Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Key Vault HSM Protection for Keys and Secrets
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is deploying a business workflow solution using Azure Platform as a Service (PaaS) capabilities. To satisfy strict corporate security and compliance mandates, the organization requires that all cryptographic keys and application secrets be stored in dedicated Hardware Security Modules (HSMs) validated to Federal Information Processing Standards (FIPS) 140, allowing the organization to maintain full control over key lifecycles with customer-managed keys.
Which Azure service should the organization implement to fulfill these key management and data protection requirements?
Explanations
Azure Key Vault
Azure Key Vault
What Azure Key Vault is
Azure Key Vault is a centralized cloud service designed for securely storing and managing application secrets, encryption keys, and TLS/SSL certificates. It provides robust security controls by safeguarding cryptographic keys and secrets within Hardware Security Modules (HSMs), ensuring sensitive configuration data and keys are not exposed in plaintext or embedded in application code.
How it meets the compliance and key management requirements
- FIPS 140 Validation: Azure Key Vault utilizes cryptographic modules and underlying hardware security modules that comply with FIPS 140 standards, providing validated cryptographic protection for high-assurance workloads.
- Customer-Managed Keys (CMK): It supports customer-managed keys, giving organizations complete control over the creation, rotation, and revocation of the keys used to encrypt data at rest across PaaS services.
- Bring Your Own Key (BYOK): Key Vault enables customers to generate or import keys into HSMs securely, ensuring that the private keys never leave the HSM protection boundary.
- Unified PaaS Integration: Azure PaaS offerings seamlessly integrate with Key Vault, allowing applications to retrieve secrets and reference keys securely at runtime without hardcoding credentials.
Key advantages and capabilities
- Centralized secret management: Consolidates tokens, passwords, certificates, and API keys into a single protected repository.
- Granular access policies: Enforces access control through Microsoft Entra ID authentication and Azure Role-Based Access Control (RBAC).
- Full lifecycle oversight: Enables automated key rotation, expiration alerts, and comprehensive auditing of key access logs.
- Cryptographic certainty: Ensures that deleting or revoking a key immediately renders the encrypted data inaccessible.
Why this is optimal
Azure Key Vault is specifically engineered to manage encryption keys, secrets, and certificates securely while adhering to government and enterprise standards such as FIPS 140. It directly satisfies the scenario requirements by offering HSM-backed customer-controlled key protection.
Azure Policy
Azure Policy
What Azure Policy is and does
Azure Policy is a governance service in Microsoft Azure that enables administrators to create, assign, and manage policy definitions. It evaluates resource configurations across subscriptions and resource groups to enforce organizational conventions, enforce baseline standards, and assess compliance at cloud scale.
Why it doesn't meet the requirement
While Azure Policy can audit or enforce rules requiring that PaaS services use customer-managed keys or connect to a key vault, it does not act as a secure key store or cryptographic module itself. It cannot store encryption keys, protect secrets, or provide FIPS 140-validated Hardware Security Modules (HSMs).
Key characteristics and limitations
- Governance enforcement: Evaluates resource properties and configuration settings against declarative rules.
- No secret storage: Lacks any mechanism for storing credentials, cryptographic keys, or certificates.
- Automated remediation: Can remediate non-compliant resource settings (such as enabling encryption settings), but relies on other services for key provisioning.
- Preventive controls: Prevents the creation of resources that violate organizational compliance policies.
This answer would be correct if
The scenario required an administrative tool to automatically audit cloud resources, prevent non-compliant deployments, or mandate that all storage accounts enforce specific compliance settings across an entire tenant.
Additional context
Azure Policy works synergistically with Azure Key Vault by allowing governance teams to define rules that restrict resource creation unless integration with Azure Key Vault is configured.
Azure Resource Manager
Azure Resource Manager
What Azure Resource Manager is and does
Azure Resource Manager (ARM) is the central deployment and management service for Azure. It provides a management layer that allows administrators and developers to create, update, and delete resources in an Azure subscription through declarative templates, the Azure portal, software development kits (SDKs), or command-line interfaces.
Why it doesn't meet the requirement
Azure Resource Manager manages the control plane infrastructure of Azure resources but does not provide cryptographic hardware storage or key lifecycle management. It does not contain Hardware Security Modules (HSMs) or manage secret values and encryption keys directly.
Key characteristics and limitations
- Consistent management layer: Handles all incoming API requests to deploy, configure, or tag Azure resources.
- Declarative deployments: Uses ARM templates and Bicep files to deploy cloud infrastructure in a repeatable manner.
- Access control boundary: Implements Azure RBAC across management operations.
- No cryptographic processing: Does not generate, rotate, or store customer cryptographic keys or secrets.
This answer would be correct if
The requirement was to provide a centralized management framework and declarative templating engine for provisioning PaaS and IaaS resources consistently across an organization.
Additional context
When deploying resources with ARM templates, parameters can securely reference secrets stored in Azure Key Vault rather than storing sensitive strings directly inside template files.
Microsoft Purview
Microsoft Purview
What Microsoft Purview is and does
Microsoft Purview (formerly Azure Purview) is a comprehensive data governance and compliance service. It helps organizations discover, catalog, classify, and manage sensitive data assets across multi-cloud, on-premises, and software-as-a-service (SaaS) environments.
Why it doesn't meet the requirement
Although Microsoft Purview assists with data protection by identifying and labeling sensitive data, it does not serve as a cryptographic key management solution. It does not provide FIPS 140-validated Hardware Security Modules (HSMs) for key generation, storage, or customer-managed encryption key lifecycle operations.
Key characteristics and limitations
- Automated data discovery: Scans enterprise data estates to locate where sensitive information resides.
- Data classification and labeling: Applies metadata tags based on predefined or custom sensitivity rules.
- Data lineage tracking: Visualizes how data moves and transforms throughout an organization's systems.
- No cryptographic vaulting: Does not store or manage encryption keys, connection strings, or application credentials.
This answer would be correct if
The organization needed to discover, classify, and monitor sensitive customer information and detect data loss across multiple PaaS data stores.
Additional context
Data discovery and classification solutions like Microsoft Purview identify which databases hold sensitive data, highlighting which PaaS services require customer-managed key encryption via Azure Key Vault.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Platform as a Service (PaaS)
Describe platform as a service (PaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Platform as a Service (PaaS)
Describe platform as a service (PaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure App Service and Azure SQL Database PaaS
Describe platform as a service (PaaS)
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Advisor Operational Excellence Category
Describe the purpose of Azure Advisor
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Locally Redundant Storage (LRS)
Describe redundancy options
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated