AZ-305 Practice Test 3

A bank is designing key management for customer-managed encryption keys used by Azure SQL Database and Azure Storage. The security architecture board sets these requirements:

- The keys must live in HSMs dedicated to this bank alone, cryptographically isolated from any other Azure customer. - Administration of the key store must be delegated to the bank's crypto officers, and neither a subscription Owner nor a management group administrator may be able to override their access decisions. - Keys generated inside the bank's own on-premises HSMs must be importable. - Applications must reach the key store from a virtual network over a private IP address.

Which service should the design use?