Cascade Regional Airlines' security team wants blobs newly uploaded to a maintenance-records container to be encrypted using a customer-managed key from the moment they are written, without requiring any application code changes on the upload path? Which statement about this requirement is accurate?
Select an answer to reveal the explanation.
Short Explanation
Encryption at rest with customer-managed keys is a storage-account-level setting, not something each upload request has to ask for. Flip it on once at the account, point it at the right Key Vault key, and every blob written from that point forward is protected transparently — the upload code never even knows the difference.
Full Explanation
Encryption at rest, whether using Microsoft-managed or customer-managed keys, is enforced transparently by the Azure Storage service itself at the account level: once customer-managed keys are configured, pointing the account at a specific Key Vault key, all subsequent writes are encrypted with that key automatically, and no application or upload-path code changes are required because encryption and decryption happen server-side and are invisible to clients. The claim that keys must be specified per-blob via a special request header is false — encryption configuration is an account (or, for finer control, an encryption-scope) property, not a per-request parameter that uploading applications must set. The claim that an account cannot move from Microsoft-managed to customer-managed keys is also false; Azure Storage explicitly supports switching the key source after account creation through the account's encryption settings, though existing data is not necessarily re-encrypted immediately — the switch governs the key used going forward, and Azure re-wraps the encryption keys accordingly. The idea that the uploading application must manually decrypt and re-encrypt blobs contradicts how transparent server-side encryption works entirely; requiring client-side crypto would defeat the purpose of a managed encryption-at-rest feature. A concrete operational check: after switching to customer-managed keys, verify the account's encryption blade reports 'Encryption type: Customer-managed keys' and confirm the Key Vault key's access policy grants the storage account's managed identity wrap/unwrap permissions, since a missing permission would cause writes to fail rather than silently fall back.