AZ-305 Practice Question 21: Key Management Isolation
Microsoft Azure Solutions Architect Expert (AZ-305) · Test 3 · question 1 of 10
A bank is designing key management for customer-managed encryption keys used by Azure SQL Database and Azure Storage. The security architecture board sets these requirements:
- The keys must live in HSMs dedicated to this bank alone, cryptographically isolated from any other Azure customer. - Administration of the key store must be delegated to the bank's crypto officers, and neither a subscription Owner nor a management group administrator may be able to override their access decisions. - Keys generated inside the bank's own on-premises HSMs must be importable. - Applications must reach the key store from a virtual network over a private IP address.
Which service should the design use?
Show answer and explanation
Answer:
Managed HSM is a fully managed, highly available, single-tenant service: each instance is dedicated to one customer and uses a separate customer-specific security domain that cryptographically isolates that customer's HSM cluster. Its local RBAC model lets designated HSM cluster administrators have complete control over the HSMs, control that, as Microsoft states explicitly, management group, subscription, or resource group administrators cannot override. That sentence is the discriminating requirement here. Managed HSM also supports importing keys generated in an on-premises HSM (BYOK) and supports private endpoints for connectivity from a virtual network.
Option A fails the first requirement outright. Standard-tier vaults protect keys in software, with no HSM boundary at all, and neither soft delete nor purge protection has anything to do with tenant isolation; they protect against deletion.
Options B and C both land on the same wrong service for the same reason. Key Vault Premium does store keys in validated HSMs, but a vault is a *multitenant* service: the HSM backing it is shared, there is no customer-specific security domain, and its access model is ordinary Azure RBAC, so a subscription Owner can always grant themselves rights over the vault. Isolating the vault in a separate subscription and locking it, as option C proposes, narrows who is likely to do that without removing the ability; the requirement is that it be impossible, not unlikely.
Reference: Azure Key Vault Managed HSM overview