AI-102 Implement computer vision solutions Practice Question
A bank uses Azure AI Document Intelligence to process loan applications. The solution must extract data from scanned PDFs and validate it against a database. The bank requires that all extracted data be encrypted at rest and in transit. Which security measure should you implement?
⚠ Common exam trap
Test-takers frequently confuse network isolation (private endpoint) or access control (RBAC/managed identity) with data encryption, leading candidates to pick options that secure the connection or identity but do not encrypt the data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable customer-managed keys (CMK) with Azure Key Vault for the Document Intelligence resource
Customer-managed keys (CMK) with Azure Key Vault provide the ability to control the encryption keys used to protect data at rest in Azure AI Document Intelligence. This, combined with the platform's default encryption in transit (TLS), satisfies the requirement for encrypting extracted data both at rest and in transit. CMK is the only option that directly addresses encryption key management for data at rest.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable customer-managed keys (CMK) with Azure Key Vault for the Document Intelligence resource
Why this is correct
CMK provides encryption at rest with customer-controlled keys.
- ✗
Use a system-assigned managed identity for the application
Why it's wrong here
Authentication, not encryption.
- ✗
Configure a private endpoint for the Document Intelligence resource
Why it's wrong here
Network isolation, not encryption at rest.
- ✗
Use Azure RBAC to restrict access to the Document Intelligence resource
Why it's wrong here
Access control, not encryption.
Go deeper
Related to this question
About these practice questions
This AI-102 question is part of Courseiva's 945-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AI-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AI-102 exam.