Microsoft Azure Administrator Associate AZ-104 Practice Question

To have control over the encryption keys used for data at rest in Azure Storage, you need to use customer-managed keys stored in Azure Key Vault. This allows the organization to manage the encryption keys, including key rotation and revocation, providing greater control over data security. Using Microsoft-managed keys does not provide this level of control, as the keys are managed by Azure. Disabling storage encryption is not advisable and would not meet the security requirements. Implementing Advanced Threat Protection enhances security but does not affect encryption key management.