Synergy Cloud Solutions has an Azure subscription named sub-synergy-prod. You deploy an Azure Storage account named sasynergydata and an Azure Key Vault named kvsynergykeys to implement customer-managed keys (CMK) for storage encryption.
The storage account is configured to use a system-assigned managed identity. The Key Vault has soft-delete enabled, purge protection disabled, and is configured to use the Azure RBAC permission model for data plane authorization.
Which of the following configuration changes must you perform to successfully enable customer-managed keys for the storage account? (Select TWO.)
- Enable purge protection on kvsynergykeys.Cevap
- Assign the Key Vault Crypto Service Encryption User role to the storage account's system-assigned managed identity on kvsynergykeys.Cevap
- CAssign the Key Vault Contributor role to the storage account's system-assigned managed identity on kvsynergykeys.
- DDisable the 'Allow trusted Microsoft services to access this storage account' option in the storage account firewall settings.
Cevap
Enable purge protection on the Key Vault, and assign the Key Vault Crypto Service Encryption User role to the storage account's system-assigned managed identity on the Key Vault.
To configure customer-managed keys (CMK) for Azure Storage encryption: 1) The Key Vault must have both soft-delete and purge protection enabled to safeguard the encryption keys from accidental or malicious deletion. Since purge protection was disabled, it must be enabled. 2) Because the Key Vault is configured with the Azure RBAC permission model, the storage account's system-assigned managed identity requires data plane permissions to read and utilize the key. Assigning the Key Vault Crypto Service Encryption User role to the identity grants the necessary data plane permissions (wrap, unwrap, and get key) on the Key Vault.
Adım Adım Çözüm
Anahtar Kavram
Azure Storage customer-managed key encryption prerequisites and data plane RBAC permissions.