Microsoft Azure Administrator Associate AZ-104 Practice Question

Configure the storage account to use customer-managed keys that are stored in Azure Key Vault (or a Key Vault Managed HSM). Customer-managed keys let you control the entire key lifecycle-creation, rotation, and revocation-satisfying requirements for full ownership and auditability of the encryption keys. Microsoft-managed keys do not provide this level of control, while infrastructure encryption adds a second, Microsoft-managed layer of encryption but does not allow you to manage that key. Creating a shared access signature is used for regulating access to data, not for selecting the keys that encrypt it.