Question

Difficulty: MediumConfigure Storage Encryption and Customer-Managed Keys

Zenix Solutions has an Azure subscription named sub-zenix-prod. You deploy an Azure Storage account named sazenixprod and an Azure Key Vault named kv-zenix-secure.

The Key Vault is configured as follows:
- Permission model: Azure role-based access control (Azure RBAC)
- Soft-delete: Enabled
- Purge protection: Enabled

You create a user-assigned managed identity named uami-zenix-storage. You plan to configure customer-managed keys (CMK) for encryption on sazenixprod using uami-zenix-storage to access the keys in kv-zenix-secure.

Which two actions should you perform to configure customer-managed key encryption? Select two.

  1. Associate the user-assigned managed identity uami-zenix-storage with the storage account sazenixprod.Answer
  2. Assign the Key Vault Crypto Service Encryption User role on kv-zenix-secure to uami-zenix-storage.Answer
  3. C
    Assign the Key Vault Contributor role on kv-zenix-secure to uami-zenix-storage.
  4. D
    Enable the 'Allow trusted Microsoft services to bypass this firewall' setting on sazenixprod.

Answer

Associate the user-assigned managed identity with the storage account, and assign the Key Vault Crypto Service Encryption User role on the Key Vault to the user-assigned managed identity.
To successfully configure customer-managed keys for an Azure Storage account using a user-assigned managed identity and a Key Vault that uses Azure RBAC, you must first associate the user-assigned managed identity with the storage account. Second, you must grant the identity data-plane access to the Key Vault. The Key Vault Crypto Service Encryption User role is the specific role designed for storage account encryption operations as it permits wrapping and unwrapping key actions.

Step-by-Step Solution

1
Associate the identity
The user-assigned managed identity uami-zenix-storage is linked to the storage account sazenixprod.
This allows the storage account to use the user-assigned managed identity's credentials when requesting operations from Azure Key Vault.
2
Grant RBAC permissions on the Key Vault
The managed identity is assigned the Key Vault Crypto Service Encryption User role on kv-zenix-secure.
Because the Key Vault uses Azure RBAC, the identity must have explicit data-plane permissions (specifically wrap/unwrap key actions) to perform the cryptographic operations required for storage encryption.

Key Concept

Configuring Customer-Managed Keys (CMK) for Azure Storage using a user-assigned managed identity and an Azure RBAC-enabled Azure Key Vault.
Rate this question