DP-203 Practice Question: Secure, monitor, and optimize data storage and data processing
Exhibit
Refer to the exhibit.
{
"properties": {
"encryption": {
"keySource": "Microsoft.Keyvault",
"keyVaultProperties": {
"keyName": "mykey",
"keyVersion": "",
"keyVaultUri": "https://myvault.vault.azure.net/"
},
"infrastructureEncryption": "Enabled"
}
}
}Refer to the exhibit. You are creating an Azure Storage account using an ARM template with the above snippet. After deployment, a security auditor reviews the configuration and notes that the storage account is not using a customer-managed key for encryption. What is the most likely reason?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'keyVersion' is missing a specific version, so Azure Storage defaults to Microsoft-managed key.
In the ARM template snippet, the 'keyVersion' property is empty. Azure Storage requires a specific key version to use a customer-managed key; if omitted, Azure defaults to Microsoft-managed keys if the key is not found or the vault is inaccessible. Option B is incorrect because 'keySource' should be 'Microsoft.Keyvault' for customer-managed keys, not 'Microsoft.Storage'. Option C is incorrect because infrastructure encryption (double encryption) is independent of the key source. Option D is incorrect because enabling 'infrastructureEncryption' does not override the key source; it can be used with customer-managed keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The 'keyVersion' is missing a specific version, so Azure Storage defaults to Microsoft-managed key.
Why this is correct
For customer-managed key, a specific key version is required; an empty version may cause Azure to use the latest but if the key is not accessible, it falls back to Microsoft-managed key.
- ✗
The 'keySource' should be 'Microsoft.Storage' for customer-managed key.
Why it's wrong here
'Microsoft.Keyvault' is correct for customer-managed key.
- ✗
The storage account requires double encryption to use customer-managed key.
Why it's wrong here
Double encryption is an additional feature but not a prerequisite for customer-managed key.
- ✗
The 'infrastructureEncryption' setting is enabled, which overrides customer-managed key.
Why it's wrong here
Infrastructure encryption works with customer-managed keys; it does not override.
Go deeper
Related to this question
About these practice questions
This DP-203 question is part of Courseiva's 760-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-203 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-203 exam.