Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Customer-Managed Keys for Azure Storage Encryption
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization stores business records in an Azure Storage account. By default, Azure automatically encrypts all data at rest using Microsoft-managed keys. To satisfy strict regulatory compliance requirements, the security team must retain full control over the encryption keys used for encrypting and decrypting data.
Which service should the organization use to store and control customer-managed keys for storage encryption?
Explanations
Azure Resource Locks
Azure Resource Locks
What Azure Resource Locks are
Azure Resource Locks are management safeguards applied at the subscription, resource group, or resource level to protect Azure resources from accidental deletion or unintended modifications.
Why it doesn't meet the requirement
Resource locks manage control plane operations (such as ReadOnly or CanNotDelete), but they have no capability related to cryptography, data encryption, or cryptographic key lifecycle management. Applying a lock to a storage account prevents accidental deletion or configuration edits, but does not manage encryption keys.
Key characteristics and limitations
- Lock types: Supports two lock modes: CanNotDelete (users can read and modify resources but cannot delete them) and ReadOnly (users can only read resources).
- Broad administrative scope: Applies restrictions to all users regardless of their role-based permissions until explicitly removed.
- No cryptographic features: Does not interact with data at rest encryption or store security secrets.
This answer would be correct if
The scenario required preventing administrators or automated scripts from accidentally deleting an Azure Storage account or altering its core infrastructure settings.
Additional context
While resource locks help maintain resource availability and integrity by avoiding deletion accidents, data confidentiality at rest is handled separately through Azure Storage encryption and Azure Key Vault.
Azure Key Vault
Azure Key Vault
What Azure Key Vault is
Azure Key Vault is a centralized cloud service for securely storing, managing, and controlling access to application secrets, cryptographic keys, and digital certificates. It provides hardware security module (HSM) backed protection and robust access policies to safeguard critical credentials and cryptographic material.
How it meets the compliance requirement
When configuring Azure Storage encryption for data at rest, organizations can choose between Microsoft-managed keys (the default) and customer-managed keys (CMK). By integrating Azure Storage with Azure Key Vault, organizations can create, store, and manage their own encryption keys. This ensures that the organization maintains direct ownership and oversight of the keys used to encrypt and decrypt stored blob and file data.
Key advantages and capabilities
- Centralized key management: Consolidates cryptographic key creation, rotation, and lifecycle controls into a dedicated, secure repository.
- Full key lifecycle control: Enables organizations to rotate, revoke, backup, and delete keys according to corporate security policies.
- Granular access monitoring: Integrates with logging tools to provide full visibility into every attempt to access or use the cryptographic keys.
- Regulatory compliance: Assists organizations in meeting stringent regulatory mandates that prohibit third-party management of root encryption keys.
Why this is optimal
Azure Key Vault is the native and optimal solution in Microsoft Azure for managing customer-managed encryption keys. It seamlessly coordinates with Azure Storage to provide envelope encryption, allowing automated data protection while leaving key governance entirely under administrative control.
Azure Policy
Azure Policy
What Azure Policy is
Azure Policy is a cloud governance service that evaluates resource configurations against organizational standards and compliance rules. It enables administrators to define, assign, and enforce policies that audit or restrict resource properties across subscriptions and management groups.
Why it doesn't meet the requirement
While Azure Policy can evaluate compliance—such as checking whether storage accounts require customer-managed keys or monitoring if access keys are rotated—it is a governance and auditing tool rather than a key storage system. It cannot store, create, or process cryptographic encryption keys itself.
Key characteristics and limitations
- Auditing and enforcement: Evaluates resource configurations to prevent non-compliant deployments or flag existing non-compliant assets.
- Rule definitions: Uses JSON-based rules to enforce conventions like naming standards, permitted regions, and required resource tags.
- No secret storage: Lacks any capability to generate, manage, or store cryptographic keys or security credentials.
This answer would be correct if
The scenario asked for a governance tool to automatically detect and flag storage accounts that do not have key rotation or encryption policies assigned across the entire subscription.
Additional context
Azure Policy and Azure Key Vault complement each other: administrators use Azure Policy to mandate that all storage accounts utilize customer-managed keys sourced from Azure Key Vault.
Azure Role-Based Access Control (Azure RBAC)
Azure Role-Based Access Control (Azure RBAC)
What Azure Role-Based Access Control (Azure RBAC) is
Azure Role-Based Access Control (Azure RBAC) is an authorization system built on Azure Resource Manager that provides fine-grained access management for Azure resources. It determines which users, groups, or managed identities have permission to perform specific management or data actions.
Why it doesn't meet the requirement
Azure RBAC manages identity permissions and privileges, defining who can access a storage account or who can read keys from a vault. However, it is an authorization mechanism, not a cryptographic key storage service. It does not generate, store, or manage customer-managed encryption keys.
Key characteristics and limitations
- Access assignment: Assigns permissions by binding security principals (users, groups, service principals) to specific roles at defined scopes.
- Built-in and custom roles: Provides standard roles (such as Owner, Contributor, and Reader) as well as tailored custom roles.
- Identity-focused: Governs user access rights but does not provide hardware security module (HSM) key storage or data encryption algorithms.
This answer would be correct if
The scenario required granting specific administrators the ability to manage storage accounts without granting them permissions to delete underlying resource groups.
Additional context
Azure RBAC is often used in combination with Azure Key Vault to control which administrators or managed service identities are permitted to access and manage the keys stored within the vault.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage Archive Tier
Describe storage account options and storage types
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Files
Describe storage account options and storage types
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
General-purpose v2 Storage Account
Describe storage account options and storage types
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Geo-Redundant Storage (GRS)
Describe storage account options and storage types
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Virtual Machine Scale Sets
Describe the benefits of high availability and scalability in the cloud
AdvancedAZ-104 Microsoft Azure Administrator Exam
Availability Zones High Availability
Deploy virtual machines to availability zones and availability sets
Last updated Validated