Microsoft Azure Administrator Associate AZ-104 Practice Question

To have full control over the encryption keys used for your Azure Storage account, you should configure the account to use customer-managed keys in Azure Key Vault. This allows you to manage and control the key lifecycle, including key rotation and revocation. Using Microsoft-managed keys does not provide control over the keys, and enabling infrastructure encryption adds a secondary layer but still relies on Microsoft-managed keys unless configured otherwise. Configuring a shared access signature (SAS) is related to access control, not encryption key management.