CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Understanding Azure Blob Storage Encryption: An Exam Question Walkthrough
Learn the correct answer for Azure Blob Storage encryption and why other options fail. Prepare for the AZ-104 exam effectively.
When it comes to Azure Blob Storage, the question of encryption can trip up many candidates. It's crucial to know not just the answer, but also the underlying principles that drive these types of questions.
The question
Your company needs to ensure that sensitive data in Azure Blob Storage is encrypted at rest. What is the default encryption method that Azure uses for Blob storage?
- A. Server-side encryption with platform-managed keys (SSE-PMK)
- B. Client-side encryption with customer-managed keys (CSE-CMK)
- C. Server-side encryption with customer-managed keys (SSE-CMK)
- D. Server-side encryption with service-managed keys (SSE-SMK)
Think before you scroll
Before jumping to the answer, consider the different types of encryption Azure offers. Each option reflects a different management strategy for encryption keys. Understanding these can clarify why some options are defaults and others are not.
The answer
The correct option is D. Server-side encryption with service-managed keys (SSE-SMK). This method is the default encryption for Azure Blob Storage, where Azure manages the encryption keys on behalf of the user. This takes the burden of key management off the customer, making it a simple and secure option.
Why the other options lose
- A. Server-side encryption with platform-managed keys (SSE-PMK): This option is not recognized within Azure Blob Storage. Azure does not offer this as a valid encryption method, making it an incorrect choice.
- B. Client-side encryption with customer-managed keys (CSE-CMK): While this option allows for customer control over encryption keys, it is not the default method. It requires additional setup and management, which is not the case for the default encryption.
- C. Server-side encryption with customer-managed keys (SSE-CMK): This option involves using keys managed by the customer. Although it is a valid method, it is not the default. Candidates must remember that the default is service-managed keys, which simplifies management.
The concept behind it
The principle here revolves around the management of encryption keys. Azure Blob Storage defaults to using service-managed keys to simplify security for users. This allows Azure to handle key rotation and management, ensuring that data is encrypted without requiring additional user intervention. Understanding this principle can help you tackle similar questions regarding encryption management in Azure.
Exam trap to remember
Always remember: Azure Blob Storage defaults to server-side encryption with service-managed keys (SSE-SMK). This is the simplest and most secure option for users who want to ensure their data is encrypted at rest.