Get Your CertAZ-104PlayCompete
‹ All AZ-104 questions

AZ-104 Practice Question 84: CMK Purge Protection

Microsoft Azure Administrator Associate (AZ-104) · Test 9 · question 4 of 10

Storagemedium

A company wants to encrypt a storage account with a customer-managed key kept in Azure Key Vault. Selecting the key from an existing vault fails with an error that says the vault does not meet the requirements.

What should the administrator enable on the key vault?

Select one answer
Show answer and explanation

Answer:

  • C. Purge protection, together with soft delete

Encrypting with a customer-managed key requires that soft delete and purge protection are both enabled on the key vault, so that a deleted key cannot be permanently removed while data still depends on it. Soft delete is on by default for new vaults, so purge protection is usually the missing setting.

Option A is not a requirement; a key vault firewall can stay restricted if trusted services are allowed.

Option B is wrong because Standard vaults hold software-protected keys, which is enough for this scenario.

Option D is wrong because encryption keys must be keys, not secrets.

Reference: Customer-managed keys for Azure Storage encryption

Practice Test 9 ›

Study guides for AZ-104

Azure Administrator (AZ-104): jobs, salary and the examAzure administrator role, jobs and pay data, and the AZ-104 exam: five domains, 100 minutes, US$165 / ₹4,865, AZ-900 first or not, and what next.
AZ-400 exam guide: DevOps Engineer Expert in 2026AZ-400 exam guide: the DevOps Engineer Expert prerequisites now that AZ-204 is retired, the five skill areas, price, renewal and a study plan.
Azure certification path 2026: AZ-900, AZ-104, AZ-305The Azure certification path for 2026 - AZ-900, AZ-104 and AZ-305 in order, what each covers, the AZ-305 prerequisite, renewal and what to skip.
Azure RBAC vs Azure Policy vs Entra roles vs resource locksHow Azure RBAC, Azure Policy, Microsoft Entra roles and resource locks differ, how scope inheritance works, and when deny beats audit.
Azure Storage redundancy - LRS, ZRS, GRS, GZRS and failoverHow LRS, ZRS, GRS, RA-GRS, GZRS and RA-GZRS differ, what failover does to your account, and how access tiers interact with redundancy.