Examkin

Soru

Zorluk: ZorConfigure Storage Encryption and Customer-Managed Keys

Vanguard Systems manages an Azure subscription named sub-vanguard-secure. An administrator deploys a storage account named savanguarddata and an Azure Key Vault named kv-vanguard-secrets with the following configurations:

savanguarddata:
- Identity: Configured with a User-Assigned Managed Identity named uami-encrypt.
- Firewall: Enabled, with 'Allow trusted Microsoft services to access this storage account' set to Yes.

kv-vanguard-secrets:
- Properties: Soft-delete is Enabled; Purge protection is Enabled.
- Permission model: Azure role-based access control (Azure RBAC).
- Firewall: Enabled from selected networks, with 'Allow trusted Microsoft services to bypass this firewall' set to No.

The administrator assigns the Key Vault Crypto Service User role to uami-encrypt at the key vault scope.

When attempting to enable customer-managed keys (CMK) on savanguarddata using a key from kv-vanguard-secrets, the configuration fails. What is the cause of the configuration failure?

  1. The Key Vault firewall blocks the Azure Storage service because the bypass for trusted Microsoft services is disabled on kv-vanguard-secrets.Cevap
  2. B
    The User-Assigned Managed Identity (uami-encrypt) requires the Owner or Contributor role assigned on the kv-vanguard-secrets control plane.
  3. C
    The storage account firewall is blocking incoming connections because the 'Allow trusted Microsoft services' bypass is enabled on savanguarddata but disabled on the Key Vault.
  4. D
    Azure Key Vault is configured with Azure RBAC, which requires the storage account's system-assigned managed identity to be granted the Key Vault Administrator role.

Cevap

The Key Vault firewall blocks the Azure Storage service because the bypass for trusted Microsoft services is disabled on the Key Vault.
The correct option correctly identifies that the Key Vault firewall is blocking the Azure Storage service. When a Key Vault restricts access to selected networks, the Azure Storage service (which is a trusted Microsoft service) cannot retrieve or use the key for encryption unless the Key Vault's firewall settings explicitly allow trusted Microsoft services to bypass the restriction.

Adım Adım Çözüm

1
Verify Managed Identity and RBAC permissions
The User-Assigned Managed Identity has the correct data-plane role (Key Vault Crypto Service User) assigned at the appropriate scope, so identity permissions are not the issue.
To ensure the correct role is applied to the configured identity.
2
Analyze Key Vault firewall configuration
The Key Vault firewall restricts access to selected networks, and the bypass for trusted Microsoft services is set to No.
Azure Storage is a trusted Microsoft service that needs to communicate with the Key Vault to access the encryption keys.
3
Identify the communication direction and failure point
The Azure Storage service initiates outbound traffic to the Key Vault. The Key Vault firewall blocks this traffic because the bypass is disabled.
Determining why the connection is refused despite the storage account's firewall allowing trusted services.

Anahtar Kavram

Azure Storage Customer-Managed Keys (CMK) require network integration bypasses on the Key Vault firewall if the vault is secured behind selected networks.
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru