AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?
⚠ Common exam trap
Watch out — candidates often confuse Azure Disk Encryption (which encrypts VM disks) with storage account encryption, or assume that platform-managed keys (SSE) provide the same revocation capability as customer-managed keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage encryption with customer-managed keys (CMK)
Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Azure Storage encryption with customer-managed keys (CMK)
Why this is correct
Azure Storage always encrypts data at rest with AES-256, but enabling customer-managed keys (CMK) lets you supply your own key in Azure Key Vault or Managed HSM. You control the key lifecycle, rotation, and revocation; if you disable or delete the key, Azure Storage begins rejecting blob operation requests and the data becomes inaccessible. There is a short delay of up to 24 hours before the cached key is evicted, which is why revocation is not instantaneous. This meets the requirement of giving the customer the ability to revoke access on demand, which is the core control needed here.
- ✗
Use service-managed keys (SSE) with platform-managed keys
Why it's wrong here
With service-managed keys (also called SSE with platform-managed keys), Microsoft generates, stores, and automatically rotates the AES-256 keys that encrypt the storage account, and no customer action is required or permitted. Although the data is encrypted at rest, the storage account owner cannot view, manage, or revoke those keys because Microsoft's platform always retains full custody. Because the stated requirement is for the customer to be able to revoke access through key management, this option fails on control even though the encryption itself is present.
- ✗
Enable Azure Disk Encryption on VMs that access the storage account
Why it's wrong here
Azure Disk Encryption (ADE) uses BitLocker on Windows and DM-Crypt on Linux to encrypt the OS and data disks of Azure Virtual Machines, not the Azure Storage service itself. Enabling ADE on VMs that connect to a storage account leaves the actual blobs, files, queues, and tables protected only by storage-side encryption, which is separate from the VM's disk encryption. Therefore, ADE does not supply a customer-controlled key for the stored customer data and cannot revoke access to the storage account on demand.
- ✗
Configure Azure Information Protection for the storage account
Why it's wrong here
Azure Information Protection (AIP), now part of Microsoft Purview, applies classification and labeling to documents and emails, and it can embed rights-management protection that restricts who can open or edit a specific file. It does not encrypt Azure Storage containers, blobs, or tables, nor does it manage any keys for storage-level encryption. Configuring AIP for a storage account has no effect on the underlying encryption-at-rest of the sensitive customer data stored there, so it is not a valid encryption control for this requirement.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.