QuestionQ97

Design security solutions for infrastructure

You are planning security for an Azure landing zone.

Your company has identified these compliance and privacy requirements:

  • Encrypt cardholder data using encryption keys managed by the company.
  • Encrypt insurance claim files using encryption keys hosted on-premises.

Which two configurations satisfy the compliance and privacy requirements? Each correct answer represents part of the solution.

NOTE: Each correct selection is worth one point.

Choose two
  • A Store the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys.
  • B Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys.
  • C Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.
  • D Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.
Explanation

Azure SQL Database transparent data encryption supports customer-managed keys stored in Azure Key Vault Managed HSM, allowing the company to control the key lifecycle. Blob Storage supports customer-provided encryption keys on requests; Azure Storage does not persist those keys, allowing the company to retain them in an on-premises key store.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!