Microsoft Cybersecurity Architect (SC-100)Design security for infrastructureHard
A large enterprise is migrating its data warehouse to Azure Synapse Analytics. The data contains highly sensitive customer information, and compliance regulations require that all data in the data warehouse be encrypted at rest using customer-managed encryption keys (CMK) stored in a hardware security module (HSM). The solution must also ensure that the encryption keys are never exposed to Azure's control plane. Which Azure Key Vault feature, combined with Synapse Analytics, meets these requirements?
- AAzure Key Vault with standard (software) keys
- BAzure Key Vault Managed HSM
- CAzure Key Vault with service-managed keys
- DAzure Key Vault with soft-delete enabled
Show answer & explanationAnswer & explanation
Correct answer: B. Azure Key Vault Managed HSM
Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated HSMs for storing customer-managed keys, ensuring that keys are hardware-protected and never leave the HSM, meeting the stringent requirement of CMK stored in an HSM and isolated from Azure's control plane.
Why the other options are wrong
- A. Standard Key Vault stores keys in software, not in a dedicated HSM, failing the 'HSM' requirement.
- C. Service-managed keys are managed by Azure, not the customer, failing the 'customer-managed' requirement.
- D. Soft-delete is a recovery feature for accidental deletion, not related to the type of key storage (software vs. HSM) or key management.
Azure Key Vault Managed HSM
Azure Key Vault Managed HSM (Hardware Security Module) is a fully managed, highly available, single-tenant, standards-compliant cloud service that safeguards cryptographic keys using FIPS 140-2 Level 3 validated HSMs.
- Dedicated, single-tenant HSMs for customer.
- FIPS 140-2 Level 3 validated for cryptographic security.
- Customer-managed keys with full control over key lifecycle.
- Keys never leave the HSM boundary, even for Azure administrators.
Memory trick: HSM for Highest Security, Software for Standard, Service for Simplicity.