AZ-500 Secure compute, storage, and databases Practice Question
You need to encrypt an Azure Storage account at rest using a customer-managed key stored in Azure Key Vault. Which feature should you enable?
⚠ Common exam trap
Candidates often confuse Azure Disk Encryption (which encrypts VM disks) with Azure Storage Service Encryption (which encrypts the storage account's data at rest), leading candidates to pick Option C when the question explicitly targets storage account encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Storage Service Encryption with customer-managed keys
Azure Storage Service Encryption (SSE) encrypts data at rest automatically. By enabling customer-managed keys (CMK) in Azure Key Vault, you can control the encryption key used for SSE, meeting the requirement to encrypt the storage account with a key you manage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Information Protection
Why it's wrong here
Azure Information Protection is a data classification and labeling solution (now part of Microsoft Purview Information Protection) that applies sensitivity labels and rights management to documents and emails, optionally encrypting them. However, it does not provide transparent, account-level encryption for Azure Storage at rest, nor does it interact with blob, file, or queue storage encryption. Therefore, it cannot satisfy the requirement to encrypt a storage account at rest.
- ✗
Azure Confidential Computing
Why it's wrong here
Azure Confidential Computing protects data in use by isolating workloads in hardware-based trusted execution environments (TEEs) such as Intel SGX and confidential containers. This prevents unauthorized access while data is being processed in memory, but it has no effect on data at rest in a storage account. Encryption of stored data is a separate layer managed by Storage Service Encryption, so Confidential Computing is not the right solution for this requirement.
- ✗
Azure Disk Encryption
Why it's wrong here
Azure Disk Encryption (ADE) uses BitLocker (Windows) or DM-Crypt (Linux) to encrypt the OS and data disks attached to Azure IaaS virtual machines, storing the keys in Azure Key Vault. While it does protect VHDs written to a storage account, the underlying storage account itself is not exposed as a separate encryption target; ADE operates at the VM disk level, not for blobs, tables, queues, or file shares. Thus it does not meet the requirement to encrypt the storage account's data at rest as a whole.
- ✓
Azure Storage Service Encryption with customer-managed keys
Why this is correct
Azure Storage Service Encryption (SSE) automatically encrypts all data at rest in an Azure storage account using AES-256 before it is persisted to disk. When configured with customer-managed keys, you supply a key from your Azure Key Vault or Managed HSM, giving you control over rotation, revocation, and audit logging of the encryption key. This is the correct service-level mechanism to encrypt a storage account at rest with a key you manage.
Go deeper
Related to this question
About these practice questions
One of 617 original AZ-500 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-500 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-500 exam.