AZ-500 Secure compute, storage, and databases Practice Question
A company stores highly sensitive data in Azure Blob Storage. The security policy requires that all data is encrypted at rest using a key that is stored in Azure Key Vault, and that the storage account uses its system-assigned managed identity to access the key. Which encryption configuration should they use?
⚠ Common exam trap
Candidates often confuse 'encryption at rest' with 'client-side encryption' or 'Azure Disk Encryption', failing to recognize that the requirement for a managed identity to access a Key Vault key directly points to server-side CMK, not client-side or disk-level encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side encryption with customer-managed keys (CMK)
Server-side encryption with customer-managed keys (CMK) is required because the security policy mandates that the encryption key be stored in Azure Key Vault and that the storage account uses its system-assigned managed identity to access that key. CMK allows you to bring your own key (BYOK) into Key Vault and grants the storage account access via a managed identity, ensuring the key is under your control and not managed by Azure. Service-managed keys (option A) use Microsoft-managed keys, which do not satisfy the requirement for customer-controlled key storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Server-side encryption with service-managed keys
Why it's wrong here
Server-side encryption with service-managed keys relies on Microsoft-owned key material to encrypt data at rest in Azure Storage, and the customer has no control over the key lifecycle, rotation, or auditing. Since the requirement explicitly states the key must be stored in the customer's Azure Key Vault, this option fails the core governance requirement. While this mode is enabled by default and provides a security baseline, it does not offer the independent customer-managed access or revocation capabilities needed for highly sensitive data.
- ✓
Server-side encryption with customer-managed keys (CMK)
Why this is correct
Server-side encryption with customer-managed keys (CMK) encrypts data at rest using a data encryption key wrapped by a customer-controlled key encryption key stored in Azure Key Vault. The storage account's system-assigned managed identity authenticates to Key Vault to perform encryption and decryption of the underlying data key, giving the organization direct control over key rotation, auditing, and revocation. This satisfies the requirement of using a customer-managed key stored in Key Vault and is the appropriate mechanism for enforcing separation of duties and meeting compliance obligations.
- ✗
Client-side encryption
Why it's wrong here
Client-side encryption encrypts data in the client application before it is transmitted to Azure Blob Storage, meaning the storage service only receives and stores ciphertext and has no access to the plaintext. The keys are managed by the client application code, not by the storage account's managed identity or the service itself, so this does not align with the requirement to use Key Vault via the storage account identity. Furthermore, client-side encryption adds significant operational complexity for key management and is not the same as server-side encryption, making it unsuitable for the stated scenario.
- ✗
Azure Disk Encryption
Why it's wrong here
Azure Disk Encryption (ADE) is specifically designed to encrypt the OS and data disks of Azure virtual machines using BitLocker or DM-Crypt, with disk encryption keys stored in Azure Key Vault. Blob Storage is an object storage service, not a virtual machine disk, so ADE cannot be applied to encrypt data stored in blobs. While ADE does integrate with Key Vault, its scope is limited to VM disks and it does not address the requirement of encrypting Azure Blob Storage data at rest.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.