Applying customer-managed key encryption at the file level in Data Lake Storage

Design solutions for securing an organization's data
Answer Correct answer: A — Encryption scopes can be applied per blob/file, which is the most granular level supported for customer-managed keys.

You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level. At which level should you recommend the encryption be applied?

  1. file Correct Answer
  2. container
  3. folder
  4. account
azure storage encryption scope customer managed key file level data lake storage cmk granularity

Community Votes

A
56%
B
44%

56% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Encryption scopes support container- and blob-level (file-level) keys; file is more granular than container or account, so it is the most granular supported level for CMK.

To apply customer-managed keys with service-side encryption at the most granular level in Azure Data Lake Storage, use encryption scopes at the file (blob) level, since scopes can be set per container or per blob/file.

Choosing container (B) — while container-level scopes are common, the most granular level supported is the file (blob), so container is not the most granular.

Community Discussion (7 comments)

424ede1 👍 1 Selected: A
You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files. A client making read write request against Blob Storage (or File) can include an encryption key on the request for granular control over blob encryption. https://docs.azure.cn/en-us/storage/common/storage-service-encryption#about-encryption-key-management
Ali96 👍 2 Selected: B
For Azure Data Lake Storage, encryption can be applied at multiple levels, but the container level is the most granular supported for customer-managed keys (CMK).
Er_01 👍 1 Selected: A
https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption It says you can scope it to container or individual blob. However a blob can contain files but it depends on if blob = file. If yes, then A, if no then B. Blobs generally contain files for various purposes but does this make it a file in this context. If A was blob, that is fair. This version is not fair and misleading.
sweetykaur 👍 2 Selected: A
A. file level. By applying service-side encryption with customer-managed keys (CMKs) at the file level, you can ensure that each file can have its own unique encryption key, providing the highest level of granularity and security for your data
jim85 👍 1 Selected: B
B looks good, as per https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption
Ali96 👍 1 Selected: B
container is the correct option since encryption keys are managed at this level and can be applied to all files within the container.
676ae1a 👍 1 Selected: A
Proporciona el nivel más granular de control sobre el cifrado de datos

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Azure Storage service-side encryption with customer-managed keys can be scoped using encryption scopes, which are supported at the container level or at the individual blob (file) level. Because Data Lake Storage Gen2 stores files as blobs, the most granular level at which you can apply an individual customer-managed key is the file (blob).

Why the Other Options Are Wrong

A container (B) or account (D) scope is less granular than a file/blob scope, so they do not meet the 'most granular level' requirement. 'Folder' (C) is not a supported encryption-scope level in Azure Storage.

Community Comment Notes

The community was split (A 56 / B 44). The encryption-scope documentation confirms scopes can be set per blob/file, making file the most granular option; a minority argued container.

Official Reference

https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption

Related Analysis

You have a Microsoft Entra tenant named contoso.com. You hav

S-Grade

You have an Azure subscription that contains multiple Azure

A-Grade

You have multiple Azure subscriptions that each contains mul

S-Grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide