Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Azure Storage Encryption at Rest by Default
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization stores sensitive financial records and customer backups in Azure Blob Storage across multiple access tiers, including Hot, Cool, and Archive.
The compliance department mandates that all stored data must be encrypted at rest without requiring application code changes or manual management overhead.
Which built-in security feature fulfills this requirement across all storage tiers?
Explanations
BitLocker Drive Encryption configured manually on individual storage containers across each tier.
BitLocker Drive Encryption configured manually on individual storage containers across each tier.
What BitLocker Drive Encryption Is
BitLocker Drive Encryption is an operating-system-level volume encryption feature designed for Windows operating systems and historically used by Azure Disk Encryption (ADE) for virtual machine virtual hard disks (VHDs).
Why It Doesn't Meet the Requirement
- Inapplicable to Object Storage: BitLocker operates on operating system partitions and local disks within virtual machines; it cannot be installed or configured on cloud-native Azure Blob Storage containers or individual blob access tiers.
- Manual Overhead: The requirement specifies a solution with zero manual overhead, whereas configuring OS-level disk encryption requires administrative deployment, maintenance, and virtual machine management.
Key Characteristics and Limitations
- Host/OS Dependency: Functions at the guest OS level rather than the native Azure cloud storage infrastructure layer.
- Limited Scope: Encrypts virtual machine OS and data volumes, not shared cloud PaaS resources like Blob Storage.
- Deprecation Path: Legacy Azure Disk Encryption based on BitLocker is scheduled for retirement in favor of host-based encryption.
This Answer Would Be Correct If
You were securing the operating system drive of a Windows IaaS Virtual Machine using guest-level tools rather than securing multi-tiered cloud Blob Storage.
Transport Layer Security (TLS) encryption in transit, which automatically encrypts disks at rest when customer-managed keys are uploaded.
Transport Layer Security (TLS) encryption in transit, which automatically encrypts disks at rest when customer-managed keys are uploaded.
What TLS Encryption in Transit Is
Transport Layer Security (TLS) is a cryptographic protocol designed to provide secure communications over a computer network, securing data in transit across the internet or private networks.
Why It Doesn't Meet the Requirement
- Protects Transit, Not Storage: TLS encrypts data while it travels between a client and an Azure endpoint over HTTPS/REST APIs, but it does not protect data at rest on physical disks.
- Confuses Key Types: Uploading customer-managed keys is not a prerequisite for encryption at rest; Azure automatically provides default encryption at rest using platform-managed keys without requiring any customer configuration.
Key Characteristics and Limitations
- Network Protocol: Operates at the transport layer of network communication (such as enforcing TLS 1.2 or higher).
- Complimentary Control: Works alongside encryption at rest as part of a defense-in-depth strategy, rather than substituting for it.
This Answer Would Be Correct If
The scenario required protecting network communication against eavesdropping or man-in-the-middle attacks while data is moving across the internet to the storage endpoint.
Storage encryption enabled exclusively on the Hot tier, with third-party software required for Cool and Archive tiers.
Storage encryption enabled exclusively on the Hot tier, with third-party software required for Cool and Archive tiers.
What Tier-Specific Manual Encryption Suggests
This option posits that Azure Storage encryption is restricted to high-performance or active tiers like the Hot tier, leaving colder tiers unencrypted unless third-party tools are deployed.
Why It Doesn't Meet the Requirement
- Misunderstands Azure Architecture: Azure Storage does not partition its security features by tier. Native encryption at rest is applied universally across the Hot, Cool, and Archive tiers.
- Unnecessary Third-Party Overhead: Introducing third-party tools adds architectural complexity, administrative overhead, and additional licensing costs that are completely unnecessary in Azure.
Key Characteristics and Limitations
- Consistent Security Fabric: Storage access tiers differ in performance, access latency, and pricing models, but all share the same underlying security and encryption standards.
- Built-in Compliance Scope: Independent third-party audits such as SOC, ISO, and PCI DSS include all tiers—including Cool storage and Archive storage—within their compliance scope.
This Answer Would Be Correct If
Azure required custom client-side encryption modules to process cold data before moving it into long-term archival storage, which is not the case.
Azure Storage automatically encrypts all data at rest by default using 256-bit AES encryption.
Azure Storage automatically encrypts all data at rest by default using 256-bit AES encryption.
What Azure Storage Service Encryption Is
Azure Storage encryption (also known as Server-Side Encryption or SSE) is a built-in security capability that automatically protects and encodes all data persisted to Azure Storage. It applies universally across all storage types—including Azure Blob Storage, Azure Files, Azure Tables, and Azure Queues—as well as across all access tiers such as Hot, Cool, and Archive.
How It Meets the Requirements
- Automatic Encryption at Rest: All data written to Azure Storage is seamlessly encrypted on disk using industry-standard 256-bit AES (Advanced Encryption Standard) encryption.
- Zero Management Overhead: By default, Azure manages the lifecycle of encryption keys using platform-managed keys (PMKs), requiring zero configuration or maintenance from administrators.
- Universal Tier Support: SSE operates at the storage infrastructure layer, ensuring that data transitioned between the Hot, Cool, and Archive tiers remains encrypted throughout its entire lifecycle.
- No Code Changes: Encryption and decryption occur transparently below the application layer, allowing workloads to read and write data normally without custom security code.
Key Advantages and Capabilities
- Defense-in-Depth: Protects persistent physical media against unauthorized extraction and physical hardware theft.
- Regulatory Compliance: Satisfies stringent compliance standards, including PCI DSS, HIPAA, FedRAMP, and ISO/IEC 27001.
- Flexible Key Management: Supports transitioning to customer-managed keys (CMK) hosted in Azure Key Vault if specialized regulatory governance is needed.
- Transparent Decryption: Automatically decrypts data when authorized users and services retrieve it.
Why This Is Optimal
Built-in Azure Storage encryption provides enterprise-grade data security out of the box at no additional cost. It eliminates the operational complexity of designing bespoke encryption pipelines while guaranteeing continuous compliance across all storage tiers.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage Archive Tier
Describe storage tiers
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Storage Lifecycle Management
Describe storage tiers
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure File Sync Cloud Tiering
Describe storage tiers
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Archive Tier
Describe storage tiers
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Network Security Group
Describe the resources required for virtual machines
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated