Helios Logistics has an Azure subscription named sub-helios-prod containing a resource group named rg-helios-storage. The resource group contains an Azure Storage account named saheliosdata and an Azure Key Vault named kvhelioskeys.
To meet regulatory compliance, you must configure saheliosdata to use customer-managed keys (CMK) stored in kvhelioskeys for double encryption of data at rest. You apply the following configurations:
- kvhelioskeys has soft-delete and purge protection enabled.
- kvhelioskeys is configured to use the Azure role-based access control (Azure RBAC) permission model.
- kvhelioskeys has its firewall enabled, restricting access to select networks, and has 'Allow trusted Microsoft services to bypass this firewall' set to Yes.
- saheliosdata is configured to use a system-assigned managed identity.
- You assign the Key Vault Contributor role to the storage account's managed identity at the key vault scope.
When you attempt to enable customer-managed keys on saheliosdata using a key from kvhelioskeys, the operation fails.
What is the primary reason for this configuration failure?
- The Key Vault Contributor role only grants control plane access to manage the key vault itself, but does not grant the data plane permissions required to wrap and unwrap encryption keys.Answer
- BThe Storage Account's firewall is blocking the Key Vault from communicating, as the 'Allow trusted Microsoft services' bypass must be disabled to enforce private endpoint security.
- CThe Key Vault Contributor role is assigned at the key vault scope, but Key Vault roles must be assigned at the subscription scope to allow cross-resource access by the Storage service.
- DThe Key Vault's firewall is blocking the Storage Account because the system-assigned managed identity is not recognized as a trusted Microsoft service for Key Vault bypass.