Microsoft Exam AZ-204 Topic 2 Question 89 Discussion

Actual exam question for Microsoft's AZ-204 exam

Question #: 89
Topic #: 2

You are developing a Java application to be deployed in Azure. The application stores sensitive data in Azure Cosmos DB. You need to configure Always Encrypted to encrypt the sensitive data inside the application. What should you do first?

ACreate a customer-managed key (CMK) and store the key in a new Azure Key Vault instance.

BCreate an Azure AD managed identity and assign the identity to a new Azure Key Vault instance.

CCreate a data encryption key (DEK) by using the Azure Cosmos DB SDK and store the key in Azure Cosmos DB.

DCreate a new container to include an encryption policy with the JSON properties to be encrypted.

Show Suggested Answer

Suggested Answer: C

by Paz at Mar 19, 2024, 04:21 AM

Limited Time Offer

25%

Off

Get Premium AZ-204 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Margurite

2 days ago

I think B makes more sense for identity management.

upvoted 0 times

...

Leontine

8 days ago

A is definitely the first step!

upvoted 0 times

...

Paz

14 days ago

I feel like creating a new container with an encryption policy could be part of the process, but I don't think it's the very first step.

upvoted 0 times

...

Galen

19 days ago

I practiced a similar question where we had to create a data encryption key using the SDK, so maybe that's the right answer here?

upvoted 0 times

...

Della

25 days ago

I remember something about using Azure AD managed identities, but I can't recall if that's the first thing we should do for Always Encrypted.

upvoted 0 times

...

Allene

1 month ago

I think the first step might be to create a customer-managed key and store it in Azure Key Vault, but I'm not entirely sure.

upvoted 0 times

...

Samira

1 month ago

Hmm, I'm leaning towards option A. Storing the encryption key in a new Key Vault instance seems like the logical first step before configuring the encryption policy in Cosmos DB. But I'll review the other options just to be sure.

upvoted 0 times

...

Mel

1 month ago

Creating an Azure AD managed identity and assigning it to a new Key Vault seems like a good approach, but I'm not sure if that's the first step. Let me re-read the question carefully.

upvoted 0 times

...

Kate

1 month ago

I'm a bit confused on the difference between a customer-managed key and a data encryption key. I'll need to double-check the details on those before I can decide.

upvoted 0 times

...

Svetlana

1 month ago

Okay, I think I know the answer here. The first step is to create a customer-managed key (CMK) and store it in a new Azure Key Vault instance. That's option A, right?

upvoted 0 times

...

Nakita

1 month ago

This looks like a tricky question about configuring encryption for sensitive data in Azure Cosmos DB. I'll need to carefully review the options and think through the steps.

upvoted 0 times

...

Claribel

1 month ago

Okay, let me see. If the backups are kept in the same place as the servers, that could mean unauthorized people have access to both, which would be a major security risk. I think that's the key thing to focus on.

upvoted 0 times

...

Marvel

1 month ago

Hmm, I'm a bit unsure about this one. I know we need to have certain information prepared for first-aid, but I can't quite remember if it's the home address or the emergency rescue address and map. I'll have to think this through carefully.

upvoted 0 times

...

Patria

1 month ago

This looks like a tricky question. I'll need to carefully consider the steps to ensure a smooth transition for third-party developers and end users.

upvoted 0 times

...

Kerry

1 year ago

That's an interesting point. Storing the key in Cosmos DB might be more efficient for our scenario.

upvoted 0 times

...

Mozell

1 year ago

I think creating a data encryption key using the Cosmos DB SDK is the way to go. It's more closely tied to the application.

upvoted 0 times

...

Elouise

1 year ago

But wouldn't creating a customer-managed key give us more control over the encryption process?

upvoted 0 times

...

Kerry

2 years ago

I disagree. I believe we should create an Azure AD managed identity and assign it to a new Key Vault instance.

upvoted 0 times

...

Elouise

2 years ago

I think we should create a customer-managed key in a new Azure Key Vault.

upvoted 0 times

...

Eulah

2 years ago

Haha, good one, Candidate 5. But seriously, I think the correct answer here is to create a new container with an encryption policy that includes the JSON properties we want to encrypt. That way, we get the benefits of Always Encrypted without having to worry about managing the keys ourselves.

upvoted 0 times

...