Implement generative AI solutions →easyMultiple Choice

AI-102 Implement generative AI solutions Practice Question

Exhibit

{
  "resource": {
    "name": "myOpenAI",
    "location": "eastus",
    "sku": {
      "name": "S0"
    },
    "properties": {
      "encryption": {
        "keySource": "Microsoft.KeyVault",
        "keyVaultProperties": {
          "keyName": "myKey",
          "keyVaultUri": "https://myvault.vault.azure.net/"
        }
      }
    }
  }
}

Refer to the exhibit. You are reviewing the configuration of an Azure OpenAI Service resource. The resource is configured with customer-managed keys for encryption. What is the primary benefit of this configuration?

⚠ Common exam trap

Many exam-takers confuse customer-managed keys with platform-managed keys, assuming the primary benefit is cost savings or performance gains, when in reality the core advantage is granular control over encryption key governance and compliance.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Enhanced control over data encryption keys

Customer-managed keys (CMK) allow you to control and manage the encryption keys used to protect your data at rest in Azure OpenAI Service. This provides enhanced control over who can access the keys, when they are rotated, and how they are stored, which is critical for meeting compliance and security requirements. The primary benefit is not performance, cost, or deployment simplicity, but rather the ability to enforce your own key lifecycle and access policies.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Enhanced control over data encryption keys
Why this is correct
Customer-managed keys let you supply and rotate your own Key Vault key, so Microsoft cannot decrypt the data. This satisfies the requirement for control over the encryption key lifecycle, rather than relying on Microsoft-managed keys.
✗
Simplified deployment process
Why it's wrong here
Customer-managed keys add Key Vault configuration, access policies and key rotation steps, so deployment becomes more involved, not simplified. It is tempting because centralised key management feels like streamlined governance, yet the actual purpose is control over encryption key lifecycle, not deployment automation.
✗
Improved model performance
Why it's wrong here
Customer-managed keys operate on the encryption layer protecting stored data; they do not change model weights, token throughput or inference latency. It is tempting because security settings are sometimes assumed to affect service quality, but the feature exists to satisfy key-ownership and regulatory control requirements.
✗
Reduced operational costs
Why it's wrong here
Customer-managed keys govern who controls the encryption key material for data at rest; they do not alter billing meters, so no cost reduction occurs. The feature is tempting because consolidated key management can reduce administrative overhead, but that is a governance benefit, not an operational cost saving.

Go deeper

AI-102 Implement generative AI solutions Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question