Describe considerations for working with non-relational data on Azure →hardMultiple ChoiceObjective-mapped
DP-900 Practice Question: Describe considerations for working with non-relational data on Azure
A hospital stores medical images in Azure Blob Storage. They must ensure that images are encrypted at rest using customer-managed keys (CMK) and that access to the keys is audited. What should you implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable Azure Storage Service Encryption with a customer-managed key in Azure Key Vault.
Azure Storage encryption with customer-managed keys stored in Azure Key Vault provides the required control and auditing. Option A is wrong because Azure Disk Encryption is for VMs, not Blob Storage. Option B is wrong because Azure Information Protection is for classification, not encryption at rest. Option D is wrong because Transparent Data Encryption (TDE) is for SQL databases, not Blob Storage. Option C is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Azure Disk Encryption to encrypt the storage account.
Why it's wrong here
Azure Disk Encryption is designed specifically to encrypt the OS and data disks of Windows and Linux virtual machines using BitLocker or DM-Crypt, not the contents of a storage account. Medical images stored as blobs in Azure Blob Storage are not covered by VM disk encryption. Blob encryption at rest is handled by Azure Storage Service Encryption, which is independent of VM disk encryption.
- ✗
Apply Azure Information Protection labels to the blobs.
Why it's wrong here
Azure Information Protection (now part of Microsoft Purview) classifies and labels documents and emails and can optionally apply rights management protection to individual files, but it does not provide encryption at rest for blobs stored in an Azure storage account. Labels may encrypt Office files or PDFs, but they do not encrypt the underlying storage or make blobs inaccessible to someone with storage account credentials. Therefore, this option neither encrypts the medical images at rest nor offers centralized key management for Azure Blob Storage.
- ✓
Enable Azure Storage Service Encryption with a customer-managed key in Azure Key Vault.
Why this is correct
Azure Storage Service Encryption (SSE) automatically encrypts all data written to Azure Blob Storage using 256-bit AES encryption. By configuring a customer-managed key (CMK) in Azure Key Vault, you gain full control over key lifecycle, rotation, and audit logging, which is essential for compliance in healthcare environments. This is the correct method to encrypt medical images at rest while maintaining auditable key management.
- ✗
Use Transparent Data Encryption (TDE) on the storage account.
Why it's wrong here
Transparent Data Encryption (TDE) is a feature of Azure SQL Database, SQL Managed Instance, and Azure Synapse Analytics that encrypts database files on disk. It does not apply to Azure Storage accounts—there is no TDE setting for blob storage in the Azure portal or management APIs. For blobs, encryption at rest is provided by Azure Storage Service Encryption at the storage service layer, not by a database engine feature.
Quick reference
Azure Blob Storage Tier Comparison
| Tier | Storage Cost | Retrieval Cost | Latency | Use Case |
|---|---|---|---|---|
| Hot | Highest | Lowest | Immediate | Active data, frequent reads |
| Cool | Lower | Higher | Immediate | Data accessed < once / month |
| Cold | Lower still | Higher | Immediate | Data accessed < once / quarter |
| Archive | Lowest | Highest + rehydration delay | Hours | Long-term compliance retention |
Go deeper
Related to this question
Learn chapter
Data Roles and Core Concepts
Key term
Data
Data is raw, unprocessed information, like numbers, words, or measurements, that can be stored, processed, and analyzed by computers.
Key term
Azure Storage
Azure Storage is Microsoft's cloud-based service for storing data like files, messages, and backups with high durability and scalability.
About these practice questions
One of 820 original DP-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DP-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DP-900 exam.