Microsoft Certified: Azure Developer Associate (AZ-204)Implement Azure securityHard
A financial services company is developing a new serverless application using Azure Functions. The application will process highly sensitive customer financial data and must comply with strict regulatory requirements for data encryption at rest, including customer-managed encryption keys (CMEK). Which Azure storage encryption option should be used for the data stored by the Azure Function?
- ACustomer-managed keys (CMK) with Azure Key Vault
- BMicrosoft-managed keys (MMK)
- CClient-side encryption
- DStorage Service Encryption (SSE) with platform-managed keys
Show answer & explanationAnswer & explanation
Correct answer: A. Customer-managed keys (CMK) with Azure Key Vault
Customer-managed keys (CMK) with Azure Key Vault allows organizations to use their own encryption keys to protect data at rest in Azure storage. This provides granular control over the encryption keys, which is often a requirement for strict regulatory compliance, as opposed to Microsoft-managed or platform-managed keys.
Why the other options are wrong
- B. Microsoft-managed keys are the default and don't provide the customer control over keys required by CMEK.
- C. Client-side encryption encrypts data before it leaves the client, which offers strong protection but is not typically considered 'storage encryption at rest' from the perspective of managing keys for the storage service itself, and often has operational complexities with search/indexing.
- D. Storage Service Encryption (SSE) with platform-managed keys is essentially the same as Microsoft-managed keys; it doesn't meet the 'customer-managed' requirement.
Customer-Managed Keys (CMK)
An encryption option that allows customers to use and manage their own encryption keys, typically stored in Azure Key Vault, to encrypt data at rest in Azure services.
- Provides granular control over encryption keys
- Often required for regulatory compliance (e.g., FIPS, HIPAA)
- Keys are stored and managed in Azure Key Vault
Memory trick: CMK: My keys, my control, my vault.