SC-100: Microsoft Cybersecurity ArchitectDemo

By Microsoft · Question Mode

QuestionQ358

Design security solutions for applications and data

You have an on-premises application that processes Personally Identifiable Information (PII) and sends the data to Azure. The application includes the following components:

  • APIs that receive and send the PII
  • A data ingestion pipeline that stores the PII in an Azure Data Lake Storage Gen2 account

A compliance policy requires that all the PII data be encrypted by using encryption keys that are regularly rotated and stored in a central repository.

You need to recommend a solution that adheres to the compliance policy. The solution must minimize administrative effort.

Which two components should you include in the recommendation? Each correct answer presents part of the solution.

Choose two
  • A Azure Cloud HSM
  • B Microsoft Cloud PKI
  • C Azure Key Vault
  • D service-side encryption (SSE)
  • E Transparent Data Encryption (TDE)
  • F Azure Disk Encryption
Explanation

Azure Data Lake Storage Gen2 encrypts data at rest automatically through service-side encryption (SSE). To meet a compliance requirement for centrally stored, regularly rotated encryption keys with minimal administrative effort, you configure SSE to use customer-managed keys, and store and manage those keys in Azure Key Vault, which provides centralized storage, access control, and automated key rotation. TDE, Azure Disk Encryption, Cloud HSM, and Cloud PKI address different services (databases, VM disks, hardware key protection, and certificates respectively) and are not the appropriate mechanisms for encrypting Data Lake Storage Gen2 data at rest.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!