SC-100 Certification Practice Question #229

Question

You have an Azure subscription that contains multiple Azure Data Lake Storage accounts.

You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level.

At which level should you recommend the encryption be applied?

Accepted Answer

The requirement is the *most granular* level for service-side encryption with customer-managed keys. Per MS Learn, Azure Storage encryption scopes let you scope a CMK to "an individual blob or container," and the key-scope table lists Account (default), container, or blob — there is no folder-level scope. Because ADLS Gen2 is built on Blob Storage and a file maps directly to a blob (confirmed by the ADLS Gen2 ↔ Blob resource mapping), the individual blob/file is strictly more granular than container, which is more granular than account. Suggested Answer (A) and the dominant community vote (A, 16 votes) both agree, and the highest-voted supporting comments cite the same encryption-scope/blob granularity. The "account-only" minority (Luweho, 👍 7) and "container-only" voters confuse ADLS account-level CMK defaults with the finer encryption-scope capability; folder-level encryption simply does not exist. Confidence is held at 84% rather than higher because the question's word "file" (vs. the docs' word "blob") is genuinely ambiguous exam phrasing that split the community.

More SC-100 practice questions