When Azure Defender for Key Vault (now part of Microsoft Defender for Cloud) raises an alert about suspicious access attempts from multiple unknown IP addresses, the immediate mitigation step-before deeper investigation-is to restrict network access to the Key Vault to reduce exposure.
The Azure Key Vault firewall allows you to restrict access by:
* Allowing access only from trusted IP addresses, VNets, or private endpoints.
* Blocking all other traffic by enabling the firewall and disabling "Allow access from all networks." Microsoft's official recommendation states:
"To reduce the likelihood of secrets being compromised while you investigate an alert, enable the Key Vault firewall and restrict access to trusted networks or specific virtual networks."
"Firewall and virtual network configuration can be applied immediately without affecting existing permissions or access policies." This step:
* Minimizes exposure to malicious IP addresses.
* Is quick to implement (through the Azure Portal or CLI).
* Has minimal impact on legitimate users if you properly whitelist trusted networks or VNets.
Other options:
* A (Modify access control settings) or D (Modify access policy) would affect permissions and could disrupt legitimate users or service principals.
* C (Create an application security group) applies to network interfaces, not directly to Key Vault.
# answer: B. Enable the Key Vault firewall