Examkin

Question

Difficulty: HardConfigure Storage Encryption and Customer-Managed Keys

Your company has an Azure subscription named sub-nebula-prod that contains the following resources:
- An Azure Storage account named sanebuladata
- A user-assigned managed identity named uami-storage-encrypt
- An Azure Key Vault named kv-nebula-keys

The Key Vault has soft delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) as its permission model.

You associate uami-storage-encrypt with sanebuladata.
You need to configure sanebuladata to use a customer-managed key stored in kv-nebula-keys for encryption.

Which two actions should you perform? (Select two.)

  1. Assign the Key Vault Crypto Service Encryption User role for kv-nebula-keys to uami-storage-encrypt.Answer
  2. Configure the encryption settings of sanebuladata to use a customer-managed key, specifying the key vault URI and selecting the uami-storage-encrypt identity.Answer
  3. C
    Assign the Key Vault Contributor role for kv-nebula-keys to uami-storage-encrypt.
  4. D
    Create a Key Vault access policy in kv-nebula-keys that grants Key Wrap, Key Unwrap, and Get permissions to uami-storage-encrypt.
  5. E
    Assign the Storage Blob Data Contributor role for sanebuladata to uami-storage-encrypt.

Answer

To configure customer-managed key encryption using a user-assigned managed identity on a Key Vault with the Azure RBAC permission model, assign the Key Vault Crypto Service Encryption User role on the Key Vault to the user-assigned managed identity, and configure the storage account's encryption settings to use the customer-managed key using that identity.
To encrypt an Azure Storage account using customer-managed keys (CMK) with a user-assigned managed identity on a vault that uses Azure RBAC, you must configure two elements. First, you must grant the user-assigned managed identity the permission to read and perform cryptographic actions on the keys. Under the Azure RBAC model, the Key Vault Crypto Service Encryption User role provides the minimum required data-plane access. Second, you must configure the storage account itself to use the customer-managed key, specifying the URI of the vault and assigning the user-assigned managed identity to authenticate the storage service's access to the Key Vault.

Step-by-Step Solution

1
Assign the appropriate data-plane role on the Key Vault to the user-assigned managed identity.
The identity is authorized to access the key and perform cryptographic operations.
Since the Key Vault uses Azure RBAC, permissions to perform key operations (wrap, unwrap, get) must be granted via Azure RBAC roles. The Key Vault Crypto Service Encryption User role is the minimum privilege required.
2
Configure the storage account encryption settings to target the customer-managed key.
The storage account begins using the customer-managed key from the Key Vault for encryption.
You must specify the customer-managed key type, the Key Vault URI, and select the user-assigned managed identity that will authenticate the request to the vault.

Key Concept

Configuring Customer-Managed Keys (CMK) for Azure Storage using user-assigned managed identities and Azure Key Vault under the Azure RBAC permission model.
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic