AZ-500 Secure compute, storage, and databases Practice Question
A company has an Azure Storage account with infrastructure encryption enabled. They configure the storage account to use customer-managed keys (CMK) stored in Azure Key Vault for encryption at rest. Despite this configuration, newly uploaded blobs are still encrypted with Microsoft-managed keys. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume that simply configuring a customer-managed key in Key Vault automatically changes the storage account's encryption type, but Azure requires an explicit configuration step to switch the encryption type from 'Microsoft-managed keys' to 'Customer-managed keys'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The storage account's encryption type is set to Microsoft-managed keys
The storage account's encryption type must be explicitly set to 'Customer-managed keys' to use CMK from Azure Key Vault. If the encryption type remains at the default 'Microsoft-managed keys', newly uploaded blobs will continue to be encrypted with Microsoft-managed keys regardless of the CMK configuration in Key Vault. Infrastructure encryption is a separate feature that encrypts data at the hardware level and does not affect the key management type.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage account was created before infrastructure encryption was generally available
Why it's wrong here
Infrastructure encryption is a hardware-level double-encryption feature that uses platform-managed keys at the physical disk layer, and it is independent of the Azure Storage account's encryption type setting. Even if the storage account predates the general availability of infrastructure encryption, this has no bearing on whether blobs are encrypted with customer-managed or Microsoft-managed keys. The encryption type for blob data is determined solely by the account's encryption setting, not the account's creation date or the presence of infrastructure encryption.
- ✗
The customer-managed key in Key Vault is disabled or expired
Why it's wrong here
When a customer-managed key is disabled or expired, Azure Storage cannot encrypt new data with that key, so write operations to the storage account will begin to fail with an authorization error. The service never falls back to Microsoft-managed keys in this scenario; the account remains in a degraded state requiring the key to be re-enabled or replaced. Therefore, a disabled or expired CMK would not cause blobs to be silently encrypted with Microsoft-managed keys, but rather would cause applications to encounter errors when attempting to write data.
- ✓
The storage account's encryption type is set to Microsoft-managed keys
Why this is correct
The storage account's encryption type is the explicit control that determines which key type is used for Azure Storage encryption. If the encryption type is set to 'Microsoft-managed keys', all blob data is encrypted with Microsoft-managed keys regardless of any customer-managed key configuration that may also exist in the account. To use a customer-managed key, the account must be created or updated with the encryption type set to 'Customer-managed keys' and a key must be specified in Key Vault. Since the blobs are encrypted with Microsoft-managed keys, the encryption type must be the one controlling this behavior.
- ✗
The blob container has a policy that overrides the encryption setting
Why it's wrong here
Blob containers do not support policies that override the storage account's encryption settings; encryption is enforced at the storage account level and applies uniformly to all blobs within it. Container-level features such as immutability policies, legal holds, or container access policies only control data lifecycle or access permissions, not how the data is encrypted. No container-level setting can cause a storage account to use Microsoft-managed keys when the account-level encryption type specifies customer-managed keys, so this option cannot explain the observed encryption behavior.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.