A security engineer is deploying an Azure OpenAI service for a healthcare application that processes PHI. The requirement mandates that the service must not use Microsoft-managed keys and all model data must be encrypted with customer-managed keys. What must be configured?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Azure OpenAI supports Customer-Managed Keys (CMK) where customers provide their own keys via Azure Key Vault (Bring Your Own Key). This ensures that data stored and processed by the Azure OpenAI service, including model fine-tuning data, is encrypted with customer-controlled keys rather than Microsoft-managed keys.
Full explanation below image
Full Explanation
B is correct because Azure OpenAI supports Customer-Managed Keys (CMK) where customers provide their own keys via Azure Key Vault (Bring Your Own Key). This ensures that data stored and processed by the Azure OpenAI service, including model fine-tuning data, is encrypted with customer-controlled keys rather than Microsoft-managed keys. A is incorrect because storing outputs in Blob Storage with CMK addresses storage encryption but does not configure CMK for the Azure OpenAI service itself. C is incorrect because private endpoints provide network isolation but do not change the key management model for encryption. D is incorrect because Azure Disk Encryption is for IaaS VMs and is not applicable to PaaS services like Azure OpenAI.