Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Default At-Rest Encryption With Platform-Managed Keys
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is planning to migrate its workloads to Microsoft Azure datacenters. As part of corporate compliance and regulatory requirements, all data written to physical storage infrastructure within the datacenters must be protected against unauthorized physical and digital access.
Which security capability does Azure provide by default to protect customer data stored on datacenter storage without requiring manual configuration?
Explanations
Dynamic data masking for query results
Dynamic data masking for query results
What Dynamic Data Masking Is
Dynamic data masking is a database security feature that obfuscates sensitive data (such as credit card numbers or personal identifiers) in query results returned to non-privileged users, while keeping the actual data on physical disk unchanged.
Why It Doesn't Meet the Requirement
Dynamic data masking operates at the database application and query presentation layer, not at the physical storage or datacenter infrastructure level. Because it does not encrypt the underlying data on disk, it does not satisfy the requirement for baseline storage encryption at rest.
Key Characteristics and Limitations
- Presentation Layer Focus: Masks sensitive values in real-time query responses without changing database storage.
- Role-Based Obfuscation: Prevents unauthorized personnel or applications from viewing plaintext data in results.
- Not Physical Encryption: Data stored on the physical datacenter hardware remains unmasked internally and relies on separate encryption mechanisms.
This Answer Would Be Correct If
The requirement was to limit exposure of sensitive database fields to non-privileged end users and application interfaces without modifying the underlying stored records.
Data at-rest encryption using platform-managed keys
Data at-rest encryption using platform-managed keys
What Platform-Managed Data at-Rest Encryption Is
Data at-rest encryption using platform-managed keys is a baseline security control implemented across Azure datacenter storage infrastructure. It automatically encrypts all customer content before it is committed to physical disks and transparently decrypts the data as soon as authorized access is granted.
How It Meets the Requirements
- Automatic Protection: Azure enables storage service encryption at rest by default for all workloads and persistent disks across its datacenters without requiring custom administrator setup.
- Zero Overhead: Microsoft manages the lifecycle, generation, and rotation of the underlying platform encryption keys, ensuring persistent security at the physical datacenter layer.
- Regulatory Alignment: Encrypting data at rest ensures compliance with major international standards such as ISO 27001, SOC 1/2/3, and PCI DSS by securing data against unauthorized media access.
Key Advantages and Capabilities
- Seamless Integration: Operates transparently with no performance impact or code modification needed on applications.
- FIPS 140-2 Validation: Uses standardized cryptographic modules and robust algorithms (such as 256-bit AES encryption).
- Comprehensive Coverage: Applies across virtual machine operating system disks, data disks, database storage, and backup repositories in Azure facilities.
Why This Is Optimal
This solution provides immediate, built-in protection across Azure datacenters. It satisfies enterprise compliance mandates instantly without introducing operational complexity or key management overhead for cloud administrators.
Customer Lockbox access approval workflow
Customer Lockbox access approval workflow
What Customer Lockbox Is
Customer Lockbox is an administrative access governance feature that ensures Microsoft cloud engineers cannot access customer content to perform support operations without explicit, time-bound approval from the customer.
Why It Doesn't Meet the Requirement
While Customer Lockbox is a valuable access control and compliance tool, it does not encrypt data stored on datacenter disks. It governs human operational access during technical support escalations rather than providing automated, continuous cryptographic data protection at rest.
Key Characteristics and Limitations
- Access Control Mechanism: Focuses on privileged access management rather than physical or logical cryptographic protection.
- Manual Approval Workflow: Requires tenant administrators to review and approve or reject support engineers' access requests.
- Limited Operational Scope: Only applies during direct support interactions and does not manage baseline storage encryption.
This Answer Would Be Correct If
The scenario required an organization to explicitly approve and control when Microsoft support engineers can access customer data during troubleshooting operations.
Customer-managed keys (CMK) stored in Azure Key Vault
Customer-managed keys (CMK) stored in Azure Key Vault
What Customer-Managed Keys (CMK) Are
Customer-managed keys (CMK) allow organizations to use their own encryption keys stored in Azure Key Vault to control data encryption and decryption across Azure cloud services.
Why It Doesn't Meet the Requirement
Although customer-managed keys deliver robust encryption at rest and fulfill strict compliance mandates, they are not enabled by default. Implementing CMK requires the customer to create and configure an Azure Key Vault, generate or import key material, and manage key rotation policies manually.
Key Characteristics and Limitations
- Explicit Setup Required: Must be provisioned and configured deliberately by organization administrators.
- Full Customer Responsibility: The organization bears operational responsibility for key lifecycle tasks, backup, and rotation.
- Advanced Control Tier: Sits on top of the default platform-managed encryption layer to provide granular control.
This Answer Would Be Correct If
The organization required complete ownership and lifecycle management of encryption keys to satisfy strict industry regulations requiring custom key custody.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Fault Domain
Describe Azure datacenters
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Datacenter Sustainability
Describe Azure datacenters
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Availability Zones Synchronous Replication
Describe Azure datacenters
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Datacenter
Describe Azure datacenters
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
ARM Template Secure Parameters
Describe Azure Resource Manager (ARM) and ARM templates
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated