A regulator wants two independent encryption layers under Microsoft’s storage infrastructure for the lock-photo account, not only the default SSE with a platform-managed or customer-managed key. Which control meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
SSE is one lock on the data at rest. Infrastructure encryption adds a second lock inside Microsoft’s storage stack—two layers, not “TLS counts as the other layer.”
Full Explanation
Infrastructure encryption (double encryption at rest) adds a second AES-256 layer at the storage infrastructure level beneath the account’s SSE layer (Microsoft-managed or customer-managed). Enabling it on the storage account is the control that satisfies a requirement for two independent at-rest encryption layers for canal telemetry blobs—not transit protections and not VM disk features. Azure Disk Encryption protects OS and data disks on virtual machines; blobs in a storage account do not inherit ADE from a nearby VM. Requiring TLS 1.2 encrypts data in transit between clients and the endpoint; it is mandatory hygiene but it is not a second at-rest layer. Soft delete retains deleted objects for recovery; it does not encrypt them twice. Exam caveat: infrastructure encryption is chosen for defense-in-depth and certain compliance narratives; it is not a substitute for CMK, private endpoints, or RBAC, and it has creation-time constraints on many account types. Operational check: verify the account property shows infrastructure encryption enabled, confirm new writes succeed, and document whether existing data required migration to an account created with the setting—then re-test read access for the telemetry pipelines that depend on the silo.