AZ-204 Develop for Azure storage Practice Question
You need to ensure that data stored in Azure Blob Storage is encrypted at rest using a customer-managed key stored in Azure Key Vault. Which feature should you configure?
⚠ Common exam trap
Many exam-takers confuse Azure Disk Encryption (ADE) with storage account encryption, or assume that default Microsoft-managed keys satisfy the requirement for customer-managed keys, when in fact you must explicitly configure customer-managed keys in Azure Key Vault.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Storage encryption with customer-managed keys in Azure Key Vault
Azure Storage encryption with customer-managed keys in Azure Key Vault allows you to use your own encryption keys to protect data at rest in Blob Storage. This feature leverages Azure Storage Service Encryption (SSE) but wraps the data encryption key with a customer-managed key stored in Azure Key Vault, providing full control over key rotation and access policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Azure Storage encryption with customer-managed keys in Azure Key Vault
Why this is correct
Azure Storage encryption with customer-managed keys (CMK) in Azure Key Vault provides robust encryption at rest for blob data, allowing organizations to maintain full control over their encryption keys. By integrating with Azure Key Vault, customers can manage the lifecycle of their keys, including rotation and revocation, ensuring compliance with stringent regulatory requirements. This approach enhances the security posture by separating key management from data storage, giving customers exclusive access to the encryption keys.
- ✗
Azure Disk Encryption (ADE) for the storage account
Why it's wrong here
Azure Disk Encryption (ADE) is specifically designed to encrypt the operating system and data disks attached to Azure Virtual Machines, leveraging BitLocker for Windows and DM-Crypt for Linux. It operates at the virtual machine level, securing the underlying disks that host VM data. Consequently, ADE is entirely irrelevant for encrypting data directly stored within an Azure Blob Storage account, which is a platform-as-a-service offering.
- ✗
Azure Information Protection (AIP) for the blob container
Why it's wrong here
Azure Information Protection (AIP) is a cloud-based solution focused on classifying, labeling, and protecting documents and emails, primarily at the *content* level. While AIP can apply encryption to individual files, it does not provide encryption at rest for an entire Azure Blob Storage container or account as an infrastructure service. Its purpose is data governance and rights management for sensitive information within files, not the underlying storage infrastructure.
- ✗
Azure Storage Service Encryption (SSE) with Microsoft-managed keys
Why it's wrong here
Azure Storage Service Encryption (SSE) with Microsoft-managed keys is the default encryption at rest for all data in Azure Storage, automatically encrypting data before persistence and decrypting it upon retrieval. While it provides strong encryption, the encryption keys are fully managed by Microsoft, meaning customers do not have direct control over key lifecycle operations like rotation or revocation. This option fails to meet a requirement for *customer-managed* keys, which implies a need for explicit customer control over key management.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Azure Functions Development
Key term
Azure Storage Encryption
Azure Storage Encryption is the process of protecting data stored in Azure cloud storage by converting it into an unreadable format using encryption keys, ensuring only authorized parties can access it.
Key term
Key Vault Secrets
Key Vault Secrets are secure containers in Microsoft Azure that store sensitive information like passwords, connection strings, and API keys, keeping them encrypted and accessible only to authorized applications and users.
About these practice questions
This AZ-204 question is part of Courseiva's 881-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-204 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-204 exam.