Microsoft Certified: Azure Developer Associate (AZ-204)Develop for Azure storageHard
A developer is designing a system where sensitive customer documents need to be stored in Azure Blob Storage. The company's compliance policy mandates that encryption keys for this data must be managed and controlled entirely by the company, not by Microsoft. Which encryption option should the developer implement for the Blob Storage account?
- AStorage Service Encryption (SSE) with customer-managed keys (CMK)
- BStorage Service Encryption (SSE) with Microsoft-managed keys
- CHTTPS encryption in transit
- DClient-side encryption
Show answer & explanationAnswer & explanation
Correct answer: A. Storage Service Encryption (SSE) with customer-managed keys (CMK)
Storage Service Encryption (SSE) with customer-managed keys (CMK) allows the company to use their own encryption keys stored in Azure Key Vault for data at rest in Blob Storage. This meets the compliance requirement for company control over encryption keys.
Why the other options are wrong
- B. Microsoft-managed keys are controlled by Microsoft, not the customer, violating the policy.
- C. HTTPS encryption protects data in transit, but the policy specifies control over encryption keys for data at rest.
- D. Client-side encryption requires explicit application-level encryption/decryption, which is not what 'encryption keys for this data must be managed and controlled entirely by the company' implies for data at rest in the storage account itself.
Azure Storage Customer-Managed Keys (CMK)
Customer-managed keys (CMK) for Azure Storage allows customers to use their own encryption keys stored in Azure Key Vault to encrypt data at rest within their Azure Storage accounts, providing full control over the key lifecycle.
- Encrypts data at rest in Azure Storage.
- Keys are stored and managed in Azure Key Vault.
- Customer retains full control over key lifecycle (creation, rotation, revocation).
- Meets strict compliance requirements for key ownership.
Memory trick: Microsoft manages some, you manage yours, or you do it yourself.