AZ-500 Question 168
Select 2You are developing a new Azure Storage account for an application that handles highly sensitive financial data. Your compliance requirements state that data at rest must be protected by two layers of encryption at the infrastructure level. Which two statements accurately describe the steps or requirements to enable double encryption (Infrastructure Encryption) for this new storage account?
- A
- You must enable Infrastructure Encryption when creating the storage account, as it cannot be enabled after creation.
- B
- You can enable Infrastructure Encryption on existing storage accounts by toggling it in the Encryption blade of the Azure portal.
- C
- You need to ensure the storage account uses a region that supports Infrastructure Encryption, as not all regions may support this feature.
- D
- Infrastructure Encryption replaces the default server-side encryption with platform-managed keys, so you must disable server-side encryption first.
Show answer and explanation
Correct answers: A, C
Explanation
Infrastructure Encryption (also referred to as 'double encryption') works by adding an extra layer of encryption at the storage service infrastructure level. According to Microsoft’s documentation, it must be enabled at the time of creating a new storage account, and it does not replace existing server-side encryption. It is also region-specific, so administrators must confirm availability in the chosen region. Further details can be found in the official Azure Storage encryption documentation.
- A. Correct.
Option 1 is correct. Infrastructure Encryption must be enabled at the time of storage account creation and cannot be retrofitted afterwards. This aligns with Microsoft’s documentation stating that Infrastructure Encryption is irreversible and must be set during initial configuration.
- B. Incorrect.
Option 2 is incorrect. There is no toggle or switch to enable Infrastructure Encryption for existing storage accounts once they are created. The feature is only available during the creation of a new storage account.
- C. Correct.
Option 3 is correct. Infrastructure Encryption may not be available in all Azure regions. Ensuring the storage account resides in a supported region is essential for enabling double encryption at the infrastructure level.
- D. Incorrect.
Option 4 is incorrect. Infrastructure Encryption does not replace the default server-side encryption with platform-managed keys; it provides an additional layer of encryption. There is no requirement to disable the default server-side encryption.