AZ-900 Describe Azure architecture and services Practice Question
Which Azure service provides a dedicated hardware security module (HSM) for generating and storing cryptographic keys?
⚠ Common exam trap
A common mix-up: candidates confuse Azure Key Vault Premium tier (which uses HSM-backed keys but is still multi-tenant) with Azure Dedicated HSM (which provides a single-tenant, dedicated hardware appliance), leading them to select the Premium tier thinking it offers the same isolation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Azure Dedicated HSM
Azure Dedicated HSM provides a single-tenant, FIPS 140-2 Level 3 validated hardware security module that is fully under your control, allowing you to generate and store cryptographic keys in a dedicated appliance. Unlike Key Vault, which is a multi-tenant software-based service, Dedicated HSM gives you exclusive access to the HSM hardware for compliance and high-security workloads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Azure Key Vault Standard tier
Why it's wrong here
Azure Key Vault Standard tier stores keys and secrets using software-based encryption only, meaning no hardware security module (HSM) is involved. This tier cannot meet regulatory or compliance requirements that mandate FIPS 140-2 Level 3 validated hardware protection. Additionally, the customer has no visibility into or control over the underlying cryptographic hardware, so it fails the requirement for exclusive use of a physical HSM.
- ✓
Azure Dedicated HSM
Why this is correct
Azure Dedicated HSM provides a single-tenant hardware security module appliance deployed directly into the customer's virtual network, giving them exclusive control over the physical device and full administrative access. It is FIPS 140-2 Level 3 validated, satisfying strict security and compliance requirements for cryptographic key storage and management. The customer manages the HSM themselves, with no shared infrastructure, which makes it the correct choice when an isolated, dedicated HSM is mandated.
- ✗
Azure Key Vault Premium tier
Why it's wrong here
Azure Key Vault Premium tier does offer HSM-backed keys, but they are provisioned on a shared HSM infrastructure managed by Microsoft, where multiple customers' keys reside on the same physical device. While the keys are protected by the HSM, the customer does not have exclusive administrative control or a dedicated appliance. For scenarios requiring absolute separation and customer-managed physical hardware, the shared nature of Premium tier is insufficient.
- ✗
Azure Confidential Computing
Why it's wrong here
Azure Confidential Computing protects data in use by running workloads inside hardware-based trusted execution environments (TEEs) like Intel SGX, isolating code and data from the host OS and hypervisor. However, it is not a key management or storage service; it does not provide any HSM for cryptographic key operations. Confidential Computing addresses memory and processing confidentiality, not the requirement for a dedicated, physical hardware security module for key storage.
Go deeper
Related to this question
Learn chapter
Azure Regions and Geographies
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Tenant
A dedicated and isolated instance of Microsoft Entra ID that an organization receives when signing up for a Microsoft cloud service.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.