You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and…

The correct answer is B. container. In Azure Data Lake Storage Gen2 (and Azure Blob Storage), the most granular level at which customer-managed keys (CMKs) can be applied via service-side encryption is the container level, using encryption scopes. Encryption scopes allow you to assign a different CMK to each…

Design security solutions for applications and data

Question

You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level. At which level should you recommend the encryption be applied?

Options

Afile
Bcontainer
Cfolder
Daccount

How the community answered

(64 responses)

A
8% (5)
B
88% (56)
C
3% (2)
D
2% (1)

Explanation

In Azure Data Lake Storage Gen2 (and Azure Blob Storage), the most granular level at which customer-managed keys (CMKs) can be applied via service-side encryption is the container level, using encryption scopes. Encryption scopes allow you to assign a different CMK to each container within the same storage account, providing per-container key isolation. This is more granular than account-level (D), which applies one key to all data. File-level (A) and folder-level (C) encryption with separate CMKs are not supported natively by the service-side encryption model in Azure Storage - individual files and folders do not have their own encryption scope assignment. Container-level scopes represent the most granular supported boundary.

Topics

#Azure Data Lake Storage#Customer-Managed Keys (CMK)#Data Encryption#Encryption Granularity

Community Discussion

No community discussion yet for this question.

Full SC-100 Practice