Where Can Secret1 and Key1 Backups Be Restored?
HOTSPOT
You have the Azure key vaults shown in the following table.
KV1 stores a secret named Secret1 and a key named Key1.
You back up Secret1 and Key1.
To which key vaults can you restore each backup. To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Community Insight
The item tests Key Vault's restore scope — same subscription and same geography — and the trap is assuming region equality is the only requirement.
This SC-500 hotspot tests Azure Key Vault backup restore boundaries for Secret1 and Key1. It establishes that both can be restored only within KV1's subscription and geography, never across either boundary.
A frequent wrong approach is matching only the Azure region or treating the backup as portable across subscriptions; Key Vault requires both same subscription and same geography.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Azure Key Vault backup and restore scope is defined by two boundaries: the backup must be restored to a vault in the same Azure subscription and the same geography as the source vault. KV1 is the source for both Secret1 and Key1, so every acceptable target must match KV1's subscription and geography. The region does not need to match, which is why a vault in a different region can still qualify when it is inside the same geography. Both the secret backup and the key backup follow this same subscription-plus-geography rule.Why Other Candidate Answers Are Wrong
A vault in the same region but a different subscription is wrong because subscription identity is a hard requirement, not a convenience. A vault in the same subscription but a different geography is also wrong, even if the region name looks similar or nearby. A globally portable backup is wrong because Key Vault does not allow restoring Secret1 or Key1 to an arbitrary vault. The correct selections must exclude any vault that fails either the subscription test or the geography test.Community Comment Notes
Craig summarized the rule as requiring the target vault to be in the exact same Azure subscription, with "Same Geography (Region doesn't matter)" for the recovery boundary. The comment's example of restoring from West US to East US is consistent with the documented behavior because both regions are in the United States geography. The key takeaway from the discussion is that region matching is not the deciding factor; subscription and geography are.Official Reference
Exam Strategy
Read the vault table for only two attributes: subscription and geography. Ignore region differences inside the same geography, but reject any vault whose subscription or geography differs from KV1 for both Secret1 and Key1.
Frequently Asked Questions
Can Secret1 be restored to a KV1-geography vault in another subscription?
No. Azure Key Vault requires the target vault to be in the same subscription and same geography as KV1 for both secret and key backups.
Does Key1 need to be restored to the same Azure region as KV1?
No. The target must be in KV1's subscription and geography, but it can be a different region within that geography.
Related Analysis
Practice All SC-500 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SC-500 Practice Test →