Microsoft Certified: Azure Solutions Architect ExpertDesign infrastructure solutionsHard
A healthcare provider is deploying a new application that will store highly sensitive patient records. To meet stringent compliance requirements, all data at rest must be encrypted using encryption keys that the organization fully controls and manages within a FIPS 140-2 Level 3 validated hardware security module (HSM). Which Azure key management solution should be used?
- AAzure Key Vault with customer-managed keys (CMK) stored in an HSM
- BAzure Disk Encryption with platform-managed keys
- CAzure Key Vault with software-protected customer-managed keys
- DAzure Storage Service Encryption with Microsoft-managed keys
Show answer & explanationAnswer & explanation
Correct answer: A. Azure Key Vault with customer-managed keys (CMK) stored in an HSM
Azure Key Vault, when configured with customer-managed keys (CMK) backed by a FIPS 140-2 Level 3 validated HSM, provides the highest level of control over encryption keys, meeting the stringent compliance requirements for sensitive data like patient records.
Why the other options are wrong
- B. Platform-managed keys do not give the customer control over the keys.
- C. Software-protected CMK in Key Vault offers control but does not meet the explicit requirement for FIPS 140-2 Level 3 validated hardware security module (HSM) backing.
- D. Microsoft-managed keys do not provide full control to the organization, failing the 'organization fully controls and manages' requirement.
Azure CMK with HSM
Using Customer-Managed Keys (CMK) in Azure, where the keys are stored and protected within a Hardware Security Module (HSM) in Azure Key Vault. This provides the highest level of control and security for encryption keys, often required for strict regulatory compliance.
- Customer retains full control over encryption keys
- Keys are protected by FIPS 140-2 Level 2 or Level 3 validated HSMs
- Separation of duties between data owner and cloud provider
- Used for various Azure services like Storage, SQL DB, Disk Encryption
Memory trick: For ultimate key control, 'CMK in HSM' is the gold standard.