Diagram
A layered stack showing customer data protected by two encryption layers: service-level encryption using platform or customer-managed keys, and infrastructure-level encryption using Microsoft-managed keys.
Implement and Validate Double Encryption
Double encryption protects data with two separate encryption layers, so if one layer is ever broken, the other still keeps the data safe. The first layer is service-level encryption, which encrypts data before it is written to disk. The second layer is infrastructure encryption, which adds an extra 256‑bit AES encryption at the Azure Storage hardware level. Using two different keys and two separate encryption algorithms means that a compromise of any single key or algorithm cannot expose the data.
Domain 7 of 7
1 practice question
Practice this DomainLast updated