Get Your CertAI-300PlayCompete
‹ All AI-300 questions

AI-300 Practice Question 96: CMK Key Vault Requirements

Microsoft Machine Learning Operations Engineer Associate (AI-300) · Test 10 · question 6 of 10

Design and implement a GenAIOps infrastructuremedium

Company policy requires the data of a Foundry resource to be encrypted with a customer-managed key. Which requirement applies to the key store that holds the key?

Select one answer
Show answer and explanation

Answer:

  • D. Soft delete and purge protection must be on, in the same region

To encrypt a Foundry resource with a customer-managed key, the key store (Azure Key Vault or Managed HSM) must be in the same Azure region as the resource. Azure also requires soft delete and purge protection to be enabled, to protect the key from accidental or malicious deletion (option D).

- A is wrong because the key store and the Foundry resource must be deployed in the same Azure region. - B is wrong because Key Vault is supported, and a Managed HSM is also an option, so it is not the only choice. - C is wrong because there is no requirement to avoid rotation, and this is not among the requirements for the key store.

Reference: Customer-managed keys for Foundry

Practice Test 10 ›

Study guides for AI-300

AI-200 exam guide: Azure AI Cloud Developer AssociateAI-200 replaced AZ-204: what the Azure AI Cloud Developer exam tests, how it differs from AI-103, price in USD and INR, format and how to prepare.
How AI Is Changing Software Jobs: Where to PrepareHow AI is changing software jobs: what history shows, the evidence on junior developers, what Klarna learned, new AI roles and five domains to prepare for.
Best MLOps certifications 2026: which test real MLOpsThe best MLOps certifications in 2026 from Microsoft, Databricks, Google and AWS, ranked by how much each exam tests MLOps, with cost and order.
Best AI certifications 2026: AWS, Google, Microsoft, ClaudeThe best AI certifications in 2026 from AWS, Google, Microsoft, Claude and Databricks, by level, with price, status and which one to take first.
Microsoft AI certification path 2026: which exam firstMicrosoft AI certification path for 2026 - AI-901, AB-730, AI-103, AI-200, AI-300, AB-100, AI-500 and GH-300 by role, and which exam to take first.
What Is RAG? How Retrieval-Augmented Generation WorksWhat RAG is and how it works: chunking, embeddings, vector search, hybrid search, reranking, GraphRAG and agentic RAG on AWS, Google and Azure.