AZ-204 Develop for Azure storage Practice Question
You are designing a solution that stores sensitive customer data in Azure Blob Storage. The data must be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, the solution must support automatic key rotation every 90 days. You need to configure the encryption settings. Which combination of Azure services and features should you use?
⚠ Common exam trap
Watch out — candidates often confuse Azure Disk Encryption (for VMs) with Azure Storage encryption (for Blob Storage), or assume that Microsoft-managed keys can be configured to meet a customer-controlled rotation schedule, when in fact only customer-managed keys in Key Vault allow custom rotation policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.
Azure Storage Service Encryption (SSE) supports customer-managed keys (CMK) stored in Azure Key Vault for encrypting blob data at rest. Automatic key rotation every 90 days can be achieved by configuring a key rotation policy in Azure Key Vault, which allows you to define a rotation frequency (e.g., 90 days) and automatically generate a new key version. This meets both the CMK and automatic rotation requirements without additional services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Information Protection to encrypt the blobs with a customer-managed key.
Why it's wrong here
Azure Information Protection (AIP) is primarily designed for classifying, labeling, and protecting documents and emails, often integrated with Microsoft 365 applications. It encrypts content at the file level, not the underlying Azure Blob Storage service itself. Therefore, AIP is not the appropriate service for encrypting blobs at rest within an Azure storage account using a customer-managed key, as its scope is content protection rather than infrastructure encryption.
- ✗
Use Azure Disk Encryption with Azure Key Vault to encrypt the storage account.
Why it's wrong here
Azure Disk Encryption (ADE) is specifically engineered to encrypt the operating system and data disks used by Azure Virtual Machines (VMs). It secures IaaS components by encrypting the disks attached to a VM, not PaaS services like Azure Blob Storage accounts. Applying ADE to a storage account is fundamentally incorrect as it operates at a different layer of the Azure infrastructure, making it unsuitable for encrypting blobs.
- ✗
Use Azure Storage Service Encryption (SSE) with Microsoft-managed keys and enable automatic key rotation.
Why it's wrong here
While Azure Storage Service Encryption (SSE) encrypts data at rest by default, using Microsoft-managed keys (MMK) means customers have no direct control over the encryption keys or their rotation schedule. Microsoft handles MMK rotation internally, but this process is opaque to the customer and cannot be configured for automatic rotation policies. Customer-managed keys (CMK) are required for configurable and automatic key rotation.
- ✓
Use Azure Storage encryption with a customer-managed key stored in Azure Key Vault. Configure a key rotation policy in Key Vault to rotate the key every 90 days.
Why this is correct
This option correctly leverages Azure Storage encryption with Customer-Managed Keys (CMK), providing the necessary control over the encryption key lifecycle. Storing the key in Azure Key Vault ensures secure key management and allows for configuring an automatic key rotation policy directly within Key Vault. This setup directly addresses the requirement for both data at rest encryption and scheduled key rotation, enhancing security and compliance without manual intervention.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Storage Encryption
Azure Storage Encryption is the process of protecting data stored in Azure cloud storage by converting it into an unreadable format using encryption keys, ensuring only authorized parties can access it.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
One of 881 original AZ-204 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.