Exam SC-100 topic 2 question 10 discussion

I would like to select B & C

Hardware Security Module takes the cake. Want to use your own keys? Great. You can still do that with BYOK.

D does not meet the requirement of using encryption keys hosted on-premises, as Managed HSM is an Azure-hosted service.

Its C and D, customer managed keys for blob and files must be stored in key vault or Azure HSM. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management

It is obvious for me B & C

C - everybody almost agree with this option. So, what is second for insurence claim files? You can use on prem keys and store them on Azure Managed HSM Import keys from your on-premises HSMs Generate HSM-protected keys in your on-premises HSM and import them securely into Managed HSM. https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview#import-keys-from-your-on-premises-hsms

It is not D and for those choosing D, please refer to the diagram for Azure Storage here: https://rajanieshkaushikk.com/2023/04/08/azure-blob-storage-vs-file-storage-vs-disk-storage-which-is-right-for-you/

Answer seems correct. C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM: This option aligns with the requirement to encrypt cardholder data using encryption keys managed by the company. Azure Key Vault Managed HSM provides FIPS 140-2 Level 3 validated HSMs, ensuring a high level of security for key management. D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM: This option allows you to generate HSM-protected keys on-premises and securely import them into Azure Key Vault Managed HSM. By encrypting insurance claim files with keys stored in Azure Key Vault Managed HSM, you can meet the requirement to encrypt insurance claim files using encryption keys hosted on-premises while leveraging the security and manageability of Azure Key Vault Managed HSM. https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/hsm-protected-keys-byok

Option A is incorrect because it uses Microsoft-managed keys, which does not meet the requirement for the company to manage the encryption keys for cardholder data. Option D is incorrect because it uses Azure Key Vault Managed HSM, which is a cloud-based service. The requirement for insurance claim files is to use keys hosted on-premises.

C is definitely one of the answers

To meet the compliance and privacy requirements for encrypting cardholder data and insurance claim files, you should consider the following configurations: ✅ C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM. ✅ D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.

C and D - surely you can't recommend storing cardholder data in a storage account.

CD https://learn.microsoft.com/en-us/azure/key-vault/managed-hsm/overview

Currently, Azure Blob storage does not support customer-provided keys (BYOK) for encryption. Azure Blob storage utilizes Azure Storage Service Encryption (SSE) to automatically encrypt data at rest. With SSE, Azure Blob storage encrypts your data using Microsoft-managed keys. These keys are managed and rotated by Azure behind the scenes, providing a high level of security for your data. You do not have direct control over the encryption keys used by Azure Blob storage. so answer: C & D

BC is the answer. https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?view=azuresql Azure SQL transparent data encryption (TDE) with customer-managed key (CMK) enables Bring Your Own Key (BYOK) scenario for data protection at rest, and allows organizations to implement separation of duties in the management of keys and data. With customer-managed TDE, the customer is responsible for and in a full control of a key lifecycle management (key creation, upload, rotation, deletion), key usage permissions, and auditing of operations on keys.

AB is correct in my opinion ,Explanation: A. Storing cardholder data in an Azure SQL database encrypted with Microsoft-managed keys ensures that the data is encrypted. Microsoft-managed keys are suitable for encrypting cardholder data as per compliance requirements. B. Storing insurance claim data in Azure Blob storage encrypted with customer-provided keys allows for encryption of the data. By using on-premises keys, the company maintains control over the encryption keys and meets the requirement for encrypting insurance claim files.

AB is right