Hotspot Question You have an Azure subscription. You plan to deploy a new storage account. You need to configure encryption for the account. The solution must meet the following requirements: - Use a

The correct answer is Key:: RSA; Bit length:: 4096. To configure customer-managed keys for Azure storage encryption, an RSA key stored in Azure Key Vault with the maximum supported bit length of 4096 must be selected.

Submitted by takeshi77· Mar 4, 2026Implement and manage storage

Question

Hotspot Question You have an Azure subscription. You plan to deploy a new storage account. You need to configure encryption for the account. The solution must meet the following requirements: - Use a customer-managed key stored in a key vault. - Use the maximum supported bit length. Which type of key and which bit length should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Answer:

Exhibit

Answer Area

Key:RSA
AES3DESRSA
Bit length:4096
2048307240968192

Explanation

To configure customer-managed keys for Azure storage encryption, an RSA key stored in Azure Key Vault with the maximum supported bit length of 4096 must be selected.

Approach. The question requires configuring encryption for an Azure storage account using a customer-managed key (CMK) stored in a key vault, with the maximum supported bit length. When using CMK for Azure Storage, the keys are stored in Azure Key Vault and function as Key Encryption Keys (KEK) to wrap the data encryption keys (DEKs). Azure Key Vault supports RSA keys for this purpose. Among the provided options, 'RSA' is the correct key type for a customer-managed key. For RSA keys in Azure Key Vault, the currently supported bit lengths are 2048, 3072, and 4096. The requirement for the 'maximum supported bit length' makes '4096' the correct choice. Therefore, selecting 'RSA' for the Key and '4096' for the Bit length fulfills all specified requirements.

Common mistakes.

common_mistake. A common mistake is selecting 'AES' or '3DES' as the key type. While Azure Storage data at rest is encrypted using AES-256, the customer-managed key stored in Key Vault acts as an asymmetric KEK (Key Encryption Key) to protect the DEKs, for which RSA is the appropriate standard. Another mistake would be choosing '8192' for the bit length; although it's the largest number presented, Azure Key Vault currently supports a maximum of 4096 bits for RSA keys. Selecting '2048' or '3072' would not meet the requirement for the 'maximum supported bit length'.

Concept tested. Azure Storage encryption with Customer-Managed Keys (CMK), the role of Azure Key Vault for key storage, supported key types (RSA), and the maximum supported bit lengths for RSA keys in Azure Key Vault.

Topics

#Storage account encryption#Customer-managed keys (CMK)#Azure Key Vault#Encryption key bit lengths

Community Discussion

No community discussion yet for this question.

Full AZ-104 Practice