Examkin

Soru

Zorluk: Çok zorConfigure Storage Encryption and Customer-Managed Keys

You manage an Azure subscription named Sub1. You plan to configure customer-managed key (CMK) encryption for an Azure storage account named contosostore1 by using an existing Azure key vault named contosokeyvault1. The resources are configured as follows:
- contosostore1 has a user-assigned managed identity named identity1 associated with it. The storage account firewall is enabled.
- contosokeyvault1 uses the Azure RBAC permission model. Soft-delete is enabled, but purge protection is disabled. The Key Vault firewall is configured to allow access from selected networks only.
You need to ensure that contosostore1 can encrypt data using a key from contosokeyvault1. The solution must follow the principle of least privilege.
Which two actions should you perform? (Select TWO.)

  1. Enable purge protection on contosokeyvault1.Cevap
  2. Assign the Key Vault Crypto Service Encryption User role to identity1 at the scope of contosokeyvault1.Cevap
  3. C
    Assign the Key Vault Contributor role to identity1 at the scope of contosokeyvault1.
  4. D
    Disable the firewall on contosostore1 to allow outbound traffic to contosokeyvault1.
  5. E
    Enable the system-assigned managed identity on contosostore1 and assign it the Key Vault Reader role on contosokeyvault1.

Cevap

Enable purge protection on the key vault, and assign the Key Vault Crypto Service Encryption User role to the user-assigned managed identity at the scope of the key vault.
To successfully configure customer-managed keys (CMK) for an Azure Storage account, two key requirements must be satisfied: Key Vault protection settings and appropriate data plane permissions. First, Azure Storage mandates that the Key Vault must have both soft-delete and purge protection enabled to prevent permanent data loss due to accidental or malicious key deletion. Because purge protection is disabled on the key vault, it must be enabled. Second, because the key vault uses the Azure RBAC permission model, permissions must be granted using Azure RBAC roles. The user-assigned managed identity associated with the storage account requires data plane permissions to perform key operations (specifically wrap and unwrap). The Key Vault Crypto Service Encryption User role is the least-privilege role that grants these permissions.

Adım Adım Çözüm

1
Enable purge protection on the key vault.
The Key Vault meets the security prerequisites for Azure Storage CMK integration.
Azure Storage mandates that both soft-delete and purge protection be enabled on the Key Vault holding the encryption key to prevent permanent data loss due to accidental key deletion.
2
Identify the permission model of the key vault and assign the data plane role.
The user-assigned managed identity identity1 is granted key wrap/unwrap permissions.
Because the Key Vault uses Azure RBAC, control plane roles like Owner or Contributor do not grant data plane access to keys. The identity must be assigned the Key Vault Crypto Service Encryption User role at the Key Vault scope, which is the least-privilege data plane role required for storage encryption.

Anahtar Kavram

Azure Storage customer-managed key configuration requirements, including Key Vault protection settings and Azure RBAC data plane permissions.
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru