Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Selecting Allow selected networks restricts public access to the vault and enforces the firewall. Adding the Prod subnet of VNet1 lets only the virtual machines in that subnet reach the vault over the service endpoint. Because Azure Backup is on Microsoft-managed addresses, it will be blocked unless the Allow trusted Microsoft services to bypass firewall setting is enabled. Enabling that bypass grants Azure Backup the access it needs, while traffic from any other location remains denied. Disabling public network access would also block Azure Backup, enabling only a service endpoint without changing the default Allow action would leave the vault open to the internet, and listing VM public IPs would not cover their managed service traffic and still block Azure Backup.