A security engineer is deploying an Azure OpenAI service for a healthcare application that processes PHI. The requirement mandates that the service must not use Microsoft-managed keys and all model data must be encrypted with customer-managed keys. What must be configured?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to configure Azure OpenAI Customer-Managed Keys using Azure Key Vault with Bring Your Own Key. That puts encryption under your control instead of Microsoft-managed keys, including model data and fine-tuning data.
Full Explanation
Configure Azure OpenAI Customer-Managed Keys using Azure Key Vault with Bring Your Own Key. Azure OpenAI supports Customer-Managed Keys where customers provide their own keys via Azure Key Vault, also called Bring Your Own Key. This ensures that data stored and processed by the Azure OpenAI service, including model fine-tuning data, is encrypted with customer-controlled keys rather than Microsoft-managed keys. The system-assigned managed identity option with Blob Storage Customer-Managed Keys is incorrect because it addresses storage encryption but does not configure Customer-Managed Keys for the Azure OpenAI service itself. The private endpoint with TLS 1.3 option is incorrect because private endpoints provide network isolation but do not change the key management model for encryption. The Azure Disk Encryption option is incorrect because Azure Disk Encryption is for infrastructure-as-a-service virtual machines and is not applicable to platform-as-a-service services like Azure OpenAI.