You have an on-premises network and an Azure subscription. You plan to migrate on-premises SAP workloads to Azure virtual machines. You will use an NFS account in Azure NetApp Files as the storage…

Question

Options

• Aa user-assigned managed identity in the Azure subscription
• Ban Active Directory connection for the NFS account
• Can Azure key vault in the Azure subscription
• Da system-assigned managed identity in the NFS account

• A
  11% (5)
• B
  2% (1)
• C
  80% (35)
• D
  7% (3)

Explanation

Use an Azure key vault to store the customer-managed encryption keys needed for the encryption of files during the transfer. Note: Security FAQs for Azure NetApp Files Can the network traffic between the Azure VM and the storage be encrypted? Azure NetApp Files data traffic is inherently secure by design, as it doesn't provide a public endpoint, and data traffic stays within customer-owned VNet. Data-in-flight isn't encrypted by default. However, data traffic from an Azure VM (running an NFS or SMB client) to Azure NetApp Files is as secure as any other Azure-VM-to-VM traffic. NFSv3 protocol doesn't provide support for encryption, so this data-in-flight can't be encrypted. However, NFSv4.1 and SMB3 data-in-flight encryption can optionally be enabled. Data traffic between NFSv4.1 clients and Azure NetApp Files volumes can be encrypted using Kerberos with AES-256 encryption. How are encryption keys managed? By default key management for Azure NetApp Files is handled by the service, using platform- managed keys. A unique XTS-AES-256 data encryption key is generated for each volume. An encryption key hierarchy is used to encrypt and protect all volume keys. These encryption keys are never displayed or reported in an unencrypted format. When you delete a volume, Azure NetApp Files immediately deletes the volume's encryption keys. *-> Alternatively, customer-managed keys for Azure NetApp Files volume encryption can be used where keys are stored in Azure Key Vault. With customer-managed keys, you can fully manage the relationship between a key's life cycle, key usage permissions, and auditing operations on The feature is generally available (GA) in supported regions. Azure NetApp Files volume encryption with customer-managed keys with the managed Hardware Security Module is an extension to this feature, allowing you to store your encryption keys in a more secure FIPS 140-2 Level 3 HSM instead of the FIPS 140-2 Level 1 or Level 2 service used by Azure Key Vault.

No community discussion yet for this question.