framework for Azure recommends deploying an Azure Key Vault in each landing zone to securely manage and store secrets, keys, and certificates for the applications and resources hosted in the landing zone. This approach ensures that sensitive information is isolated and secured within each application landing zone.
  4. 424ede1 👍 1 Answered D
    Based on the provided picture and the conceptual architecture of the landing zone, both landing zone subscriptions include KeyVault. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/#azure-landing-zone-architecture
  5. 424ede1 👍 1 Answered D
    Landing Zone Subscription --> Azure Key Vault Connectivity Subscription --> Azure Firewall https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/define-an-azure-network-topology#virtual-wan-network-topology
Show 4 more comments
  1. 676ae1a 👍 1 Answered D
    Azure key vault es uno de los recursos que debe tener una zona de aterrizaje en relación a seguridad y cumplimiento y por lo tanto sería la opción más óptima pese a que se recomiende un Azure firewall relativo a redes y conectividad
  2. 676ae1a 👍 1 Answered A
    Azure firewall es uno de los recursos que debe tener la zona de aterrizaje
  3. jim85 👍 1 Answered A
    should be A for app landing zone and D for single-platform landing zone
  4. Ali96 👍 1 Answered C
    an Azure Private DNS zone

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide