Enable Customer-Managed Keys for Azure Storage with Key Revocation
A company stores critical business data in an Azure Storage account (Blob Storage). They want to ensure that all data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need to be able to revoke access to the data quickly if a breach is suspected. Which feature should they enable on the storage account to enforce CMK?
Quick Answer
The answer is enabling Azure Storage encryption with customer-managed keys (CMK). This is correct because it allows you to use your own encryption key stored in Azure Key Vault to protect all data at rest in the storage account, and crucially, it provides the ability to revoke access instantly by disabling, deleting, or rotating that key in Key Vault—rendering the data inaccessible until the key is restored. On the AZ-500 exam, this scenario tests your understanding of data protection controls and the relationship between Azure Storage and Key Vault; a common trap is confusing CMK with infrastructure encryption or Azure Disk Encryption, which apply to different services. Remember the memory tip: “CMK = Control + Revoke” — if you control the key, you can revoke access on demand.
⚠ Common exam trap
It's easy for candidates to confuse infrastructure encryption (which adds a second encryption layer but uses Microsoft-managed keys) with customer-managed key encryption, or they mistakenly think soft delete or versioning can enforce encryption key control and revocation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage encryption with customer-managed keys
Enabling Azure Storage encryption with customer-managed keys (CMK) allows you to use your own key stored in Azure Key Vault to encrypt all data at rest in the storage account. This also provides the ability to revoke access to the data quickly by disabling, deleting, or rotating the key in Key Vault, which renders the data inaccessible until the key is restored.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable infrastructure encryption for the storage account
Why it's wrong here
Infrastructure encryption provides a second layer of encryption at the infrastructure level, but it still uses the same key type as the base encryption. It does not provide the ability to revoke access via key disabling.
- ✓
Enable Azure Storage encryption with customer-managed keys
Why this is correct
This configures the storage account to use a CMK from Key Vault. Revocation is done by disabling the key in Key Vault, making the data inaccessible.
- ✗
Enable soft delete for blobs
Why it's wrong here
Soft delete protects against accidental deletion, but does not change the encryption key management.
- ✗
Enable versioning for blobs
Why it's wrong here
Versioning keeps previous versions of blobs, but does not affect encryption.
Go deeper
Related to this question
About these practice questions
One of 194 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on AZ-500
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You need to ensure that an Azure Storage account's blob data is encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. What should you do first?
easy- A.Generate a random 256-bit key and store it in the storage account.
- ✓ B.Create an Azure Key Vault with soft-delete and purge protection enabled.
- C.Create a system-assigned managed identity for the storage account.
- D.Enable Azure Information Protection for the storage account.
Why B: To use a customer-managed key (CMK) for encrypting Azure Storage blob data, the key must be stored in an Azure Key Vault that supports the required lifecycle operations. Azure Key Vault must have both soft-delete and purge protection enabled to prevent permanent key deletion, which is a prerequisite for using CMK with Azure Storage. Without these features, the storage account cannot be configured to use the key, as Azure Storage requires the key to be recoverable.
Variation 2. A company stores sensitive customer data in an Azure Storage account. The security policy requires that all data be encrypted at rest using a customer-managed key (CMK) stored in Azure Key Vault. They also need the ability to disable the key in case of a security breach and have the data become inaccessible immediately. Which feature should they enable on the storage account to achieve this?
medium- ✓ A.Enable Azure Storage encryption with customer-managed keys (CMK)
- B.Use service-managed keys (SSE) with platform-managed keys
- C.Enable Azure Disk Encryption on VMs that access the storage account
- D.Configure Azure Information Protection for the storage account
Why A: Enabling Azure Storage encryption with customer-managed keys (CMK) allows the customer to use their own key stored in Azure Key Vault for encrypting the storage account data at rest. The key can be disabled or revoked in Key Vault, which immediately renders the data inaccessible because Azure Storage uses the key to wrap the data encryption key; without access to the CMK, decryption cannot occur.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.