AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive data in Azure Blob Storage. They want to ensure that the data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they need the ability to immediately make the data inaccessible in case of a security breach. Which configuration on the storage account enables this?
⚠ Common exam trap
Many exam-takers confuse soft delete (which protects against accidental deletion) with the ability to make data inaccessible via key revocation, or they assume infrastructure encryption or Azure AD authentication provide the same control as CMK, but only CMK with key revocation in Key Vault gives the customer direct, immediate control over data accessibility.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage encryption with a customer-managed key (CMK)
Enabling Azure Storage encryption with a customer-managed key (CMK) stored in Azure Key Vault allows the customer to control the encryption key used for data at rest. In the event of a security breach, the customer can immediately revoke access to the CMK in Key Vault (e.g., by disabling the key or deleting the key vault), which renders the encrypted Blob Storage data inaccessible because Azure Storage cannot decrypt it without the key. This satisfies both the encryption-at-rest requirement and the ability to make data inaccessible on demand.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable Azure Storage encryption with a customer-managed key (CMK)
Why this is correct
Customer-managed keys (CMK) give you explicit control over the key hierarchy used to encrypt Azure Storage. Under envelope encryption, the CMK is a key encryption key (KEK) stored in Azure Key Vault that protects the data encryption key (DEK) used for blob encryption. Revoking or disabling the CMK in Key Vault causes Azure Storage to reject any attempt to decrypt the DEK, effectively making the data inaccessible almost immediately. This provides a deliberate, auditable kill switch that meets the requirement to block access on demand.
- ✗
Enable infrastructure encryption
Why it's wrong here
Infrastructure encryption adds a second layer of encryption at the storage infrastructure level using platform-managed keys, resulting in double encryption of data at rest. However, because the keys for this extra layer are owned and managed by Microsoft, you cannot independently revoke or disable them to block access. This option addresses defense-in-depth against physical media theft but fails the requirement for a customer-controlled key revocation capability.
- ✗
Enable soft delete for the storage account
Why it's wrong here
Soft delete for a storage account protects blobs, containers, and snapshots from accidental deletion by retaining them for a configurable period. It does not alter the encryption state of the data at rest nor does it provide any mechanism to revoke decryption keys. Even with soft delete enabled, any principal with valid permissions can still read the data; it is not a security control that can lock out access on demand, so it does not satisfy the stated requirement.
- ✗
Enable Azure AD authentication for Blob Storage
Why it's wrong here
Azure AD authentication for Blob Storage enables granular role-based access control (RBAC) and conditional access policies over data plane operations. However, it governs identity-based authorization, not the encryption key lifecycle. The underlying keys used to encrypt blobs remain unchanged, and Azure AD alone offers no way to revoke or invalidate those keys. Therefore, while it strengthens access control, it does not provide the key revocation capability the scenario demands.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.