AZ-204 Develop for Azure storage Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Azure Information Protection to encrypt the files.

  Why it's wrong here

  Azure Information Protection (AIP) is primarily a classification and rights management solution, not a general-purpose encryption mechanism for data streams before storage. While AIP can apply encryption as part of a protection label, it's typically applied to specific file types (e.g., Office documents) and managed through policies, rather than programmatically encrypting arbitrary data before it's uploaded to a storage account. It doesn't fulfill the requirement of encrypting data *before* it reaches the storage service at a low level.

• ✗

  Use Azure Disk Encryption for the storage account.

  Why it's wrong here

  Azure Disk Encryption (ADE) is designed to encrypt the operating system and data disks attached to Azure Virtual Machines (VMs) using BitLocker for Windows or DM-Crypt for Linux. This technology operates at the virtual machine infrastructure level, securing the underlying disks that host VM data. It is entirely unrelated to encrypting data within an Azure Storage Account, such as Blob Storage, which is a distinct platform-as-a-service offering.

• ✓

  Implement client-side encryption using the Azure Storage SDK and store the encryption keys in Azure Key Vault.

  Why this is correct

  Implementing client-side encryption using the Azure Storage SDK ensures that data is encrypted by the application on the client machine *before* it is transmitted over the network and stored in Azure Storage. This approach provides the highest level of control over the encryption process and keys, directly addressing the requirement to encrypt data *before* storage. Storing the encryption keys securely in Azure Key Vault is a best practice, centralizing key management and enhancing security posture.

• ✗

  Enable Azure Storage Service Encryption (SSE) with customer-managed keys.

  Why it's wrong here

  Azure Storage Service Encryption (SSE) automatically encrypts all data *at rest* within Azure Storage, meaning the encryption occurs on the server-side *after* the data has been uploaded to the storage service. While SSE can be configured with customer-managed keys (CMK) from Azure Key Vault, its fundamental operation is to protect data once it has already reached the Azure platform. Therefore, SSE does not meet the specific requirement to encrypt data *before* it is transmitted or stored.