AZ-500 Question 166
Single answerYour organization must meet strict compliance requirements that mandate double encryption at the Azure Storage infrastructure level. Currently, you have an Azure premium performance tier storage account storing highly confidential data. You need to ensure that both new and existing data in this storage account are protected with infrastructure encryption (double encryption). Which approach would best accomplish this requirement?
- A
Modify the existing premium storage account to enable infrastructure encryption using the Azure CLI.
- B
Create a new premium storage account with infrastructure encryption enabled and migrate all existing data to this new account.
- C
Use Azure Key Vault to enable 'double encryption' on the existing premium storage account.
- D
No configuration changes are necessary, because premium storage accounts are automatically configured with infrastructure encryption.
Show answer and explanation
Correct answer: B
Explanation
To enable double encryption at the Azure Storage infrastructure level, you must select infrastructure encryption when creating a new storage account. Azure does not permit enabling this feature on existing storage accounts. Therefore, the recommended approach for existing data is to create a new account that has infrastructure encryption turned on and migrate data over. Refer to Microsoft Docs (https://learn.microsoft.com/azure/storage/common/infrastructure-encryption-enable) for detailed steps and considerations.
- A. Incorrect.
Option 1 is incorrect. Infrastructure encryption for Azure Storage can only be enabled at the time of creating a new storage account. It cannot be retroactively enabled on an existing account.
- B. Correct.
Option 2 is correct. To use double encryption (also known as infrastructure encryption) for both new and existing data, you must create a new storage account with infrastructure encryption enabled and then migrate your existing data. This ensures all data is encrypted at the infrastructure level in addition to the default server-side encryption.
- C. Incorrect.
Option 3 is incorrect. Azure Key Vault manages keys for server-side encryption but does not toggle infrastructure encryption. Key Vault integration manages customer-managed keys at software level, not the additional physical layer encryption.
- D. Incorrect.
Option 4 is incorrect. Premium storage accounts are not automatically configured with infrastructure encryption. This is an optional setting that must be selected when creating the account.