AZ-500 Question 165
Select 2Your company maintains a FIPS 140-2 Level 2 compliant Hardware Security Module (HSM) on-premises for generating cryptographic keys. You need to import these keys into an Azure Key Vault configured with the Premium tier, ensuring that the key material remains protected at all times and never leaves an HSM unencrypted. Which two actions should you take to meet these requirements when configuring Bring your own key (BYOK)?
- A
Export the key from your on-premises HSM in plain text, then upload it directly to Azure Key Vault using the Azure Portal.
- B
Generate a Key Encryption Key (KEK) in your Azure Key Vault HSM, then use it to wrap your on-premises key before uploading.
- C
Use the on-premises HSM and the Azure Key Vault-provided public key to create a secure key transfer package for import.
- D
Enable a user-assigned managed identity in Azure Active Directory so the key is automatically synchronized from on-premises to Azure Key Vault.
Show answer and explanation
Correct answers: B, C
Explanation
To securely import your own key into Azure Key Vault (BYOK), you must ensure that keys generated on-premises are encrypted before they leave your HSM. Microsoft recommends creating a key transfer package using the public key from Azure Key Vault or using a KEK stored in Azure Key Vault to wrap the on-premises key. This protects the key in transit and preserves end-to-end HSM protection. For detailed steps and best practices, refer to the Microsoft Docs on BYOK with Azure Key Vault: https://docs.microsoft.com/azure/key-vault/keys/about-keys#bring-your-own-key-byok.
- A. Incorrect.
Incorrect. You should never export the key in plain text when doing BYOK. The entire purpose is to transfer the key securely, ensuring it remains HSM-protected and never exposed in clear form.
- B. Correct.
Correct. A recommended practice is to generate or use an existing Key Encryption Key (KEK) in your Azure Key Vault HSM to wrap (encrypt) your on-premises key, preventing exposure of its plain text during transit.
- C. Correct.
Correct. A secure BYOK process involves using a provided public key from the Azure Key Vault HSM to create a protected key transfer package. This ensures the key is encrypted before leaving your on-premises HSM.
- D. Incorrect.
Incorrect. While managed identities are useful for Azure resource authentication, they do not handle the secure import of on-premises encryption keys into Azure Key Vault. BYOK specifically relies on a secure key transfer mechanism, not an automated identity synchronization.