Examkin

Soru

Zorluk: ZorConfigure Storage Encryption and Customer-Managed Keys

Aether Dynamics has an Azure subscription named sub-aether-prod. You deploy an Azure Storage account named sa-aether-data and an Azure Key Vault named kv-aether-keys. To comply with security standards, all data stored in sa-aether-data must be encrypted using customer-managed keys (CMK). You configure a user-assigned managed identity named uami-storage-enc. The key vault is configured with retention and purge prevention settings active, and uses the Vault access policy permission model. You configure sa-aether-data to use CMK and select uami-storage-enc as the encryption identity. However, when you attempt to save the configuration, the operation fails with an access denied error. What is the most likely cause of this failure?

  1. The vault access policy for kv-aether-keys is configured to grant Get, Wrap Key, and Unwrap Key permissions to the system-assigned managed identity of sa-aether-data, but no permissions are assigned to uami-storage-enc.Cevap
  2. B
    The user-assigned managed identity uami-storage-enc is assigned the Owner role for the resource group containing the key vault, but no vault access policies are configured for it.
  3. C
    The network routing configuration on sa-aether-data restricts public access, and the setting to allow trusted Microsoft services to access the storage account is disabled.
  4. D
    The user-assigned managed identity uami-storage-enc is assigned the Reader role at the key vault scope.

Cevap

The vault access policy for kv-aether-keys is configured to grant Get, Wrap Key, and Unwrap Key permissions to the system-assigned managed identity of sa-aether-data, but no permissions are assigned to uami-storage-enc.
When a storage account is configured to use customer-managed keys (CMK) with a user-assigned managed identity, that specific user-assigned identity (not the system-assigned identity) must be granted the required Key Vault data-plane permissions (Get, Wrap Key, and Unwrap Key) in the Key Vault access policies. If permissions are granted to the system-assigned identity instead, the storage account will fail to authenticate using the configured user-assigned identity, resulting in an access denied error.

Adım Adım Çözüm

1
Identify the identity configured for customer-managed key encryption on the storage account.
The encryption is configured to use the user-assigned managed identity named uami-storage-enc.
The correct identity must be identified to verify its permissions on the Key Vault.
2
Analyze the permission model and configuration of the Key Vault.
The Key Vault uses the Vault access policy permission model and has retention/purge prevention active.
This indicates that key permissions must be assigned via Key Vault access policies (Get, Wrap Key, Unwrap Key) directly to the configured identity.
3
Evaluate why the access denied error occurred during configuration.
The permissions were granted to the storage account's system-assigned managed identity rather than the selected user-assigned identity uami-storage-enc.
An identity without the required data-plane permissions cannot perform the necessary cryptographic operations on the Key Vault keys.

Anahtar Kavram

Configure Storage Encryption and Customer-Managed Keys
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Configure Storage Encryption and Customer-Managed Keys

Bu konudan daha fazla soru