Question

A financial services company must store scanned loan documents in Azure Blob Storage. A regulator requires that the data be protected with organization-controlled encryption keys AND that a second, independent layer of encryption be applied at the storage platform level so that a single cryptographic flaw cannot expose the data. The security architect must design the storage encryption to satisfy both requirements while keeping key rotation under the organization's control. Which approach should the architect recommend?

Accepted Answer

Enable customer-managed keys (CMK) with Azure Key Vault for the storage account and enable infrastructure encryption on the account at creation time.

Answer

Rely on the default Microsoft-managed keys for at-rest encryption and enforce HTTPS-only transfer to add a second encryption layer.

Answer

Enable customer-managed keys (CMK) with Azure Key Vault and configure a private endpoint on the storage account for the second layer.

Answer

Use client-side encryption in the application only, and disable Microsoft-managed encryption on the storage account.