Question

Your company's security policy requires that a general-purpose v2 storage account use encryption keys that your team controls and can rotate independently in Azure Key Vault, rather than keys managed by Microsoft. Which configuration should you enable on the storage account to meet this requirement?

Accepted Answer

Configure a customer-managed key (CMK) stored in an Azure Key Vault for the storage account's encryption

Answer

Enable infrastructure encryption to add a second layer of Microsoft-managed key encryption

Answer

Generate and rotate the storage account access keys on a defined schedule

Answer

Create a shared access signature (SAS) with a stored access policy for all client access