Q: 5
You are designing security for an Azure landing zone. Your company identifies the following
compliance and privacy requirements:
• Encrypt cardholder data by using encryption keys managed by the company.
• Encrypt insurance claim files by using encryption keys hosted on-premises.
Which two configurations meet the compliance and privacy requirements? Each correct answer
presents part of the solution. NOTE: Each correct selection is worth one point.
Options
Discussion
A and B tbh. Blob with customer-provided keys checks the on-prem key box for insurance, and Managed HSM for SQL DB fits company-managed keys for cardholder data. Not 100% but fits what I've seen in practice.
Nah, I don't think it's C. A and B match best since "hosted on-premises" rules out Azure-managed HSM here.
A/B? I saw a similar question on a practice test and the key thing was "on-premises" for the insurance claims, so A (with customer-provided keys) fits. For cardholder data, B makes sense since Managed HSM is still company-controlled. Can't be totally sure unless "on-premises" is super literal, but that's what I'd use here.
A , C
I’d go C here. Azure Key Vault Managed HSM is still company-managed, so option C should fit the insurance claim requirement. Not 100% sure if "hosted on-premises" always rules out Managed HSM but I think it works in most cases.
Sick of how picky these requirements are. A and B imo, since customer-provided keys for insurance means you keep keys on-prem, and Managed HSM for cardholder covers company-managed. Pretty sure that's what exam reports mention too.
A/B tbh. Official docs say customer-provided keys (A) let you keep the insurance claim keys on-prem, since Azure doesn't store them. For cardholder data, Managed HSM (B) gives the company full lifecycle control of keys, which ticks the compliance box for "company-managed." Seen similar in some practice exams. If you think "on-premises" rules out any Azure integration, I'd check MS documentation again-CPK is designed for this case.
A/B. Customer-provided keys for on-prem, Managed HSM for company-managed. Fits both requirements.
I don't think C fits since Managed HSM is Azure-side, not on-prem. So A and B.
Yeah, looks like A and B fit best. Blob storage with customer-provided keys lets you keep insurance file encryption keys on-prem, which matches that requirement. For cardholder data, Managed HSM is still company-controlled in Azure so B works. Pretty sure about this combo but let me know if something's off?
Be respectful. No spam.
