AZ-500 Secure compute, storage, and databases Practice Question
A company stores sensitive documents in an Azure Blob Storage account. They have enabled infrastructure encryption and configured the storage account to use a customer-managed key stored in Azure Key Vault for encryption at rest. Despite this, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume the storage account-level CMK setting applies uniformly to all blobs, but they overlook that encryption scopes at the container level can override that setting, causing a silent fallback to Microsoft-managed keys.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A default encryption scope is configured on the blob container that uses a Microsoft-managed key.
When a default encryption scope is set on a blob container, it overrides the storage account's encryption settings for all blobs uploaded to that container. Even if the storage account is configured with a customer-managed key (CMK), the container-level encryption scope with a Microsoft-managed key takes precedence, causing new blobs to be encrypted with Microsoft-managed keys instead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The Key Vault is in a different Azure region than the storage account.
Why it's wrong here
Azure Key Vault and Azure Storage accounts are independent resources that can reside in different Azure regions. Customer-managed key encryption only requires the storage account to authenticate to the Key Vault using a managed identity and the Key Vault's URI; there is no regional affinity or co-location requirement. Because cross-region Key Vault access is fully supported, this configuration alone would never cause new blobs to fall back to Microsoft-managed keys. The actual override in the scenario comes from a container-level default encryption scope, not the Key Vault's location.
- ✗
The storage account does not have a system-assigned managed identity enabled.
Why it's wrong here
For customer-managed keys, the storage account uses a managed identity to access the Key Vault. If the managed identity is missing or not configured, encryption operations would fail, but they would not fall back to Microsoft-managed keys silently. The blobs would not upload successfully or would fail encryption.
- ✓
A default encryption scope is configured on the blob container that uses a Microsoft-managed key.
Why this is correct
Encryption scopes can be set at the container level. A default encryption scope overrides the storage account-level encryption. If the scope uses Microsoft-managed keys, new blobs in that container will not use the customer-managed key.
- ✗
The customer-managed key in Key Vault is disabled or expired.
Why it's wrong here
If a customer-managed key is disabled or expired, Azure Storage cannot perform the key wrapping and unwrapping operations needed to encrypt or decrypt blob data using that key. In that situation, write and read operations fail with errors (for example, a 403 or an exception stating the key is disabled), and new blobs are not silently encrypted with Microsoft-managed keys. Azure does not automatically downgrade a customer-managed key configuration to Microsoft-managed encryption when the key becomes unusable. A silent fallback to Microsoft-managed keys is behavior that would only occur via a container-level encryption scope explicitly configured to use Microsoft-managed keys, not via key state.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
About these practice questions
Courseiva writes every AZ-500 question from scratch — 194 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.