Box 1: A server in the paired region
The contents of your key vault are replicated within the region and to a secondary region at least 150 miles away, but within the same geography to maintain high durability of your keys and secrets.
Regions are paired for cross-region replication based on proximity and other factors.
Box 2: Delete -
During failover, your key vault is in read-only mode. Requests that are supported in this mode are:
List certificates -
Get certificates -
List secrets -
Get secrets -
List keys -
Get (properties of) keys -
Encrypt -
Decrypt -
Wrap -
Unwrap -
Verify -
Sign -
Backup -
Reference:
https://docs.microsoft.com/en-us/azure/key-vault/general/disaster-recovery-guidance