AZ-204 Implement Azure security Practice Question
A company uses Azure Blob Storage to store sensitive documents. They want to ensure that data is encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data immediately if a security breach is detected. Which feature should they enable?
⚠ Common exam trap
Test-takers frequently think enabling infrastructure encryption (Option B) or using Microsoft-managed keys (Option C) provides the same revocation capability, but only customer-managed keys with soft delete and purge protection allow the customer to immediately and permanently revoke access by controlling the key in Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.
It combines customer-managed keys (CMK) in Azure Key Vault for encryption at rest with soft delete and purge protection, which allows immediate revocation of access by deleting or disabling the key in Key Vault. This ensures that the data becomes permanently inaccessible as Azure Storage relies on the CMK to encrypt/decrypt the data, and without the key, the data cannot be decrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure Azure Storage encryption with customer-managed keys in Azure Key Vault and enable soft delete and purge protection.
Why this is correct
This option correctly addresses the requirement for customer-managed keys (CMK) by integrating Azure Storage encryption with Azure Key Vault. Using CMK provides granular control over the encryption keys, allowing customers to revoke access and render data immediately inaccessible, which is crucial for sensitive data. Enabling soft delete and purge protection on the Key Vault further enhances security by preventing accidental or malicious deletion of these critical encryption keys, ensuring data recoverability while maintaining key control.
- ✗
Enable infrastructure encryption for the storage account.
Why it's wrong here
Infrastructure encryption provides a second layer of encryption at the hardware level, separate from Azure Storage Service Encryption. However, it exclusively uses Microsoft-managed keys (MMK) for this encryption. Since the requirement is to use customer-managed keys (CMK) for sensitive data, this option does not meet the core security control objective of the company to manage their own encryption keys directly.
- ✗
Use Azure Storage Service Encryption with Microsoft-managed keys.
Why it's wrong here
Azure Storage Service Encryption (SSE) encrypts data at rest by default for all storage accounts. While SSE is a robust security feature, when configured with Microsoft-managed keys (MMK), Microsoft retains full control over the encryption key lifecycle. This approach fails to meet the company's explicit requirement for customer-managed keys, which is crucial for maintaining direct control over the encryption and decryption process of sensitive documents.
- ✗
Implement client-side encryption using Azure Key Vault.
Why it's wrong here
Client-side encryption involves encrypting data on the client application before it is transmitted to Azure Storage. While this provides strong security by ensuring data is encrypted in transit and at rest, it shifts the encryption management burden entirely to the application developers. The question's context of "Azure Storage encryption with customer-managed keys" points towards a server-side encryption solution where Azure Storage handles the encryption/decryption using keys managed by the customer in Key Vault, making client-side encryption not the intended solution.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-204 question from scratch — 881 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.