Get Your CertAI-103PlayCompete
‹ All AI-103 questions

AI-103 Practice Question 63: Customer Managed Key Prerequisites

Microsoft Azure AI Apps and Agents Developer Associate (AI-103) · Test 7 · question 3 of 10

Plan and manage an Azure AI solutionmedium

A hospital network's compliance team requires that it be able to revoke the encryption key for its Foundry resource's data at rest at any time, cutting off access immediately. An engineer enables the system-assigned managed identity on the Foundry resource, creates a key in an Azure Key Vault in a different region for cost-tracking reasons, and switches the resource's encryption type to Customer-Managed Keys. The operation fails.

What is the most likely cause?

Select one answer
Show answer and explanation

Answer:

  • B. The key vault must be in the same Azure region as the Foundry resource, and it must have soft delete and purge protection enabled

Microsoft's prerequisites for configuring CMK are explicit: "Deploy the key store and the Foundry resource in the same Azure region," and "Enable soft delete and purge protection on the key store ... (required by Azure)." A key vault in a different region, chosen here for cost tracking, fails that requirement and blocks the encryption switch, independent of any identity or permission setup.

- A is wrong because both identity types are supported. A system-assigned identity works fine; it just doesn't exist until the resource is created, which changes the *order* of steps (grant access after creation) but isn't a supported/unsupported distinction. - C is wrong because the documented minimum is a 2048-bit RSA key, not 4096-bit, and key size isn't the failure implied by the scenario. - D is wrong because CMK can be enabled on an existing resource; the portal path is Resource Management > Encryption, select Customer-Managed Keys, and supply the key store URL and key name. Creation-time-only would make CMK impossible to adopt after the fact, which contradicts the documented update flow.

Reference: Configure Customer-Managed Keys for Microsoft Foundry

Practice Test 7 ›

Study guides for AI-103

AI engineer roadmap 2026: skills, certs and the orderAI engineer roadmap for 2026: skills to learn in order, AI engineer vs ML engineer, which certifications fit each stage, and what to skip.
AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
AI-901 exam guide: Azure AI Fundamentals after AI-900AI-901 replaced AI-900: learn what changed, how much Python and Microsoft Foundry you need, exam costs in India, and how to prepare.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.
AI-103 Certification Guide: What Changed From AI-102The AI-103 certification replaced AI-102 in 2026. Exam format, cost, the five skill domains, what changed and how to prepare, with free practice questions.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.
Prompt engineering vs RAG vs fine-tuningWhen to use prompt engineering, retrieval-augmented generation, fine-tuning or continued pre-training, compared on cost, freshness, hallucination and privacy.