Exam AZ-500 topic 5 question 45 discussion

"Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account." https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview Isn't automatically, logical solution BC

Seems outdated for a bit, 'cause now you can choose what services you want to protect with CMK during creation of storage account: it can be blobs and files only or all services.

B and C support customer-managed keys. Azure Table storage and Azure Queue storage do not support encryption with customer-managed keys. They are encrypted with service-managed keys by default.

Customer-managed key (CMK) support can be limited to blob service and file service only, or to all service types. After the storage account is created, this support cannot be changed.Learn more

ANSWERS R CORRECT FOR CMK: https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption

B. Azure Files C. Blob storage

the question should reference MMK not CMK. MMK, by default, only has BLOBS and FILES selected but CMK will automatically select all files types

The question is misleading. All services support data encryption with customer managed keys stored in a key vault.

BC is the answer. https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#customer-managed-keys-for-queues-and-tables Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account. Data in Blob storage and Azure Files is always protected by customer-managed keys when customer-managed keys are configured for the storage account.

AD, you need to read the question. Question says: "storage account is configured to use the CMK stored in the keyvault" so the question is about the additional services that can use the CMK, not the ones who are using it by default when configured. When using customer managed keys on a storage account, the CMK are automatically enabled for BLOB and FILE. You can then optionaly configure Queues and Tables. "Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account." https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#customer-managed-keys-for-queues-and-tables

AD, you need to read the question. When using customer managed keys on a storage account, the CMK are automatically enabled for BLOB and FILE. You can then optionaly configure Queues and Tables. "Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account." https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#customer-managed-keys-for-queues-and-tables

B. Azure Files C. Blob storage

outdated question

Correct, but outdated. Customer-managed key (CMK) support can be limited to blob service and file service only, or to ALL service types. After the storage account is created, this support cannot be changed.

Correct. Data in Blob storage and Azure Files is always protected by customer-managed keys when customer-managed keys are configured for the storage account. Data stored in Queue and Table storage isn't automatically protected by a customer-managed key when customer-managed keys are enabled for the storage account. You can optionally configure these services to be included in this protection at the time that you create the storage account.

Answers are correct..C and D, the provided link gives informative info regarding question.

Correct