Examkin

Soru

Zorluk: KolayConfigure Storage Encryption and Customer-Managed Keys

Your company, Litware, Inc., has an Azure subscription containing a storage account named storage1 and an Azure Key Vault named vault1.

storage1 is configured with a system-assigned managed identity.

vault1 has both soft-delete and purge protection enabled, and is configured to use Azure role-based access control (Azure RBAC) for its authorization model.

You need to configure customer-managed key (CMK) encryption for storage1 using a key stored in vault1.

Which RBAC role must you assign to the system-assigned managed identity of storage1 over vault1 to allow key wrapping and unwrapping operations?

  1. Key Vault Crypto Service Encryption UserCevap
  2. B
    Key Vault Contributor
  3. C
    Storage Blob Data Contributor
  4. D
    Key Vault Reader

Cevap

Key Vault Crypto Service Encryption User
The correct role is Key Vault Crypto Service Encryption User. Under the Azure RBAC permission model for Key Vault, this specific role grants the required data-plane permissions (Microsoft.KeyVault/vaults/keys/wrap/action and Microsoft.KeyVault/vaults/keys/unwrap/action) needed by the storage account's managed identity to encrypt and decrypt the storage service keys.

Adım Adım Çözüm

1
Identify the authorization model and requirements.
The target Key Vault uses Azure RBAC for authorization, meaning standard Azure RBAC roles must be assigned to grant access to the keys.
Azure Key Vault supports two permission models: vault access policies and Azure RBAC.
2
Determine the necessary key operations.
The storage account's system-assigned managed identity needs permission to perform key wrap and unwrap operations to encrypt and decrypt the storage service encryption keys.
Customer-managed key encryption relies on envelope encryption, where the storage account's root key is wrapped by the key stored in the Key Vault.
3
Select the correct role that matches the required operations with the least privilege.
The Key Vault Crypto Service Encryption User role grants permission to perform wrap/unwrap operations, which is the exact minimum privilege needed.
Control-plane roles like Key Vault Contributor or Key Vault Reader do not grant these data-plane cryptographic permissions.

Anahtar Kavram

Configuring customer-managed keys (CMK) for Azure Storage accounts requires granting the storage account's managed identity specific data-plane permissions (Key Vault Crypto Service Encryption User role or equivalent vault access policy) over the Key Vault containing the encryption key.
Tahmini Süre:1m 0s
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru