Question

A financial services company stores sensitive transaction records in Azure Cosmos DB. Compliance requires that the organization retains full control of the encryption keys, that keys can be revoked to render data inaccessible on demand, and that key material is protected by a FIPS 140-2 Level 3 validated hardware boundary. The security architect must design the encryption approach. Which solution meets all requirements?

Accepted Answer

Configure customer-managed keys (CMK) for the Cosmos DB account backed by an Azure Key Vault Managed HSM.

Answer

Rely on the default Microsoft-managed service-side encryption at rest that Cosmos DB provides automatically.

Answer

Enable Always Encrypted with randomized encryption on all sensitive columns using a local certificate store.

Answer

Apply a Purview sensitivity label with encryption to the transaction records before ingestion into Cosmos DB.