SC-100 Certification Practice Question #127

Question

You have an Azure Storage account named storage1.

You plan to secure storage1 by using a Bring Your Own Key (BYOK) strategy.

You create an Azure key vault named AKV1 and upload a compatible key.

You need to configure storage1 to use the key stored in AKV1 for encryption.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Accepted Answer

Customer-managed key (BYOK) encryption requires the storage account to authenticate to the key vault, so the storage account first needs a managed identity (`Create a managed identity and assign it to storage1`). That identity must then be granted key permissions — wrapkey/unwrapkey/get via a Key Vault access policy (or the equivalent Crypto Service Encryption User RBAC role) — so step two is `Create and assign a Key Vault access policy`. Only after the identity exists and is authorized can you point the storage account at the AKV1 key (`Configure Azure Storage encryption with customer-managed keys`). MS Learn's CMK flow (grant identity key permissions → configure encryption) and both community sequences agree exactly. Confidence is held at 88% because no official suggested answer or vote tally is published for this drag-drop, though the doc-grounded ordering is unambiguous.

More SC-100 practice questions