AZ-204 Develop for Azure storage Practice Question
You need to enable client-side encryption for data stored in Azure Blob Storage. The encryption keys must be managed by your organization using Azure Key Vault. What should you use?
⚠ Common exam trap
Test-takers frequently confuse client-side encryption (where the client encrypts before sending) with service-side encryption (where the service encrypts after receiving), leading candidates to incorrectly choose service-side encryption with customer-managed keys (Option C) even though it does not meet the 'client-side' requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Storage client-side encryption library with Key Vault
Client-side encryption requires the application to encrypt data before uploading it to Azure Blob Storage, and the Azure Storage client-side encryption library integrates with Azure Key Vault to allow your organization to manage the encryption keys. This approach ensures that the storage service never has access to the plaintext data or the keys, meeting the requirement for client-side encryption with customer-managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Disk Encryption
Why it's wrong here
Azure Disk Encryption (ADE) is specifically designed to encrypt the operating system and data disks attached to Azure Virtual Machines. It leverages industry-standard encryption technologies like BitLocker for Windows and DM-Crypt for Linux to secure entire volumes. While ADE provides robust encryption for VM-related storage, it operates at the disk level and does not directly provide client-side encryption for data stored within Azure Blob Storage, Azure Files, or other general Azure Storage services. Therefore, it is not the appropriate solution for enabling client-side encryption for arbitrary data stored in Azure Storage.
- ✗
Azure Information Protection
Why it's wrong here
Azure Information Protection (AIP) is a cloud-based solution focused on helping organizations classify, label, and protect their sensitive documents and emails. It enables data governance and rights management, ensuring that protected information remains secure regardless of its location or sharing. While AIP can apply encryption as part of its protection policies for specific file types, it is primarily a data classification and rights management service, not a general-purpose client-side encryption library for arbitrary data being uploaded to Azure Storage. Its scope is different from encrypting raw data streams before storage.
- ✗
Azure Storage service-side encryption with customer-managed keys
Why it's wrong here
Azure Storage service-side encryption with customer-managed keys (SSE-CMK) automatically encrypts data at rest when it is persisted to Azure Storage. Although it allows customers to manage their encryption keys in Azure Key Vault, the encryption process itself occurs on the Azure storage service side *after* the data has been uploaded. This means the data is transmitted to Azure in an unencrypted state (though typically protected by transport layer security like HTTPS) and then encrypted by the service. This approach does not meet the requirement for client-side encryption, where data must be encrypted *before* it leaves the client application.
- ✓
Azure Storage client-side encryption library with Key Vault
Why this is correct
The Azure Storage client-side encryption library, when integrated with Azure Key Vault, provides the exact functionality required: encrypting data on the client application *before* it is uploaded to Azure Storage. This ensures that the data is encrypted in transit and remains encrypted at rest, with Azure Storage only ever receiving the ciphertext. Azure Key Vault securely stores and manages the encryption keys, allowing the client application to retrieve and use them for encryption and decryption, thereby giving customers full control over their data's encryption lifecycle and ensuring maximum confidentiality.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.