You are building an application that moves data between on-premises file servers and Azure Blob Storage. The app stores keys, secrets, and certificates in Azure Key Vault and calls the Key Vault APIs. You want to ensure accidental deletion of a key vault or its objects can be recovered for 90 days after deletion. What should you do?

To ensure accidental deletion of a key vault or its objects can be recovered for 90 days, you need to enable both soft delete and purge protection. Soft delete allows recovery of deleted key vaults and objects for a configurable retention period (90 days by default). Purge protection prevents permanent deletion during the soft-delete retention period, even by privileged users, ensuring the 90-day recovery window. The az keyvault update --enable-soft-delete true --enable-purge-protection true command correctly configures both settings. Add-AzKeyVaultKey is used to add a key, not configure protection settings. Configuring virtual network service endpoints enhances security by restricting network access, but does not address data recovery after deletion. Setting enable-soft-delete false would disable the recovery feature, contrary to the requirement.