AZ-500 Question 167
Single answerYour organization has strict compliance requirements that mandate double encryption for data stored at rest. You currently use a standard Azure Storage account with Microsoft-managed keys (SSE), and now you need to ensure infrastructure-level encryption as an additional layer. What is the correct way to enable double encryption at the Azure Storage infrastructure layer for this scenario?
- A
Modify the existing Storage account’s properties to enable infrastructure encryption in the Azure portal
- B
Set up a Key Vault and configure customer-managed keys to achieve double encryption on the existing Storage account
- C
Create a new Storage account with the infrastructure encryption feature enabled at the time of creation
- D
Run an Azure PowerShell command against the existing Storage account to activate the double encryption feature
Show answer and explanation
Correct answer: C
Explanation
Azure Storage accounts can be configured to enforce double encryption (infrastructure encryption), but only during creation. This feature enhances security by encrypting data once at the storage service level and once again at the infrastructure layer. Once a Storage account is provisioned, you cannot retroactively enable infrastructure encryption. For more details, refer to Azure documentation on storage infrastructure encryption.
- A. Incorrect.
Incorrect. Once a Storage account is created without infrastructure encryption, you cannot simply toggle it on. Infrastructure encryption is not a post-creation property you can enable in the portal.
- B. Incorrect.
Incorrect. Customer-managed keys offer additional control over the encryption key, but this does not enable infrastructure encryption. Infrastructure encryption is a separate feature at the physical layer.
- C. Correct.
Correct. Infrastructure encryption can only be configured when creating a new Storage account. This ensures the data is encrypted twice: once with standard encryption and once with the infrastructure layer.
- D. Incorrect.
Incorrect. There is no command or script that can retroactively enable infrastructure encryption on an existing Storage account. It must be set at the account creation phase.