Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
Microsoft Certified: Cybersecurity Architect Expert · Microsoft
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
D does not meet the requirement of using encryption keys hosted on-premises, as Managed HSM is an Azure-hosted service.
Its C and D, customer managed keys for blob and files must be stored in key vault or Azure HSM. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management
Correction to my answer, its B and C. Because you can use a customer-provided key (not customer-managed) to include into the cleint request for Blob Storage. As is said in the link below: "Customer-provided keys can be stored in Azure Key Vault or in another key store" meanwhile the Customer-Managed keys for Storage must be stored in AKV or HSM but is not the case. Additionally the D answer does not mention the key, it just says encrypt using an HSM that cannot be because an HSM by itself does not encrypt. https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-customer-provided-key