A reviewer starts answering the grain-silo BYOK task by drafting Key Vault access-policy JSON, private-endpoint rules, and a rotation schedule. For Domain 3 storage encryption, what is the correct focus?
Select an answer to reveal the explanation.
Short Explanation
Domain 3 is the silo saying “use that key.” Domain 4 is running the Key Vault itself—networks, who can touch keys, rotation. Don’t rewrite the vault handbook when the ask is just pointing Storage at the CMK.
Full Explanation
Bring Your Own Key for Azure Storage is configured on the storage encryption experience: choose a customer-managed key URI and, when needed, encryption scopes for finer boundaries. Administering Key Vault networking, access policies versus RBAC, and rotation is Domain 4 Key Vault administration. Consuming the key from the storage resource is the Domain 3 skill under test.