SC-100 Certification Practice Question #233

Question

You have an Azure subscription that contains multiple storage accounts. The accounts contain Azure Files shares and Azure Blob Storage containers. The accounts have encryption scopes and infrastructure encryption enabled.

You need to implement customer-managed key-based encryption for the shares and the containers. The solution must ensure that the encryption keys are applied at the most granular level.

At which level should you apply the encryption keys? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement is the *most granular* level for customer-managed key encryption. Encryption scopes let a CMK be scoped to an individual blob, which is finer than the container or account level, so the containers row resolves to **Blob**. Azure Files supports CMK but only at the account/share level — there is no per-file CMK granularity — so the most granular achievable level for the shares is the **Share**. RoboCock (👍 4) states this directly for shares, and MS Learn confirms blob-level granularity for encryption scopes and lists blob as the finest CMK scope. The "Blob and File" answers (sweetykaur 👍 4, tuyi2 👍 3) correctly pick Blob for containers but mis-map the shares row to "File," which is not a supported CMK granularity for Azure Files. Confidence is 80% because the community vote leans toward "File" for the second row even though the documented granularity floor for Files is the share.

More SC-100 practice questions