Describe considerations for working with non-relational data on Azure →hardMultiple ChoiceObjective-mapped
DP-900 Customer-managed keys (CMK) Practice Question
A company stores sensitive customer data in Azure Blob Storage. They need to ensure that data at rest is encrypted using a customer-managed key that is stored in Azure Key Vault. Additionally, they want to prevent data from being accessed by unauthorized users even if the storage account key is compromised. Which combination should they use?
⚠ Common exam trap
Candidates may assume that Azure Defender for Storage alone prevents access, but it only detects. The prevention comes from the ability to revoke the customer-managed key upon detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable customer-managed keys and use Azure Defender for Storage
Customer-managed keys (CMK) stored in Azure Key Vault allow you to control and revoke the encryption key, thereby preventing decryption of data at rest even if the storage account key is compromised. Azure Defender for Storage provides threat detection and can trigger alerts or automated responses (e.g., revoking the key) to stop unauthorized access. Together, CMK gives you control over encryption and Defender enables detection and response, effectively preventing unauthorized access. Options B, C, and D do not provide either encryption control or security monitoring necessary to meet the requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable customer-managed keys and use Azure Defender for Storage
Why this is correct
Customer-managed keys stored in Azure Key Vault let the customer create, rotate, and revoke the encryption keys used by Azure Storage, giving them the ability to cryptographically erase data and meet key-control compliance demands. Azure Defender for Storage continuously analyzes storage account telemetry to detect suspicious activities such as anomalous access patterns, privilege attempts, and known malware, then raises alerts or triggers automated mitigation. Together these two services address both requirements: customer-controlled encryption plus active threat detection.
- ✗
Enable customer-managed keys and use Azure Monitor
Why it's wrong here
Customer-managed keys provide the needed control over encryption keys, but Azure Monitor is strictly a telemetry and alerting service: it collects metrics and logs from resources and can trigger notifications based on thresholds, yet it has no built-in anomaly-detection logic for Azure Storage data-plane activity and cannot block unauthorized access on its own. It therefore satisfies only the key-control half of the requirements, leaving the threat-detection requirement unmet.
- ✗
Enable infrastructure encryption and use Azure Backup
Why it's wrong here
Infrastructure encryption adds a second layer of AES-256 encryption at the Azure infrastructure level, but the keys remain Microsoft-managed, so the customer still lacks the control and revocability that customer-managed keys provide. Azure Backup is designed to create and restore recovery points for blob data; it does not analyze storage telemetry for malicious behavior and has no role in preventing unauthorized access. Consequently this combination provides neither the required key management nor the required threat-detection capability.
- ✗
Enable storage account encryption and use Azure Sentinel
Why it's wrong here
Enabling storage account encryption merely applies the default Azure Storage encryption with Microsoft-managed keys, so the customer cannot control, rotate, or revoke the keys as required. Azure Sentinel is a cloud-native SIEM/SOAR that ingests logs from many sources and can help analysts hunt and respond, but it does not natively detect or prevent storage-specific threats without additional data connectors and retention configurations. This option therefore fails the customer-managed key control requirement and does not directly protect the storage account.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Blob storage
Blob storage is a cloud service for storing large amounts of unstructured data, such as text or binary data, like documents, images, and videos.
Key term
Trigger
In Azure data services, a trigger is a predefined automatic action that initiates a process when a specific event occurs, such as data arriving or a schedule being met.
About these practice questions
Courseiva writes every DP-900 question from scratch — 820 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.