Examkin

Soru

Zorluk: OrtaConfigure Storage Encryption and Customer-Managed Keys

An administrator is configuring customer-managed keys (CMK) for an Azure Storage account named saapexdata. The storage account has a system-assigned managed identity enabled. The key is stored in an Azure Key Vault named kv-apex-keys, which is configured to use the Azure role-based access control (Azure RBAC) permission model. Soft-delete and purge protection are already enabled on the Key Vault. Which role must be assigned to the storage account's managed identity over kv-apex-keys to allow encryption to function?

  1. A
    Owner of the resource group containing the Key Vault
  2. Key Vault Crypto Service Encryption UserCevap
  3. C
    Key Vault Contributor
  4. D
    Contributor on the storage account and enabling the 'Allow trusted Microsoft services to bypass this firewall' setting on the Key Vault firewall

Cevap

Key Vault Crypto Service Encryption User
The correct role is Key Vault Crypto Service Encryption User. Under the Azure RBAC authorization model, this role grants the required cryptographic data-plane operations (wrap key and unwrap key) to the managed identity of the storage account, enabling Azure Storage Service Encryption to encrypt and decrypt data using the customer-managed key.

Adım Adım Çözüm

1
Identify the authorization model used by the Key Vault.
The Key Vault uses the Azure RBAC permission model instead of Vault Access Policies.
This determines how permissions to read and use the cryptographic keys must be granted.
2
Determine the cryptographic operations required by Azure Storage Service Encryption.
The storage account identity must be able to wrap and unwrap keys to perform envelope encryption.
Azure Storage uses envelope encryption where it encrypts data with a symmetric key and wraps that key using the customer-managed key.
3
Select the built-in role that offers the minimum required permissions for key usage.
The 'Key Vault Crypto Service Encryption User' role is identified as granting wrap and unwrap permissions.
Using built-in, least-privileged roles is a security best practice.

Anahtar Kavram

Assigning appropriate Azure RBAC roles to a storage account's managed identity for Key Vault access when configuring customer-managed keys (CMK).
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru