Courseiva
Develop for Azure storageeasyMultiple ChoiceObjective-mapped

AZ-204 Develop for Azure storage Practice Question

You need to ensure that data stored in Azure Blob Storage is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you configure?

⚠ Common exam trap

Many exam-takers confuse Azure Disk Encryption (ADE) with storage account encryption, or assume that default Microsoft-managed keys satisfy the requirement for customer-managed keys, when in fact you must explicitly configure customer-managed keys in Azure Key Vault.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Azure Storage encryption with customer-managed keys in Azure Key Vault

Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to use your own encryption keys to protect data at rest in Blob Storage. This feature leverages Azure Storage Service Encryption (SSE) but wraps the data encryption key with a customer-managed key stored in Azure Key Vault, providing full control over key rotation and access policies.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Azure Storage encryption with customer-managed keys in Azure Key Vault

    Why this is correct

    Azure Storage encryption with customer-managed keys (CMK) in Azure Key Vault provides robust encryption at rest for blob data, allowing organizations to maintain full control over their encryption keys. By integrating with Azure Key Vault, customers can manage the lifecycle of their keys, including rotation and revocation, ensuring compliance with stringent regulatory requirements. This approach enhances the security posture by separating key management from data storage, giving customers exclusive access to the encryption keys.

  • Azure Disk Encryption (ADE) for the storage account

    Why it's wrong here

    Azure Disk Encryption (ADE) is specifically designed to encrypt the operating system and data disks attached to Azure Virtual Machines, leveraging BitLocker for Windows and DM-Crypt for Linux. It operates at the virtual machine level, securing the underlying disks that host VM data. Consequently, ADE is entirely irrelevant for encrypting data directly stored within an Azure Blob Storage account, which is a platform-as-a-service offering.

  • Azure Information Protection (AIP) for the blob container

    Why it's wrong here

    Azure Information Protection (AIP) is a cloud-based solution focused on classifying, labeling, and protecting documents and emails, primarily at the *content* level. While AIP can apply encryption to individual files, it does not provide encryption at rest for an entire Azure Blob Storage container or account as an infrastructure service. Its purpose is data governance and rights management for sensitive information within files, not the underlying storage infrastructure.

  • Azure Storage Service Encryption (SSE) with Microsoft-managed keys

    Why it's wrong here

    Azure Storage Service Encryption (SSE) with Microsoft-managed keys is the default encryption at rest for all data in Azure Storage, automatically encrypting data before persistence and decrypting it upon retrieval. While it provides strong encryption, the encryption keys are fully managed by Microsoft, meaning customers do not have direct control over key lifecycle operations like rotation or revocation. This option fails to meet a requirement for *customer-managed* keys, which implies a need for explicit customer control over key management.

Quick reference

Azure Blob Storage Tier Comparison

TierStorage CostRetrieval CostLatencyUse Case
HotHighestLowestImmediateActive data, frequent reads
CoolLowerHigherImmediateData accessed < once / month
ColdLower stillHigherImmediateData accessed < once / quarter
ArchiveLowestHighest + rehydration delayHoursLong-term compliance retention

Go deeper

Related to this question

About these practice questions

This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.