An existing account lacks account-level infrastructure encryption. The requirement can be limited to future data under a newly created encryption scope. Which option is documented?

Choose the single best answer.

A.Change the infrastructure setting on an already created scope
B.Change service-level encryption from Microsoft-managed to customer-managed keys and assume this adds the infrastructure layer
C.Enable secure transfer and assume it adds the required at-rest layer
D.Creating an encryption scope with infrastructure encryption enabled at scope creation

Show the answer and explanation

✓ Correct answer

Creating an encryption scope with infrastructure encryption enabled at scope creation

The documentation supports selecting infrastructure encryption for a new scope when account-level infrastructure encryption is absent. Customer-managed service keys change key ownership rather than adding the layer, an existing scope setting is fixed, and secure transfer protects transport rather than adding at-rest encryption.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.