sc-500 Practice Question 2000
Exam: sc-500
Domain: Secure cloud apps and AI environments
Topic: Implement security controls for AI endpoints
Difficulty: medium
When implementing security controls for an Azure AI service, you want to ensure that the encryption keys used for data at rest are managed by your organization rather than by Azure. Which of the following actions should you take to achieve this?
Answer Options
A
Create a Private Endpoint for the AI service.
B
Enable Network Isolation for the AI service.
C
Enable encryption on the AI service.
D
Use Customer-Managed Keys (CMK) for the AI service.
Correct Answer
D: Use Customer-Managed Keys (CMK) for the AI service.
Explanation
Customer-Managed Keys (CMK) allow you to manage your own encryption keys for Azure services, providing more control over key management. Implementing a Private Endpoint or Network Isolation does not affect key management. Enabling encryption on the AI service itself does not change who manages the keys. Using a Virtual Network for isolation also does not manage encryption keys.