Applying customer-managed key encryption at the file level in Data Lake Storage

SC-100 By islever Editorial Last updated

Design solutions for securing an organization's data

Short answer

A Encryption scopes can be applied per blob/file, which is the most granular level supported for customer-managed keys.

Question

You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level. At which level should you recommend the encryption be applied?
  1. file Correct Answer
  2. container
  3. folder
  4. account

Key Takeaways

Encryption scopes support container- and blob-level (file-level) keys; file is more granular than container or account, so it is the most granular supported level for CMK.

To apply customer-managed keys with service-side encryption at the most granular level in Azure Data Lake Storage, use encryption scopes at the file (blob) level, since scopes can be set per container or per blob/file.

Common mistake: Choosing container (B) — while container-level scopes are common, the most granular level supported is the file (blob), so container is not the most granular.

Expert Analysis

Why the Answer Is Correct

Azure Storage service-side encryption with customer-managed keys can be scoped using encryption scopes, which are supported at the container level or at the individual blob (file) level. Because Data Lake Storage Gen2 stores files as blobs, the most granular level at which you can apply an individual customer-managed key is the file (blob).

Why the Other Options Are Wrong

A container (B) or account (D) scope is less granular than a file/blob scope, so they do not meet the 'most granular level' requirement. 'Folder' (C) is not a supported encryption-scope level in Azure Storage.

Community Comment Notes

The community was split (A 56 / B 44). The encryption-scope documentation confirms scopes can be set per blob/file, making file the most granular option; a minority argued container.

Official Reference

https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption

This link opens the official vendor documentation in a new tab.

Community Votes

A
56%
B
44%

56% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 7 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 7

  1. sweetykaur 👍 2 Answered A
    A. file level. By applying service-side encryption with customer-managed keys (CMKs) at the file level, you can ensure that each file can have its own unique encryption key, providing the highest level of granularity and security for your data
  2. Ali96 👍 2 Answered B
    For Azure Data Lake Storage, encryption can be applied at multiple levels, but the container level is the most granular supported for customer-managed keys (CMK).
  3. Er_01 👍 1 Answered A
    https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption It says you can scope it to container or individual blob. However a blob can contain files but it depends on if blob = file. If yes, then A, if no then B. Blobs generally contain files for various purposes but does this make it a file in this context. If A was blob, that is fair. This version is not fair and misleading.
  4. 424ede1 👍 1 Answered A
    You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files. A client making read write request against Blob Storage (or File) can include an encryption key on the request for granular control over blob encryption. https://docs.azure.cn/en-us/storage/common/storage-service-encryption#about-encryption-key-management
  5. Ali96 👍 1 Answered B
    container is the correct option since encryption keys are managed at this level and can be applied to all files within the container.
Show 2 more comments
  1. jim85 👍 1 Answered B
    B looks good, as per https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption
  2. 676ae1a 👍 1 Answered A
    Proporciona el nivel más granular de control sobre el cifrado de datos

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Using Microsoft Entra Permissions Management to find unused RBAC assignments

S-grade

Scenarios supported by compliant network check in Global Secure Access

S-grade

Removing the inbound firewall rule for an Entra application proxy connector

S-grade

Changing DNS MX records to route all inbound mail through Defender for Office 365

S-grade

Practice All SC-100 Questions

Access 110 questions with complete answers and detailed explanations.

View Full SC-100 Practice Test →

← Back to SC-100 Study Guide