AZ-104 Question 86
Select 3You are an Azure Administrator at Contoso. The company requires all data stored in a new Azure Storage account to be encrypted at rest using a customer-managed key (CMK) that is stored in an Azure Key Vault. You must ensure you have full control over key rotation and the ability to revoke key access at any time. Which actions should you take to properly configure this requirement?
- A
Create or import a key into Azure Key Vault
- B
Enable Cross-Region Replication for the storage account
- C
Enable Infrastructure Encryption for double encryption
- D
Configure the storage account’s encryption settings to use a key from Key Vault
- E
Grant the Storage account principal the necessary access rights (e.g., get, wrapKey, unwrapKey) on the Key Vault key
Show answer and explanation
Correct answers: A, D, E
Explanation
To configure encryption at rest with a customer-managed key, you need a key in Azure Key Vault, update the storage account’s encryption settings to reference that key, and ensure proper permissions so the Storage account can access the key.
- A. Correct.
You must have a key in Key Vault to use as the customer-managed key. This is a prerequisite for any CMK scenario.
- B. Incorrect.
Cross-Region Replication is unrelated to customer-managed encryption requirements. It is primarily a redundancy feature.
- C. Incorrect.
Infrastructure Encryption provides an additional layer of encryption but is not mandatory for a basic CMK scenario.
- D. Correct.
You must update the storage account’s encryption settings to specify the Key Vault key you wish to use for encryption.
- E. Correct.
Granting the Storage account principal the correct permissions to read and use the key is essential for CMK integration.