Examkin

Question

Difficulty: EasyConfigure Storage Encryption and Customer-Managed Keys

Your company, Tailwind Traders, has an Azure subscription containing a storage account named twtstorage1 and an Azure Key Vault named twtkeyvault1. You configure twtstorage1 to use a system-assigned managed identity. twtkeyvault1 is configured to use Azure Role-Based Access Control (RBAC) for authorization. On twtkeyvault1, recovery of deleted vaults is enabled, and protection against permanent deletion is activated. You need to configure customer-managed key encryption for twtstorage1 using a key from twtkeyvault1. Which role must you assign to the system-assigned managed identity of twtstorage1 on twtkeyvault1?

  1. Key Vault Crypto Service Encryption UserAnswer
  2. B
    Contributor
  3. C
    Owner
  4. D
    Storage Blob Data Contributor

Answer

Key Vault Crypto Service Encryption User
To configure customer-managed key encryption, the storage account's managed identity must be granted data plane permissions to wrap and unwrap keys on the Key Vault. The Key Vault Crypto Service Encryption User role is the built-in role designed for this purpose, providing only the required cryptographic data plane permissions without administrative access.

Step-by-Step Solution

1
Identify the resource where permissions must be granted.
The Key Vault storing the customer-managed key (twtkeyvault1) is the target resource.
The storage account's managed identity needs permission to access the cryptographic key stored inside the Key Vault.
2
Determine the required permission type (control plane vs. data plane).
Data plane permissions for key operations (wrap and unwrap) are required.
Encrypting and decrypting storage data using a customer-managed key is a data plane operation, which standard control plane roles like Owner or Contributor do not grant.
3
Select the built-in Key Vault RBAC role that provides these data plane permissions.
The Key Vault Crypto Service Encryption User role provides the necessary wrap and unwrap key permissions.
This role is specifically designed to allow managed identities (like those of storage accounts) to perform encryption operations without granting excess administrative rights.

Key Concept

Customer-managed key encryption for Azure Storage requires granting data plane permissions (wrap/unwrap keys) to the storage account's managed identity using specific roles like Key Vault Crypto Service Encryption User.
Estimated Time:45s
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic