Microsoft Certified: Azure Security Engineer AssociateSecure data and applicationsHard
A media company uses Azure Blob Storage to store large volumes of video assets. They require that all new blobs uploaded to a specific container are automatically encrypted using a customer-managed key (CMK) from Azure Key Vault. Additionally, they need to ensure that the encryption key used for these blobs is automatically rotated every 90 days without manual intervention. Which Azure Storage feature should be utilized?
- AStorage account encryption with customer-managed keys (CMK) and auto-rotation
- BAzure Disk Encryption
- CStorage account encryption with service-managed keys
- DClient-side encryption
Show answer & explanationAnswer & explanation
Correct answer: A. Storage account encryption with customer-managed keys (CMK) and auto-rotation
Storage account encryption with customer-managed keys (CMK) directly addresses the requirement for encrypting data at rest using customer-controlled keys. The integration with Azure Key Vault allows for configuring automatic key rotation, fulfilling all specified criteria.
Why the other options are wrong
- B. Azure Disk Encryption is for encrypting virtual machine disks, not Azure Blob Storage.
- C. Service-managed keys do not provide customer control over the encryption keys, failing the CMK requirement.
- D. Client-side encryption requires the application to handle encryption before uploading, which is not 'automatic' at the storage account level and doesn't leverage Key Vault's auto-rotation directly for storage encryption.
Storage Account CMK with Auto-rotation
Azure Storage account encryption using customer-managed keys (CMK) stored in Azure Key Vault, configured for automatic key rotation.
- Encrypts all data at rest in the storage account (blobs, files, queues, tables).
- Keys are managed by the customer in Azure Key Vault.
- Azure Key Vault supports automatic key rotation for CMKs.
Memory trick: CMK Auto-rotate: Your storage's personal key, always fresh from the vault.