Examkin

Soru

Zorluk: OrtaConfigure Storage Encryption and Customer-Managed Keys

CloudScale Logistics has an Azure subscription named sub-cloudscale-prod. You are configuring customer-managed keys (CMK) for a storage account named sacloudscaleprod. You create a user-assigned managed identity named uami-storage-encrypt. You deploy an Azure Key Vault named kv-cloudscale-prod that uses Azure role-based access control (RBAC) authorization. You must ensure that sacloudscaleprod can encrypt data using a key in kv-cloudscale-prod while meeting security compliance policies. Which of the following actions must be performed to successfully complete the CMK configuration? (Select THREE.)

  1. Enable soft-delete and purge protection on kv-cloudscale-prod.Cevap
  2. Associate the uami-storage-encrypt managed identity with sacloudscaleprod.Cevap
  3. Assign the Key Vault Crypto Service Encryption User role to uami-storage-encrypt at the kv-cloudscale-prod scope.Cevap
  4. D
    Assign the Key Vault Contributor role to uami-storage-encrypt at the kv-cloudscale-prod scope.
  5. E
    Assign the Storage Blob Data Contributor role to uami-storage-encrypt at the sacloudscaleprod scope.
  6. F
    Disable the "Allow trusted Microsoft services to bypass this firewall" option in the sacloudscaleprod firewall settings.

Cevap

To configure customer-managed keys (CMK) using a user-assigned managed identity with Azure RBAC, you must enable soft-delete and purge protection on the key vault, associate the user-assigned managed identity with the storage account, and assign the Key Vault Crypto Service Encryption User role to the managed identity at the key vault scope.
To encrypt storage account data with customer-managed keys using a user-assigned managed identity, three main configurations must be met: first, the Key Vault must have soft-delete and purge protection enabled to safeguard the keys from accidental deletion; second, the user-assigned managed identity must be associated with the storage account to act on its behalf; and third, the identity must be granted the Key Vault Crypto Service Encryption User role on the Key Vault to perform key wrapping/unwrapping. Using these options satisfies the data-plane access requirements and security constraints.

Adım Adım Çözüm

1
Configure the Azure Key Vault settings
Soft-delete and purge protection are enabled on kv-cloudscale-prod.
Customer-managed keys in Azure Storage require the Key Vault to have soft-delete and purge protection enabled to protect against accidental key deletion.
2
Configure the Storage Account identity
The user-assigned managed identity uami-storage-encrypt is associated with sacloudscaleprod.
The storage account needs a valid identity reference to authenticate and request access to the Key Vault.
3
Configure Key Vault permissions
The Key Vault Crypto Service Encryption User role is assigned to uami-storage-encrypt at the kv-cloudscale-prod scope.
The storage account's identity needs data plane permissions to read and perform wrap/unwrap key operations on the Key Vault.

Anahtar Kavram

Configure Storage Encryption and Customer-Managed Keys using User-Assigned Managed Identity and Azure RBAC
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru