Examkin

Question

Difficulty: MediumConfigure Storage Encryption and Customer-Managed Keys

NovaByte Research has an Azure subscription named sub-novabyte-core. You are configuring customer-managed keys (CMK) for an Azure Storage account named sanovabytearchive. You create a user-assigned managed identity named uami-storage-enc to be used for Key Vault access. The Azure Key Vault named kv-novabyte-secure is configured to use Azure role-based access control (Azure RBAC) for authorization. Which of the following actions must you perform to successfully configure the storage account to use customer-managed keys from the key vault? (Select two)

  1. Enable purge protection on kv-novabyte-secure.Answer
  2. Assign the Key Vault Crypto Service Encryption User role for kv-novabyte-secure to uami-storage-enc.Answer
  3. C
    Assign the Reader role for kv-novabyte-secure to uami-storage-enc.
  4. D
    Disable the 'Allow trusted Microsoft services to bypass this firewall' setting on kv-novabyte-secure.

Answer

Enable purge protection on the key vault and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity.
To successfully configure customer-managed keys (CMK) for a storage account using Azure RBAC, two main requirements must be met: the Key Vault must have purge protection enabled to protect the encryption keys from accidental deletion, and the managed identity assigned to the storage account must be granted the Key Vault Crypto Service Encryption User role to allow it to perform data-plane encryption and decryption operations.

Step-by-Step Solution

1
Enable purge protection on kv-novabyte-secure.
Purge protection is enabled, satisfying the Azure Storage requirement that keys cannot be permanently deleted immediately.
Azure Storage requires both soft-delete (enabled by default) and purge protection to be active on the key vault to guard against accidental deletion of the encryption key.
2
Assign the Key Vault Crypto Service Encryption User role to uami-storage-enc.
The identity is granted data-plane access to read, wrap, and unwrap keys within the key vault.
Since the key vault is configured to use Azure RBAC for authorization, data-plane access for cryptographic operations must be explicitly granted via RBAC roles rather than Key Vault access policies.

Key Concept

Configuring Azure Storage encryption with customer-managed keys requires Key Vault protection settings (soft-delete and purge protection) and appropriate data-plane permissions (using Azure RBAC or Key Vault access policies) for the storage account's managed identity.
Rate this question

Topics

Configure Storage Encryption and Customer-Managed Keys

More questions from this topic