Examkin

Question

Difficulty: MediumConfigure Storage Encryption and Customer-Managed Keys

Solaris Energy Partners has an Azure subscription named sub-solaris-dev. The subscription contains an Azure Key Vault named kv-solaris-dev and a Storage account named sasolarisdev. The Key Vault has soft-delete enabled, purge protection disabled, and uses the Azure role-based access control (Azure RBAC) permission model.

You associate a user-assigned managed identity named uami-solaris-storage with sasolarisdev.

You need to configure sasolarisdev to use a customer-managed key stored in kv-solaris-dev by using uami-solaris-storage. The solution must follow the principle of least privilege.

Which configuration steps should you perform?

  1. A
    Enable purge protection on kv-solaris-dev, and assign the Key Vault Contributor role to uami-solaris-storage on kv-solaris-dev.
  2. B
    Enable the firewall bypass for trusted Microsoft services on sasolarisdev, and assign the Storage Blob Data Contributor role to uami-solaris-storage on kv-solaris-dev.
  3. Enable purge protection on kv-solaris-dev, and assign the Key Vault Crypto Service Encryption User role to uami-solaris-storage on kv-solaris-dev.Answer
  4. D
    Enable purge protection on kv-solaris-dev, and assign the Owner role to uami-solaris-storage on sub-solaris-dev.

Answer

Enable purge protection on the Key Vault, and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity on the Key Vault.
To successfully configure customer-managed keys (CMK) for an Azure Storage account, two primary security configurations must be met: the Key Vault must have both soft-delete and purge protection enabled, and the managed identity assigned to the storage account must have sufficient data plane permissions on the Key Vault. The Key Vault Crypto Service Encryption User role is the minimum built-in Azure RBAC role that provides the required data plane permissions (wrap, unwrap, and get key) for storage account encryption, conforming to the principle of least privilege.

Step-by-Step Solution

1
Check Key Vault data protection features.
Determine that purge protection must be enabled on kv-solaris-dev.
Azure Storage encryption with customer-managed keys requires both soft-delete and purge protection to be enabled on the Key Vault to prevent data loss due to accidental key deletion.
2
Identify the authentication identity used by the Storage account.
Identify the user-assigned managed identity, uami-solaris-storage, associated with the storage account.
The storage account uses this identity to authenticate and request key operations from the Key Vault.
3
Assign the least-privileged role on the Key Vault.
Assign the Key Vault Crypto Service Encryption User role to the managed identity.
For Key Vaults using Azure RBAC, this built-in role provides the necessary data plane permissions to perform key operations without granting administrative control plane access.

Key Concept

Key Vault requirements and Azure RBAC data plane permissions for Azure Storage Customer-Managed Keys (CMK) configuration.
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic