How should multi-region Key Vault deployments be architected for high availability?
- A One vault, geo-replication enabled
- B One primary vault per region (Key Vault replicates within a region's paired region automatically) (correct answer)
- C Manual replication between vaults
- D Azure Front Door in front of one vault
Shortcut: Key Vault automatically replicates within its region's pair. For multi-region HA, deploy separate vaults per region. Apps should have fallback logic to try the secondary region's vault if the primary is unavailable.