AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive data in Azure Blob Storage. They want to enforce encryption at rest using a customer-managed key (CMK) stored in Azure Key Vault. Additionally, they require that the key vault be in a different region than the storage account to protect against regional disasters. Can this be achieved, and if so, what is the implication?
⚠ Common exam trap
A common mix-up: candidates assume Azure's global infrastructure allows cross-region key vault access for CMK, but Azure explicitly restricts CMK to the same region to maintain low-latency encryption operations and avoid cross-region dependency for data at rest.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No, Azure does not support CMK from a different region than the storage account.
Azure Blob Storage encryption with customer-managed keys (CMK) requires the key vault to reside in the same Azure region as the storage account. This is a hard platform constraint because the storage account's encryption service must communicate with the key vault over the regional boundary to wrap/unwrap the data encryption key (DEK) using the customer-managed key (KEK). Cross-region CMK is not supported, making option C the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Yes, but the storage account must use a different key vault per region; no other implications.
Why it's wrong here
This is incorrect because the core limitation is not addressed by using multiple key vaults. Azure Storage CMK only works when the key vault resides in the exact same region as the storage account; even if you create a separate vault for each region, that is just the standard topology, not an exception to the cross-region prohibition. Moreover, the claim that there are 'no other implications' is false—you must enable soft-delete and purge protection on the vault, configure a managed identity for the storage account, and plan for key rotation, so multiple operational considerations apply.
- ✗
Yes, but you must enable cross-region replication for the key vault and pay additional costs.
Why it's wrong here
Azure Key Vault offers geo-replication for the vault itself, but this does not enable using a vault from a different region for storage encryption. The storage encryption CMK feature requires the vault to be in the same region.
- ✓
No, Azure does not support CMK from a different region than the storage account.
Why this is correct
Correct. Azure Storage customer-managed keys require the key vault (or managed HSM) to be in the same Azure region as the storage account. Azure Key Vault is a regional service, and the key material cannot be used for encryption operations outside that region, so a CMK from a different region is simply not supported. This is a documented architectural constraint, and no configuration or feature—such as geo-replication or multi-region vaults—bypasses this requirement.
- ✗
Yes, but you must use a managed identity from the storage account's region to access the key vault.
Why it's wrong here
This is wrong because the region of a managed identity is irrelevant to the co-region requirement. The storage account authenticates to Key Vault using a system-assigned or user-assigned managed identity, but that identity is an Azure AD object with no physical region that could satisfy the storage account's key vault location constraint. Even if the managed identity is created in the same region as the storage account, the key vault itself must still reside in that same Azure region; the identity only affects authentication, not the regional compatibility requirement.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.