A regulator requires dedicated single-tenant HSM-backed cryptographic key custody, and general secret storage is handled separately. Which service should be evaluated?

Choose the single best answer.

A.Evaluate Azure Key Vault Managed HSM.
B.Use a certificate object in a shared vault and assume that object creates a dedicated HSM boundary.
C.Use Key Vault Standard and treat software-protected keys as the required dedicated HSM custody.
D.Use Key Vault Premium and assume its HSM tenancy is identical to dedicated Managed HSM.

Show the answer and explanation

✓ Correct answer

Evaluate Azure Key Vault Managed HSM.

Managed HSM is the dedicated single-tenant key service using documented FIPS 140-3 Level 3 validated HSMs. Premium vault HSM keys are a different offering and do not establish identical dedicated tenancy. Standard software keys and a certificate object do not supply the required dedicated HSM custody. Source: AZ-305 Study Guide.pdf, PDF page(s) 17.

Read the source reference

This item is flagged for content review.

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study aid; not affiliated with or endorsed by Microsoft. Original practice questions are not real examination questions and do not guarantee an exam result.