Examkin

Question

Difficulty: EasyConfigure Storage Encryption and Customer-Managed Keys

Contoso Corp has an Azure subscription containing a Key Vault named contosokey1 and a Storage Account named contosodata1. You plan to configure contosodata1 to use customer-managed keys (CMK) stored in contosokey1 to encrypt storage data.

Which two features must be enabled on contosokey1 before you can configure CMK encryption? (Select two.)

  1. Soft deleteAnswer
  2. Purge protectionAnswer
  3. C
    The Key Vault Contributor role for the storage account managed identity
  4. D
    The trusted Microsoft services firewall bypass setting

Answer

Soft delete and Purge protection must be enabled on the Key Vault.
To use customer-managed keys for storage encryption, the Key Vault must have both soft delete and purge protection enabled. Soft delete ensures that deleted vaults or keys can be recovered within a retention period, while purge protection prevents the permanent deletion of the key or vault until the retention period has elapsed.

Step-by-Step Solution

1
Identify key vault prerequisites for customer-managed key (CMK) encryption.
To protect against accidental key deletion, Azure Storage requires both soft delete and purge protection to be enabled on the target Key Vault.
If a key used for encryption is permanently deleted, all data in the storage account becomes unreadable. Soft delete and purge protection provide a safety window to recover the key.
2
Evaluate key vault role permissions.
The storage account requires data-plane permissions to wrap and unwrap keys (such as Key Vault Crypto Service Encryption User), not control-plane permissions like Key Vault Contributor.
Azure RBAC distinguishes between control-plane actions (managing the key vault resource) and data-plane actions (performing cryptographic operations on the keys).

Key Concept

Key Vault requirements for Storage Account Customer-Managed Keys (CMK)
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic