Correct Answer: Deploy Azure Key Vault with a Private Endpoint in the same VNet as the HANA VM, and configure Key Vault firewall to deny public access
Azure Private Endpoint creates a private IP address in your VNet that maps to the Key Vault. Traffic from the HANA VM to Key Vault stays entirely within the Azure backbone and neve...
Correct Answer
Deploy Azure Key Vault with a Private Endpoint in the same VNet as the HANA VM, and configure Key Vault firewall to deny public access
Why This Answer Is Correct
Azure Private Endpoint creates a private IP address in your VNet that maps to the Key Vault. Traffic from the HANA VM to Key Vault stays entirely within the Azure backbone and never traverses the internet. Combined with Key Vault firewall set to deny public network access, this ensures fully private key retrieval. Service Endpoints allow VNet traffic to reach Key Vault via the public endpoint (but over the Microsoft backbone), while Private Endpoints are preferred for stricter isolation. Storing TDE keys in blob is insecure and unsupported.
This question evaluates your knowledge of High Availability — a core concept tested in Microsoft Certified: Azure for SAP Workloads Specialty (AZ-120). Understanding High Availability is essential for designing scalable, secure, and cost-effective cloud architectures. Mastery of this topic will help you answer scenario-based questions confidently on exam day.
You are configuring SAP HANA System Replication (HSR) across two different Azure Availability Zones in the same region. What replication mode should you use to ensure zero data loss while minimizing the impact on the primary node's performance?
You are designing the network topology for an SAP landscape on Azure. To ensure high availability of the SAP ASCS/SCS instance across two VMs in an availability set, what networking component is required to route traffic to the active node?
When configuring a SUSE Linux Enterprise Server (SLES) Pacemaker cluster for SAP ASCS High Availability in Azure, what resource is used to reliably fence (STONITH) a failed node?
You are migrating a legacy SAP ECC system running on Windows Server to Azure. You want to ensure the VMs automatically restart on healthy hardware if an underlying Azure host fails. What is this capability called?
Your organization uses Azure Active Directory (Entra ID) for authentication. You want to configure Single Sign-On (SSO) for your SAP Fiori launchpad. Which standard protocol is natively supported by both SAP Fiori (ABAP front-end) and Azure AD for this purpose?