AZ-204 Certification Practice Question #251

Question

You need to ensure the security policies are met.
What code do you add at line CS07 of ConfigureSSE.ps1?

Accepted Answer

When configuring Azure Storage Service Encryption (SSE) to use customer-managed keys stored in an Azure Key Vault, the storage account's managed identity requires permission to access the key vault. Specifically, it needs the `get` permission to retrieve key metadata, and `wrapkey` and `unwrapkey` to perform envelope encryption (encrypting/decrypting the account's internal symmetric encryption keys). These are specified under key permissions using the `-PermissionsToKeys` parameter. The other options either request permissions that are too broad/incorrect (`encrypt/decrypt`) or target certificates instead of keys.

More AZ-204 practice questions