A contractor tries to turn on infrastructure encryption for an existing grain-silo storage account that was created without it. What should you tell them?
Select an answer to reveal the explanation.
Short Explanation
This one’s a factory option, not a bolt-on kit. If the silo account was built without infrastructure encryption, you stand up a new account with it on and move the grain—not flip a hidden switch later.
Full Explanation
Infrastructure encryption must be enabled when the storage account is created and cannot be enabled afterward on that same account. Meeting a double-encryption mandate for an existing account typically means creating a new account with infrastructure encryption and migrating data. It is not universally on by default for every account, and configuring a CMK does not retroactively enable infrastructure encryption.