AZ-500 Storage account access keys Practice Question
You manage Azure Storage accounts for a healthcare organization. To comply with HIPAA, you need to ensure that all data at rest is encrypted and that encryption keys are rotated automatically every 90 days. What should you implement?
⚠ Common exam trap
The main trap is confusing storage account access keys (used for authentication) with encryption keys (used for data at rest). Candidates may choose manual rotation of access keys, but that does not meet the automatic rotation requirement for encryption keys and only addresses a different type of key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.
Customer-managed keys (CMK) stored in Azure Key Vault with automatic key rotation fulfill the requirement for encrypted data at rest and automatic rotation of encryption keys. This ensures that HIPAA compliance is met by maintaining control over encryption keys and enforcing their periodic rotation. The other options do not provide automatic key rotation: RBAC controls access but does not rotate keys; infrastructure encryption adds another layer but does not include key rotation; manually rotating storage account access keys addresses authentication keys, not encryption keys, and is not automatic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure Azure RBAC roles for storage accounts.
Why it's wrong here
Azure RBAC roles, such as Storage Blob Data Owner or Reader, are authorization primitives that control which principals can perform operations against the storage account or its data plane. They do not implement encryption at rest, nor do they manage or rotate the keys that protect the data. Even with fine-grained RBAC assignments, the underlying data encryption relies on Azure- or customer-managed keys, so this option fails to satisfy the key rotation requirement.
- ✗
Enable infrastructure encryption for storage accounts.
Why it's wrong here
Infrastructure encryption, also known as double encryption, adds a second layer of encryption at the hardware infrastructure level on top of the service-level encryption. Both layers use platform-managed keys controlled by Microsoft, so you cannot define a rotation schedule or bring your own key material. While this improves defense-in-depth against physical threats, it does not provide automatic rotation of customer-controlled encryption keys, making it insufficient for the stated compliance need.
- ✗
Generate new storage account access keys manually every 90 days.
Why it's wrong here
Regenerating storage account access keys every 90 days changes the shared secret used for request authentication, not the encryption keys that protect your data at rest. Access keys are analogous to passwords and are validated by the storage service to authorize requests; they never touch the AES-256 encryption layer. Moreover, manual rotation is by definition not automatic, so it cannot meet a policy that requires automatic key rotation without human intervention.
- ✓
Use customer-managed keys (CMK) in Azure Key Vault with automatic key rotation.
Why this is correct
Customer-managed keys in Azure Key Vault let you supply the key encryption key (KEK) that wraps the data encryption key (DEK) used to encrypt every storage object, giving you full control over key lifecycle. When you enable automatic key rotation, Azure Key Vault creates a new key version according to the rotation policy you define, and Azure Storage re-wraps the DEK without any downtime or data re-encryption. This directly satisfies both the encryption-at-rest and automatic-rotation requirements, which is why it is the correct choice.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This AZ-500 question is part of Courseiva's 194-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.