AZ-305 Design infrastructure solutions Practice Question
A healthcare company is designing a new Azure solution that must comply with HIPAA. The solution will store patient records in Azure Blob Storage and must ensure that data is encrypted at rest using customer-managed keys. The company also requires that the encryption keys be stored in a hardware security module (HSM) and that they have full control over key rotation. Which Azure service should the solutions architect use to meet these requirements?
⚠ Common exam trap
Many candidates confuse Azure Key Vault standard tier with Managed HSM; standard tier uses software-protected keys and does not satisfy the HSM requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Key Vault Managed HSM
Azure Key Vault Managed HSM provides HSM-backed keys with full customer control, meeting the HIPAA and key rotation requirements. It integrates with Azure Storage for customer-managed keys, allowing the healthcare company to encrypt Blob Storage using keys stored in a hardware security module. Other options either lack HSM backing, are not integrated with Blob Storage, or are intended for different purposes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Disk Encryption
Why it's wrong here
Azure Disk Encryption is used to encrypt OS and data disks of Azure VMs, not Blob Storage. It can use Key Vault for key management, but it does not apply to storage accounts. The scenario specifically requires encryption of data at rest in Blob Storage, so this service is irrelevant to the requirement.
- ✗
Azure Dedicated HSM
Why it's wrong here
Azure Dedicated HSM provides a dedicated hardware security module, but it is not integrated with Azure Storage for customer-managed keys out of the box. It requires more management overhead and is typically used for legacy lift-and-shift scenarios or custom applications. It does not offer the seamless integration with Azure Storage that Managed HSM provides.
- ✓
Azure Key Vault Managed HSM
Why this is correct
Azure Key Vault Managed HSM is a fully managed, highly available, single-tenant HSM service that enables you to store cryptographic keys in FIPS 140-2 Level 3 validated HSMs. It supports customer-managed keys for Azure Storage encryption and provides full control over key rotation, directly satisfying the HIPAA compliance and HSM requirements.
- ✗
Azure Key Vault (standard tier)
Why it's wrong here
Azure Key Vault standard tier uses software-protected keys and does not provide HSM-backed keys. While it supports customer-managed keys for storage encryption, the requirement explicitly states that keys must be stored in an HSM. Therefore, the standard tier does not meet the HSM requirement, even though it offers key management capabilities.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 795 original AZ-305 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This AZ-305 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-305 exam.