Exam AZ-301 topic 6 question 25 discussion

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management You can specify a customer-managed key with Azure Key Vault to use for encrypting and decrypting data in Blob storage and in Azure Files

No Doubt in given answer. By default Blob and File is always managed by customer key. Table and queue are always used Microsoft managed key.

C. Azure Blob storage E. Azure Files

given answer is correct.

Data in Blob storage and Azure Files is always protected by customer-managed keys when customer-managed keys are configured for the storage account. https://docs.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management You can specify a customer-managed key with Azure Key Vault to use for encrypting and decrypting data in Blob storage and in Azure Files.1,2 For more information about customer-managed keys, see Use customer-managed keys with Azure Key Vault to manage Azure Storage encryption. Ans: Files and Blob.

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management About encryption key management Answers are OK

E: Azure Files is correct because we are using this same scenario in our production environment. B: Blob storage - may be correct because - another requirement is to provide Encryption-at-rest ( which incase is provided by Blob - because the data can be encrypted while being stored on a Blob storage in the cloud)

given answers are correct

Think the answers are correct, but the reference seem irrelevant.

I find this requirement somehow vague. "Encrypt data only by using a key generated by the company.". The requirement asks for a key _generated_ by the company. The provided answers are valid for "customer-managed keys", which are store in Azure Key Vault. Then however the Azure Key Vault would generate the keys, no? If so the only valid answer would be "Blob Storage"

given ans is correct

i also see this: All Azure Storage resources are encrypted, including blobs, disks, files, queues, and tables. All object metadata is also encrypted. - so queues and tables are also encrypted at rest and i see this: 1 For information about creating an account that supports using customer-managed keys with Queue storage, see Create an account that supports customer-managed keys for queues. 2 For information about creating an account that supports using customer-managed keys with Table storage, see Create an account that supports customer-managed keys for tables. so there is a way to use customer-managed keys for queues and tables. i stick with the answer but it's doubtful

https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption