CloudGuild · Blog · Cheat sheets · Lessons · Certifications
AZ-500 Exam Question Walkthrough: Encrypting Sensitive Information in Azure Files
Explore a key AZ-500 exam question on encrypting sensitive information in Azure Files and discover strategies for success.
Migrating to Azure presents unique challenges, especially around data security. Candidates often trip on encryption methods, unsure which approach meets requirements for sensitive data stored in Azure Files.
The question
An organization is migrating to Azure and needs to encrypt all sensitive information stored in Azure Files. What is the recommended method to ensure that the data is securely encrypted?
- A. Use storage account encryption with Microsoft-managed keys.
- B. Encrypt files on the client side before uploading.
- C. Set up a firewall for the storage account.
- D. Use Azure VPN to encrypt data in transit.
Think before you scroll
Consider the context of data storage and encryption. The question focuses on securing sensitive data at rest, not just in transit or through access controls. Weigh the options carefully against the requirements for encryption.
The answer
The correct answer is A. Use storage account encryption with Microsoft-managed keys. This method ensures that data at rest is automatically encrypted, fulfilling the requirement for securing sensitive information in Azure Files.
Why the other options lose
- B. Encrypt files on the client side before uploading. While client-side encryption adds security, it is not the recommended method for Azure Files according to the exam's context. The question asks for a method that ensures automatic encryption at rest, which option A does.
- C. Set up a firewall for the storage account. Firewalls help control access to the storage account but do not encrypt data at rest. This option does not address the primary concern of encrypting sensitive information.
- D. Use Azure VPN to encrypt data in transit. This option focuses on protecting data while it travels, not while it is stored. The question specifically asks about encryption for data at rest, making this option irrelevant.
The concept behind it
The underlying principle here is that encryption methods must align with the data's state—either at rest or in transit. For sensitive data stored in Azure, using built-in storage account encryption is the recommended approach. It ensures compliance and security without the need for additional steps by users.
Exam trap to remember
Remember: Data at rest requires specific encryption methods like storage account encryption, while data in transit involves different security measures.