Microsoft Certified: Azure Solutions Architect ExpertDesign infrastructure solutionsHard
A company is designing a new application that will store highly sensitive customer data. The data at rest must be encrypted using customer-managed keys (CMK) in a hardware security module (HSM). The application requires low-latency access to this data. Which Azure storage solution should be recommended?
- AAzure Disk Storage with customer-managed keys in Azure Key Vault
- BAzure Cosmos DB with customer-managed keys in Azure Key Vault HSM
- CAzure Files with platform-managed keys
- DAzure Blob Storage with platform-managed keys
Show answer & explanationAnswer & explanation
Correct answer: B. Azure Cosmos DB with customer-managed keys in Azure Key Vault HSM
Azure Cosmos DB provides low-latency access to globally distributed, highly available data. It supports customer-managed keys (CMK) stored in Azure Key Vault, including the option to use Key Vault's HSM-backed keys, directly addressing the requirements for sensitive data encryption with CMK in an HSM and low-latency access.
Why the other options are wrong
- A. Azure Disk Storage is for VM disks, not a general application data store, and while it supports CMK, Cosmos DB is better for low-latency application data.
- C. Azure Files with platform-managed keys does not meet the 'customer-managed keys in HSM' requirement.
- D. Azure Blob Storage supports CMK, but the question specifies HSM-backed keys for sensitive data, and Cosmos DB is better for low-latency application data.
Azure CMK with HSM
Customer-Managed Keys (CMK) allow customers to control the encryption keys used for data at rest. Azure Key Vault HSM provides FIPS 140-2 Level 2 validated hardware security modules for key protection.
- CMK provides greater control over encryption keys.
- Azure Key Vault stores and manages CMK.
- HSM-backed keys offer the highest level of key security.
- Supported by various Azure services like Cosmos DB, Storage, SQL.
Memory trick: CMK with HSM gives you the 'key' to security for 'sensitive' data.