AZ-104 Question 87
Select 2You are the Azure Administrator for an organization that requires all data stored in Azure to be encrypted at rest using customer-managed keys from Azure Key Vault. You have created a new Azure Storage account and an Azure Key Vault to host your encryption key. Which two actions do you need to perform to properly configure server-side encryption using a key from Azure Key Vault?
- A
Select 'Azure Key Vault' as the key source and specify the key vault key URI under the Storage account's encryption settings
- B
Grant the Storage account the necessary permissions (e.g., Key Wrap/Unwrap) on the chosen key in Azure Key Vault
- C
Disable the 'Secure transfer required' setting on the new Storage account to enable key access
- D
Enable public anonymous access to the Storage account so that Key Vault can retrieve the key
Show answer and explanation
Correct answers: A, B
Explanation
To configure storage account encryption with a customer-managed key from Azure Key Vault, you must first set the Storage account to use 'Azure Key Vault' as the key source and provide the vault's key URI. Then, you must grant the Storage account appropriate permissions on the key in Azure Key Vault so it can perform encryption and decryption operations. Disabling 'Secure transfer required' and enabling public access are not required for encryption and could introduce security vulnerabilities.
- A. Correct.
Specifying 'Azure Key Vault' as the key source and providing the key identifier is essential for customer-managed keys.
- B. Correct.
Granting the Storage account the right Key Vault permissions (Key Wrap/Unwrap) is mandatory so the account can use the key for encryption and decryption.
- C. Incorrect.
Disabling 'Secure transfer required' weakens security and is not necessary for configuring customer-managed keys.
- D. Incorrect.
Enabling public anonymous access is unrelated to key retrieval and would pose a security risk.