DP-203 Design and implement data storage Practice Question
A healthcare company stores patient records in Azure Data Lake Storage Gen2. The data must be encrypted at rest using customer-managed keys (CMK) stored in Azure Key Vault. The company also requires that the encryption keys are automatically rotated every 90 days. You need to configure the storage account to meet these requirements. What should you do?
⚠ Common exam trap
Many exam-takers confuse Azure Disk Encryption with storage account encryption, or assuming that Microsoft-managed keys can have custom rotation policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the storage account to use customer-managed keys from Azure Key Vault and set a key rotation policy in Azure Key Vault.
To use customer-managed keys with Azure Data Lake Storage Gen2, you configure the storage account to reference a key in Azure Key Vault. Azure Key Vault supports automatic key rotation policies, which can rotate the key every 90 days. The storage account automatically uses the new key version. This meets both encryption at rest with CMK and automatic rotation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Disk Encryption with customer-managed keys and schedule a runbook to rotate the keys every 90 days.
Why it's wrong here
Azure Disk Encryption is used for virtual machine disks, not for Azure Data Lake Storage Gen2. It does not apply to storage account encryption. Using a runbook to rotate keys adds unnecessary complexity and does not integrate with storage account encryption. This option is not relevant to the scenario.
- ✗
Enable Azure Storage Service Encryption with Microsoft-managed keys and configure a key rotation policy in Azure Key Vault.
Why it's wrong here
Microsoft-managed keys do not allow you to control rotation; Azure manages them automatically. You cannot set a custom rotation policy for Microsoft-managed keys. Customer-managed keys are required to meet the 90-day rotation requirement and to have control over the keys. This option does not satisfy the requirement for customer-managed keys.
- ✗
Enable infrastructure encryption on the storage account and use Microsoft-managed keys for automatic rotation.
Why it's wrong here
Infrastructure encryption adds a second layer of encryption but still uses Microsoft-managed keys by default. It does not provide customer-managed keys or custom rotation. The requirement for customer-managed keys and 90-day rotation is not met. This option addresses a different security aspect.
- ✓
Configure the storage account to use customer-managed keys from Azure Key Vault and set a key rotation policy in Azure Key Vault.
Why this is correct
Azure Storage supports customer-managed keys stored in Azure Key Vault. By configuring the storage account to use a key from Key Vault and setting a rotation policy on that key, you can automatically rotate the key every 90 days. The storage account will use the latest key version, ensuring encryption with rotated keys.
Go deeper
Related to this question
About these practice questions
One of 509 original DP-203 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Microsoft exam blueprint
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.