AZ-500 Question 163
Single answerYour company maintains a master key in an on-premises Hardware Security Module (HSM) and wants to use a Bring Your Own Key (BYOK) approach with Azure Key Vault to protect sensitive data in the cloud. You need to ensure the key remains hardware-protected and is never exposed in plaintext outside of the HSM. What is the correct method for importing the key into Azure Key Vault using BYOK?
- A
Export the master key in plaintext from the on-premises HSM and import it directly into Azure Key Vault using the Azure portal’s ‘Import Key’ option.
- B
Generate the master key in Azure Key Vault as a soft key, export it to the on-premises HSM for signing, and then re-import it into Key Vault as an HSM-protected key.
- C
Wrap the master key within the on-premises HSM using a key transfer package from Azure Key Vault, then upload the wrapped key to Key Vault via PowerShell or CLI.
- D
Use Azure Key Vault to generate a self-signed certificate and sign the on-premises HSM key with that certificate before importing it into Key Vault.
Show answer and explanation
Correct answer: C
Explanation
In a BYOK scenario, Microsoft recommends using a key transfer package to wrap the on-premises HSM key so it remains protected throughout the import process. This package is obtained from Azure Key Vault and used to wrap the master key in the on-premises HSM. Once wrapped, the key is imported into Azure Key Vault without ever being exposed in plaintext. For more details, refer to the official documentation: https://learn.microsoft.com/azure/key-vault/keys/byok
- A. Incorrect.
Incorrect. Exporting the master key in plaintext defeats the purpose of BYOK and violates security best practices. The key should remain protected by the HSM during transit to ensure it’s never accessible in unencrypted form.
- B. Incorrect.
Incorrect. You cannot generate a soft key in Azure Key Vault and later convert it into an HSM-protected key. Also, exporting any key from Azure Key Vault in plaintext is not supported when HSM protection is required.
- C. Correct.
Correct. The recommended BYOK process involves generating a key transfer package from Azure Key Vault, wrapping the on-premises HSM key with it, and then importing the wrapped key into the Key Vault HSM. This ensures the key remains protected by cryptographic boundaries at all times.
- D. Incorrect.
Incorrect. While certificates can be used for certain signing operations, this approach does not follow the official Microsoft BYOK guidance for securely importing a hardware-protected key. Simply signing the on-premises key with a self-signed certificate does not guarantee the key remains hardware-bound.