Design solutions for securing an organization's data

Montrose Defense Systems stores controlled technical data in an existing Azure Storage account named stmontrosearchive that uses customer-managed keys from Azure Key Vault. A new government contract requires that data at rest be protected by two independent layers of encryption with separate keys and algorithms at the storage service level, so that a compromise of one key or algorithm does not expose the data. The company must also keep enforcing TLS 1.2 or later for data in transit.

What should you recommend?

1. AEnable infrastructure encryption on stmontrosearchive and keep the existing customer-managed keyInfrastructure encryption can only be enabled when a storage account is created; it cannot be turned on for an existing account.
2. BCreate a new storage account with infrastructure encryption enabled and customer-managed keys, set the minimum TLS version to 1.2, and migrate the data from stmontrosearchiveInfrastructure encryption adds a second, independent 256-bit AES layer with platform-managed keys beneath the customer-managed key layer; because it is a creation-time setting, a new account and data migration are required, and the minimum TLS setting covers data in transit.
3. CRotate the customer-managed key in Key Vault and enable Azure Disk Encryption for the storage accountRotating a key does not add a second encryption layer, and Azure Disk Encryption applies to virtual machine disks, not to Azure Storage accounts.
4. DMove the customer-managed key to Azure Key Vault Managed HSMManaged HSM strengthens protection of the single key but still results in one layer of encryption; it does not satisfy the two-independent-layers requirement.

Orrin Labs is designing an Azure Synapse Analytics workspace named syn-orrin-prod with a dedicated SQL pool and Apache Spark pools that will process clinical trial data held in an Azure Data Lake Storage Gen2 account named dlorrinprod. Security requirements state that Spark jobs and pipelines may send data only to dlorrinprod and to an approved Azure Key Vault, never to storage in another Microsoft Entra tenant or to the public internet; that analysts must reach Synapse Studio and the SQL endpoints only from the corporate virtual network with public network access to the workspace disabled; and that the SQL pools must accept Microsoft Entra authentication only, with SQL authentication disabled. The workspace has not been created yet.

What should you recommend?

1. ACreate the workspace with a managed virtual network and data exfiltration protection enabled, approve only the company Microsoft Entra tenant, create managed private endpoints to dlorrinprod and the key vault, disable public network access and expose the Dev, SQL, and SqlOnDemand endpoints through private endpoints in the corporate virtual network, and enable Microsoft Entra-only authentication for the workspaceA managed virtual network isolates the Spark pools and pipelines, data exfiltration protection restricts their egress to managed private endpoints in approved tenants, private endpoints with public access disabled satisfy the inbound requirement, and Microsoft Entra-only authentication disables SQL logins. Because the managed virtual network and data exfiltration protection cannot be changed after creation, they must be specified at design time.
2. BCreate the workspace without a managed virtual network, deploy the Spark pools into a delegated subnet of the corporate virtual network, and apply a network security group to that subnet that denies outbound internet trafficSynapse Spark pools cannot be deployed into a customer virtual network; without a managed virtual network they run in a shared network with internet egress, and there is no customer subnet or network security group to control them.
3. CCreate the workspace with default networking, add workspace IP firewall rules that allow only the corporate public IP ranges, and enable the managed virtual network and data exfiltration protection after the pipelines have been testedThe managed virtual network and data exfiltration protection are creation-time settings that cannot be enabled on an existing workspace, and IP firewall rules still expose the workspace through its public endpoints rather than disabling public access.
4. DCreate the workspace with a managed virtual network but without data exfiltration protection, route Spark egress through Azure Firewall in the hub virtual network, and set a Microsoft Entra administrator while keeping SQL authentication enabled for break-glass accessTraffic from the managed virtual network does not traverse the customer hub network, so Azure Firewall cannot filter it, and without data exfiltration protection Spark can write to any public endpoint; keeping SQL authentication enabled also violates the Microsoft Entra-only requirement.

Evergate Capital is building an internal assistant on Azure OpenAI in Azure AI Foundry that uses retrieval-augmented generation over an Azure AI Search index populated from department document libraries. HR, Finance, and Legal documents are indexed together. Compliance requires that a user can receive answers only from documents that the user is permitted to read in the source library, enforced at retrieval time, and that the application itself uses no stored keys to reach Azure AI Search or Azure OpenAI.

What should you recommend?

1. AGrant the application's managed identity the Search Index Data Reader role and the Cognitive Services OpenAI User role, and store the permitted group identifiers for each document in a filterable index field that the application applies as a security filter using the signed-in user's group membership at query timeSecurity trimming in Azure AI Search is implemented by storing access-control identifiers with each document and filtering queries by the caller's groups, so retrieval returns only permitted documents; managed identity with least-privilege roles removes stored keys.
2. BGive every user the Search Index Data Reader role on the index and let Azure AI Search enforce their individual permissions automaticallyAn RBAC role on the index grants read access to the whole index; it does not restrict which documents a user receives based on source library permissions.
3. CEnable Azure AI Content Safety Prompt Shields on the deployment to block requests for documents the user should not seePrompt Shields detects jailbreak and indirect prompt injection attempts in prompts and documents; it has no knowledge of document permissions and cannot perform authorization.
4. DCreate three separate indexes for HR, Finance, and Legal and store the Azure AI Search admin key for each index in Azure Key VaultSeparate indexes still do not enforce per-user permissions within a department, and an admin key is a stored key with full control, which violates the no-keys requirement and least privilege.

Dunmore Clinical Research receives trial data files from partner laboratories into a blob container named incoming in a storage account named stdunmoretrials. Partners currently use a service shared access signature that an engineer generates with the storage account key and emails to them, valid for one year. A HIPAA review requires that no long-lived shared secrets grant access to the storage account, that partner access is time-limited and tied to an identity, and that compromised credentials can be revoked immediately.

Which two actions should you recommend? Each correct answer presents part of the solution.

1. ADisable Shared Key authorization on stdunmoretrials so that only Microsoft Entra ID authorization is acceptedDisabling Shared Key authorization removes the account keys and any key-signed service SAS as an access path, forcing all access through Microsoft Entra identities.
2. BIssue short-lived user delegation SAS tokens for the incoming container, signed with Microsoft Entra credentials, from an automated process that uses a managed identityA user delegation SAS is secured with Microsoft Entra credentials rather than the account key, can be scoped to the container with a short expiry, and can be revoked by revoking the delegation key or the identity's permissions.
3. CContinue issuing service SAS tokens but attach them to a stored access policy so they can be revokedA service SAS is still signed with the account key, so it depends on Shared Key authorization, which the review requires to be eliminated.
4. DRotate the storage account keys every 90 days by using Azure Key Vault managed storage account keysRotation shortens the exposure window but keeps shared keys as the access mechanism, which still violates the requirement that no long-lived shared secret grants access.
5. EEnable anonymous read access on the incoming container so partners do not need credentialsAnonymous access exposes protected health information to anyone with the URL and is the opposite of the required control.